kempo 4.2.30 → 4.2.32

package/middleware/kempo.js

@@ -212,16 +212,23 @@ export default config => {
             Revalidated rather than immutable. The URL carries lexical's version but not kempo's, so
             rebuilding kempo changes what lives at the same URL, and caching that for a year would
             strand every client on a stale bundle. A 304 costs almost nothing.
+
+            `no-cache`, not `must-revalidate` alone: without an explicit max-age, must-revalidate
+            leaves freshness to the browser's heuristics, and a heuristically-fresh entry is served
+            straight from disk cache with no conditional request at all — so a stale entry chunk can
+            keep pointing at a chunk hash a rebuild already deleted, breaking the editor with no
+            network request to observe. no-cache forces a conditional GET on every load regardless of
+            heuristic freshness, so a rebuild is always picked up via the ETag check above.
           */
           const etag = `"${info.size}-${Math.floor(info.mtimeMs)}"`;
           if(request.headers['if-none-match'] === etag){
-            response.writeHead(304, { ETag: etag, 'Cache-Control': 'public, must-revalidate' });
+            response.writeHead(304, { ETag: etag, 'Cache-Control': 'public, no-cache' });
             response.end();
             return;
           }
           response.writeHead(200, {
             'Content-Type': 'application/javascript; charset=utf-8',
-            'Cache-Control': 'public, must-revalidate',
+            'Cache-Control': 'public, no-cache',
             ETag: etag,
           });
           response.end(await readFile(file));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo",
-  "version": "4.2.30",
+  "version": "4.2.32",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {

package/server/utils/extensions/dependencies.js

@@ -0,0 +1,26 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+/*
+  An extension declares the other extensions it requires via kempo-config.json's `dependencies`
+  array (a list of extension names). Enforced at install/enable time (a dependency must already be
+  enabled) and in reverse at disable/uninstall time (nothing enabled may be left depending on an
+  extension that is going away).
+*/
+
+export const getUnmetDependencies = async (dependencies = []) => {
+  if(!dependencies.length) return [];
+  const rows = await db.select({ name: extension.name, enabled: extension.enabled }).from(extension);
+  const enabled = new Set(rows.filter(row => row.enabled).map(row => row.name));
+  return dependencies.filter(dep => !enabled.has(dep));
+};
+
+export const getEnabledDependents = async (name) => {
+  const rows = await db.select({ name: extension.name, kempo: extension.kempo })
+    .from(extension)
+    .where(eq(extension.enabled, true));
+  return rows
+    .filter(row => row.name !== name && (row.kempo?.dependencies || []).includes(name))
+    .map(row => row.name);
+};

package/server/utils/extensions/disableExtension.js

@@ -2,12 +2,18 @@ import db from '../../db/index.js';
 import { extension } from '../../db/schema.js';
 import { eq } from 'drizzle-orm';
 import { invalidateScopeCache } from './scopeCache.js';
+import { getEnabledDependents } from './dependencies.js';
 
 export default async ({ name }) => {
   if(!name){
     return [{ code: 400, msg: 'Extension name is required' }, null];
   }
 
+  const dependents = await getEnabledDependents(name);
+  if(dependents.length){
+    return [{ code: 409, msg: `${dependents.join(', ')} depends on this extension and is still enabled` }, null];
+  }
+
   try {
     const updated = await db.update(extension)
       .set({ enabled: false, updatedAt: new Date() })

package/server/utils/extensions/enableExtension.js

@@ -2,6 +2,7 @@ import db from '../../db/index.js';
 import { extension } from '../../db/schema.js';
 import { eq } from 'drizzle-orm';
 import { invalidateScopeCache } from './scopeCache.js';
+import { getUnmetDependencies } from './dependencies.js';
 
 export default async ({ name }) => {
   if(!name){
@@ -9,17 +10,23 @@ export default async ({ name }) => {
   }
 
   try {
-    const updated = await db.update(extension)
+    const [existing] = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
+    if(!existing){
+      return [{ code: 404, msg: 'Extension not found' }, null];
+    }
+
+    const unmet = await getUnmetDependencies(existing.kempo?.dependencies || []);
+    if(unmet.length){
+      return [{ code: 409, msg: `Requires ${unmet.join(', ')} to be enabled first` }, null];
+    }
+
+    const [updated] = await db.update(extension)
       .set({ enabled: true, updatedAt: new Date() })
       .where(eq(extension.name, name))
       .returning();
 
-    if(!updated.length){
-      return [{ code: 404, msg: 'Extension not found' }, null];
-    }
-
     invalidateScopeCache();
-    return [null, updated[0]];
+    return [null, updated];
   } catch(error) {
     return [{ code: 500, msg: 'Failed to enable extension' }, null];
   }

package/server/utils/extensions/installExtension.js

@@ -11,6 +11,7 @@ import createHook from '../hooks/createHook.js';
 import setSetting from '../settings/setSetting.js';
 import createTablesFromSchema from './createTablesFromSchema.js';
 import { invalidateScopeCache } from './scopeCache.js';
+import { getUnmetDependencies } from './dependencies.js';
 
 export default async ({ name }) => {
   if(!name){
@@ -44,6 +45,11 @@ export default async ({ name }) => {
     return [{ code: 500, msg: `Failed to read extension package files` }, null];
   }
 
+  const unmet = await getUnmetDependencies(kempoConfig.dependencies || []);
+  if(unmet.length){
+    return [{ code: 409, msg: `Requires ${unmet.join(', ')} to be installed and enabled first` }, null];
+  }
+
   /*
     Create tables from declarative schema
   */

package/server/utils/extensions/uninstallExtension.js

@@ -6,6 +6,7 @@ import { pathToFileURL } from 'url';
 import { sql } from 'drizzle-orm';
 import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
 import { invalidateScopeCache } from './scopeCache.js';
+import { getEnabledDependents } from './dependencies.js';
 
 /*
   Uninstall an extension.
@@ -38,6 +39,11 @@ export default async ({ name, purgeData = false }) => {
     return [{ code: 500, msg: 'Failed to find extension' }, null];
   }
 
+  const dependents = await getEnabledDependents(name);
+  if(dependents.length){
+    return [{ code: 409, msg: `${dependents.join(', ')} depends on this extension and is still enabled` }, null];
+  }
+
   try {
     const extRoot = join(process.cwd(), 'node_modules', name);
     const uninstallModule = await import(pathToFileURL(join(extRoot, 'uninstall.js')).href + `?t=${Date.now()}`).catch(() => null);