kempo 4.2.3 → 4.2.5

package/server/utils/sessions/createSession.js

@@ -0,0 +1,36 @@
+import crypto from 'crypto';
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import getSetting from '../settings/getSetting.js';
+
+export default async (userId) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  try {
+    const sessionToken = crypto.randomBytes(32).toString('hex');
+    const [error, sessionDurationDays] = await getSetting('system', 'session_duration_days', 7);
+    
+    if(error){
+      return [error, null];
+    }
+    
+    const expiresAt = new Date(Date.now() + sessionDurationDays * 24 * 60 * 60 * 1000);
+    const now = new Date();
+    
+    await db.insert(session).values({
+      token: sessionToken,
+      userId,
+      expiresAt,
+      createdAt: now,
+    });
+
+    return [null, {
+      sessionToken,
+      expiresAt,
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to create session' }, null];
+  }
+};

package/server/utils/sessions/deleteExpiredUserSessions.js

@@ -0,0 +1,22 @@
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import { eq, lt, and } from 'drizzle-orm';
+
+export default async (userId) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+
+  try {
+    const deleted = await db.delete(session)
+      .where(and(
+        eq(session.userId, userId),
+        lt(session.expiresAt, new Date())
+      ))
+      .returning();
+
+    return [null, { deleted: deleted.length }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to delete expired sessions' }, null];
+  }
+};

package/server/utils/sessions/deleteSession.js

@@ -0,0 +1,16 @@
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (token) => {
+  if(!token){
+    return [{ code: 400, msg: 'Session token is required' }, null];
+  }
+  
+  try {
+    await db.delete(session).where(eq(session.token, token));
+    return [null, { token }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to delete session' }, null];
+  }
+};

package/server/utils/sessions/deleteUserSessions.js

@@ -0,0 +1,16 @@
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (userId) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  try {
+    await db.delete(session).where(eq(session.userId, userId));
+    return [null, { userId }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to delete user sessions' }, null];
+  }
+};

package/server/utils/sessions/getSessionById.js

@@ -0,0 +1,21 @@
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (token) => {
+  if(!token){
+    return [{ code: 400, msg: 'Session token is required' }, null];
+  }
+  
+  try {
+    const result = await db.select().from(session).where(eq(session.token, token)).limit(1);
+    
+    if(!result[0]){
+      return [{ code: 404, msg: 'Session not found' }, null];
+    }
+    
+    return [null, result[0]];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve session' }, null];
+  }
+};

package/server/utils/sessions/getSessionByToken.js

@@ -0,0 +1,21 @@
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (token) => {
+  if(!token){
+    return [{ code: 400, msg: 'Session token is required' }, null];
+  }
+  
+  try {
+    const result = await db.select().from(session).where(eq(session.token, token)).limit(1);
+    
+    if(!result[0]){
+      return [{ code: 404, msg: 'Session not found' }, null];
+    }
+    
+    return [null, result[0]];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve session' }, null];
+  }
+};

package/server/utils/sessions/getSessions.js

@@ -0,0 +1,19 @@
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import { sql } from 'drizzle-orm';
+
+export default async ({ limit = 50, offset = 0 } = {}) => {
+  try {
+    const sessions = await db.select().from(session).limit(limit).offset(offset);
+    const [{ count }] = await db.select({ count: sql`count(*)` }).from(session);
+    
+    return [null, {
+      sessions,
+      total: Number(count),
+      limit,
+      offset
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve sessions' }, null];
+  }
+};

package/server/utils/sessions/getUserSessions.js

@@ -0,0 +1,30 @@
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import { eq, sql } from 'drizzle-orm';
+
+export default async (userId, { limit = 50, offset = 0 } = {}) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  try {
+    const sessions = await db.select()
+      .from(session)
+      .where(eq(session.userId, userId))
+      .limit(limit)
+      .offset(offset);
+    
+    const [{ count }] = await db.select({ count: sql`count(*)` })
+      .from(session)
+      .where(eq(session.userId, userId));
+    
+    return [null, {
+      sessions,
+      total: Number(count),
+      limit,
+      offset
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve user sessions' }, null];
+  }
+};

package/server/utils/settings/deleteSetting.js

@@ -0,0 +1,24 @@
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (owner, name) => {
+  if(!owner || !name){
+    return [{ code: 400, msg: 'Both owner and name are required' }, null];
+  }
+  
+  if(owner === 'system'){
+    return [{ code: 403, msg: 'Cannot delete system settings' }, null];
+  }
+  
+  try {
+    const fullName = `${owner}:${name}`;
+    await db
+      .delete(setting)
+      .where(eq(setting.name, fullName));
+    
+    return [null, { deleted: true, name: fullName }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to delete setting' }, null];
+  }
+};

package/server/utils/settings/getPublicSettings.js

@@ -0,0 +1,22 @@
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { convertValue } from './helpers.js';
+
+export default async () => {
+  try {
+    const results = await db
+      .select()
+      .from(setting)
+      .where(eq(setting.isPublic, true));
+
+    const settings = {};
+    for(const s of results){
+      settings[s.name] = convertValue(s.value, s.type);
+    }
+
+    return [null, settings];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve public settings' }, null];
+  }
+};

package/server/utils/settings/getSetting.js

@@ -0,0 +1,25 @@
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { convertValue } from './helpers.js';
+
+export default async (owner, name, defaultValue = null) => {
+  if(!owner || !name){
+    return [{ code: 400, msg: 'Both owner and name are required' }, null];
+  }
+  
+  try {
+    const fullName = `${owner}:${name}`;
+    const [result] = await db
+      .select()
+      .from(setting)
+      .where(eq(setting.name, fullName))
+      .limit(1);
+    
+    if(!result) return [null, defaultValue];
+    
+    return [null, convertValue(result.value, result.type)];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve setting' }, null];
+  }
+};

package/server/utils/settings/getSettingWithMetadata.js

@@ -0,0 +1,33 @@
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { convertValue } from './helpers.js';
+
+export default async (owner, name) => {
+  if(!owner || !name){
+    return [{ code: 400, msg: 'Both owner and name are required' }, null];
+  }
+  
+  try {
+    const fullName = `${owner}:${name}`;
+    const [result] = await db
+      .select()
+      .from(setting)
+      .where(eq(setting.name, fullName))
+      .limit(1);
+    
+    if(!result) return [{ code: 404, msg: 'Setting not found' }, null];
+    
+    return [null, {
+      name: result.name,
+      value: convertValue(result.value, result.type),
+      type: result.type,
+      isPublic: result.isPublic,
+      description: result.description,
+      createdAt: result.createdAt,
+      updatedAt: result.updatedAt
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve setting' }, null];
+  }
+};

package/server/utils/settings/getSettingsByOwner.js

@@ -0,0 +1,23 @@
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+import { like } from 'drizzle-orm';
+import { convertValue } from './helpers.js';
+
+export default async (owner) => {
+  if(!owner){
+    return [{ code: 400, msg: 'Owner is required' }, null];
+  }
+  
+  try {
+    const results = await db
+      .select()
+      .from(setting)
+      .where(like(setting.name, `${owner}:%`));
+    
+    return [null, Object.fromEntries(
+      results.map(s => [s.name, convertValue(s.value, s.type)])
+    )];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve settings' }, null];
+  }
+};

package/server/utils/settings/helpers.js

@@ -0,0 +1,29 @@
+export const convertValue = (value, type) => {
+  if(value === null) return null;
+  
+  switch(type){
+    case 'number':
+      return Number(value);
+    case 'boolean':
+      return value === 'true';
+    case 'json':
+      return JSON.parse(value);
+    case 'string':
+    default:
+      return value;
+  }
+};
+
+export const serializeValue = (value, type) => {
+  if(value === null) return null;
+  
+  switch(type){
+    case 'json':
+      return JSON.stringify(value);
+    case 'number':
+    case 'boolean':
+    case 'string':
+    default:
+      return String(value);
+  }
+};

package/server/utils/settings/listSettings.js

@@ -0,0 +1,25 @@
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+import { like, not, and, sql } from 'drizzle-orm';
+
+export default async ({ owner, limit = 50, offset = 0 } = {}) => {
+  try {
+    let where;
+    if(owner === 'system' || owner === 'custom'){
+      where = like(setting.name, `${owner}:%`);
+    } else if(owner === 'extension'){
+      where = and(
+        not(like(setting.name, 'system:%')),
+        not(like(setting.name, 'custom:%'))
+      );
+    }
+    const q = db.select().from(setting);
+    const cq = db.select({ count: sql`count(*)` }).from(setting);
+    if(where){ q.where(where); cq.where(where); }
+    const settings = await q.limit(limit).offset(offset);
+    const [{ count }] = await cq;
+    return [null, { settings, total: Number(count), limit, offset }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve settings' }, null];
+  }
+};

package/server/utils/settings/setSetting.js

@@ -0,0 +1,49 @@
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { serializeValue } from './helpers.js';
+
+export default async (owner, name, value, type = null, isPublic = false, description = null) => {
+  if(!owner || !name){
+    return [{ code: 400, msg: 'Both owner and name are required' }, null];
+  }
+  
+  try {
+    const fullName = `${owner}:${name}`;
+    const detectedType = type || (typeof value === 'object' ? 'json' : typeof value);
+    const serializedValue = serializeValue(value, detectedType);
+    
+    const existing = await db
+      .select()
+      .from(setting)
+      .where(eq(setting.name, fullName))
+      .limit(1);
+    
+    if(existing.length > 0){
+      await db
+        .update(setting)
+        .set({ 
+          value: serializedValue,
+          type: detectedType,
+          isPublic,
+          description,
+          updatedAt: new Date() 
+        })
+        .where(eq(setting.name, fullName));
+    } else {
+      await db.insert(setting).values({
+        name: fullName,
+        value: serializedValue,
+        type: detectedType,
+        isPublic,
+        description,
+        createdAt: new Date(),
+        updatedAt: new Date()
+      });
+    }
+    
+    return [null, { name: fullName, value, type: detectedType, isPublic, description }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to save setting' }, null];
+  }
+};

package/server/utils/templates/createTemplate.js

@@ -0,0 +1,71 @@
+import { readFile, writeFile, mkdir } from 'fs/promises';
+import { join, dirname } from 'path';
+import { existsSync } from 'fs';
+
+const slugify = name => name
+  .toLowerCase()
+  .trim()
+  .replace(/[^\w\s-]/g, '')
+  .replace(/[\s_]+/g, '-')
+  .replace(/-+/g, '-')
+  .replace(/^-|-$/g, '');
+
+export default async ({ rootDir, directory, name, author, copyFrom }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!name) return [{ code: 400, msg: 'Template name is required' }, null];
+
+  const slug = slugify(name);
+  if(!slug) return [{ code: 400, msg: 'Template name must contain valid characters' }, null];
+
+  const dir = directory && directory !== '.' && directory !== '/'
+    ? directory.replace(/^\//, '').replace(/\/$/, '')
+    : '';
+  const filePath = dir
+    ? join(rootDir, dir, `${slug}.template.html`)
+    : join(rootDir, `${slug}.template.html`);
+
+  if(existsSync(filePath)) return [{ code: 409, msg: 'A template with this name already exists in this location' }, null];
+
+  const now = new Date().toISOString();
+  const frontmatter = [
+    '<!--',
+    `  owner: custom`,
+    `  author: ${author || ''}`,
+    `  created: ${now}`,
+    `  updated: ${now}`,
+    '-->'
+  ].join('\n');
+
+  let markup;
+  if(copyFrom){
+    const safeCopy = copyFrom.replace(/\.\./g, '').replace(/^\//, '');
+    const copyPath = join(rootDir, safeCopy);
+    if(!existsSync(copyPath)) return [{ code: 404, msg: 'Source template not found' }, null];
+    const raw = await readFile(copyPath, 'utf-8');
+    const frontmatterMatch = raw.match(/^<!--\s*\n[\s\S]*?\n\s*-->\n?/);
+    markup = frontmatterMatch ? raw.slice(frontmatterMatch[0].length) : raw;
+  } else {
+    markup = `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{title}}</title>
+    <location name="head" />
+</head>
+<body>
+    <location />
+    <location name="scripts" />
+</body>
+</html>
+`;
+  }
+
+  const pageDir = dirname(filePath);
+  await mkdir(pageDir, { recursive: true });
+  await writeFile(filePath, `${frontmatter}\n${markup}`, 'utf-8');
+
+  const relPath = dir ? `${dir}/${slug}.template.html` : `${slug}.template.html`;
+
+  return [null, { file: relPath, name, slug }];
+};

package/server/utils/templates/deleteTemplate.js

@@ -0,0 +1,35 @@
+import { readFile, unlink } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, files }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!files?.length) return [{ code: 400, msg: 'No files specified' }, null];
+
+  for(const file of files){
+    const normalized = normalize(file);
+    if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+      return [{ code: 400, msg: 'Invalid file path' }, null];
+    }
+
+    const fullPath = join(rootDir, normalized);
+    let content;
+    try {
+      content = await readFile(fullPath, 'utf-8');
+    } catch {
+      continue;
+    }
+
+    const meta = parseFrontmatter(content);
+    if(meta.locked === 'true'){
+      return [{ code: 403, msg: `Cannot delete locked template: ${file}` }, null];
+    }
+    if(meta.owner && meta.owner !== 'custom'){
+      return [{ code: 403, msg: `Cannot delete template: ${file}` }, null];
+    }
+
+    await unlink(fullPath);
+  }
+
+  return [null, { deleted: files.length }];
+};

package/server/utils/templates/disableTemplate.js

@@ -0,0 +1,37 @@
+import { readFile, rename } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+
+  const normalized = normalize(file);
+  if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  if(!normalized.endsWith('.template.html')){
+    return [{ code: 400, msg: 'File must be a .template.html file' }, null];
+  }
+
+  const fullPath = join(rootDir, normalized);
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Template not found' }, null];
+  }
+
+  const content = await readFile(fullPath, 'utf-8');
+  const meta = parseFrontmatter(content);
+  if(meta.locked === 'true'){
+    return [{ code: 403, msg: 'Cannot disable a locked template' }, null];
+  }
+
+  const disabledPath = fullPath.replace(/\.template\.html$/, '.template-disabled.html');
+  if(existsSync(disabledPath)){
+    return [{ code: 409, msg: 'A disabled version of this template already exists' }, null];
+  }
+
+  await rename(fullPath, disabledPath);
+  return [null, { file: normalized.replace(/\.template\.html$/, '.template-disabled.html') }];
+};

package/server/utils/templates/enableTemplate.js

@@ -0,0 +1,30 @@
+import { rename } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import { existsSync } from 'fs';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+
+  const normalized = normalize(file);
+  if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  if(!normalized.endsWith('.template-disabled.html')){
+    return [{ code: 400, msg: 'File must be a .template-disabled.html file' }, null];
+  }
+
+  const fullPath = join(rootDir, normalized);
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Disabled template not found' }, null];
+  }
+
+  const enabledPath = fullPath.replace(/\.template-disabled\.html$/, '.template.html');
+  if(existsSync(enabledPath)){
+    return [{ code: 409, msg: 'An enabled version of this template already exists' }, null];
+  }
+
+  await rename(fullPath, enabledPath);
+  return [null, { file: normalized.replace(/\.template-disabled\.html$/, '.template.html') }];
+};

package/server/utils/templates/getTemplate.js

@@ -0,0 +1,30 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+
+  const safePath = file.replace(/\.\./g, '').replace(/^\//, '');
+  const fullPath = join(rootDir, safePath);
+
+  if(!existsSync(fullPath)) return [{ code: 404, msg: 'Template not found' }, null];
+
+  const raw = await readFile(fullPath, 'utf-8');
+  const meta = parseFrontmatter(raw);
+  const frontmatterMatch = raw.match(/^<!--\s*\n[\s\S]*?\n\s*-->\n?/);
+  const markup = frontmatterMatch ? raw.slice(frontmatterMatch[0].length) : raw;
+
+  return [null, {
+    file: safePath,
+    name: safePath.replace(/\.template\.html$/, '').split('/').pop(),
+    owner: meta.owner || 'custom',
+    locked: meta.locked === 'true',
+    author: meta.author || '',
+    createdAt: meta.created || '',
+    updatedAt: meta.updated || '',
+    markup
+  }];
+};