kempo 4.2.4 → 4.2.5

package/server/utils/groups/deleteGroup.js

@@ -0,0 +1,29 @@
+import db from '../../db/index.js';
+import { group } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (name) => {
+  if(!name){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+
+  const owner = name.includes(':') ? name.split(':')[0] : null;
+  if(owner && owner !== 'admin'){
+    return [{ code: 403, msg: `Cannot delete ${owner}-owned groups` }, null];
+  }
+
+  try {
+    const [result] = await db
+      .delete(group)
+      .where(eq(group.name, name))
+      .returning();
+    
+    if(!result){
+      return [{ code: 404, msg: 'Group not found' }, null];
+    }
+    
+    return [null, result];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to delete group' }, null];
+  }
+};

package/server/utils/groups/getGroup.js

@@ -0,0 +1,25 @@
+import db from '../../db/index.js';
+import { group } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (name) => {
+  if(!name){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+  
+  try {
+    const [result] = await db
+      .select()
+      .from(group)
+      .where(eq(group.name, name))
+      .limit(1);
+    
+    if(!result){
+      return [{ code: 404, msg: 'Group not found' }, null];
+    }
+    
+    return [null, result];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve group' }, null];
+  }
+};

package/server/utils/groups/getGroupMembers.js

@@ -0,0 +1,33 @@
+import db from '../../db/index.js';
+import { user, userGroup } from '../../db/schema.js';
+import { eq, sql } from 'drizzle-orm';
+
+export default async (groupName, { limit = 50, offset = 0 } = {}) => {
+  if(!groupName){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+
+  try {
+    const members = await db
+      .select({ user })
+      .from(userGroup)
+      .leftJoin(user, eq(userGroup.userId, user.id))
+      .where(eq(userGroup.groupName, groupName))
+      .limit(limit)
+      .offset(offset);
+
+    const [{ count }] = await db
+      .select({ count: sql`count(*)` })
+      .from(userGroup)
+      .where(eq(userGroup.groupName, groupName));
+
+    return [null, {
+      members: members.map(m => m.user),
+      total: Number(count),
+      limit,
+      offset
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve group members' }, null];
+  }
+};

package/server/utils/groups/listGroups.js

@@ -0,0 +1,21 @@
+import db from '../../db/index.js';
+import { group } from '../../db/schema.js';
+import { eq, sql, and, ne } from 'drizzle-orm';
+
+export default async ({ limit = 50, offset = 0, owner } = {}) => {
+  try {
+    let where;
+    if(owner === 'extension'){
+      where = and(ne(group.owner, 'system'), ne(group.owner, 'custom'));
+    } else if(owner !== undefined){
+      where = eq(group.owner, owner);
+    }
+    const baseQuery = db.select().from(group);
+    const countQuery = db.select({ count: sql`count(*)` }).from(group);
+    const groups = await (where ? baseQuery.where(where) : baseQuery).limit(limit).offset(offset);
+    const [{ count }] = await (where ? countQuery.where(where) : countQuery);
+    return [null, { groups, total: Number(count), limit, offset }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve groups' }, null];
+  }
+};

package/server/utils/groups/removeUserFromGroup.js

@@ -0,0 +1,31 @@
+import db from '../../db/index.js';
+import { userGroup } from '../../db/schema.js';
+import { eq, and } from 'drizzle-orm';
+
+export default async (userId, groupName) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  if(!groupName){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+  
+  try {
+    const [result] = await db
+      .delete(userGroup)
+      .where(and(
+        eq(userGroup.userId, userId),
+        eq(userGroup.groupName, groupName)
+      ))
+      .returning();
+
+    if(!result){
+      return [{ code: 404, msg: 'User is not in this group' }, null];
+    }
+
+    return [null, result];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to remove user from group' }, null];
+  }
+};

package/server/utils/groups/updateGroup.js

@@ -0,0 +1,54 @@
+import db from '../../db/index.js';
+import { group, userGroup, groupPermission } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (name, updates) => {
+  if(!name){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+
+  if(!updates || Object.keys(updates).length === 0){
+    return [{ code: 400, msg: 'Updates are required' }, null];
+  }
+
+  if(name.startsWith('system:')){
+    return [{ code: 403, msg: 'Editing system-owned groups is not allowed' }, null];
+  }
+
+  try {
+    const safeUpdates = {};
+    if(updates.name !== undefined) safeUpdates.name = updates.name;
+    if(updates.description !== undefined) safeUpdates.description = updates.description;
+    safeUpdates.updatedAt = new Date();
+
+    if(safeUpdates.name && safeUpdates.name !== name){
+      let result;
+      await db.transaction(async (tx) => {
+        await tx.update(userGroup).set({ groupName: safeUpdates.name }).where(eq(userGroup.groupName, name));
+        await tx.update(groupPermission).set({ groupName: safeUpdates.name }).where(eq(groupPermission.groupName, name));
+        [result] = await tx.update(group).set(safeUpdates).where(eq(group.name, name)).returning();
+      });
+      if(!result){
+        return [{ code: 404, msg: 'Group not found' }, null];
+      }
+      return [null, result];
+    }
+
+    const [result] = await db
+      .update(group)
+      .set(safeUpdates)
+      .where(eq(group.name, name))
+      .returning();
+
+    if(!result){
+      return [{ code: 404, msg: 'Group not found' }, null];
+    }
+
+    return [null, result];
+  } catch(error){
+    if(error.code === '23505'){
+      return [{ code: 409, msg: 'Group name already exists' }, null];
+    }
+    return [{ code: 500, msg: 'Failed to update group' }, null];
+  }
+};

package/server/utils/hooks/createHook.js

@@ -0,0 +1,29 @@
+import db from '../../db/index.js';
+import { hook } from '../../db/schema.js';
+import crypto from 'crypto';
+
+export default async ({ owner, event, callback }) => {
+  if(!owner){
+    return [{ code: 400, msg: 'Owner is required' }, null];
+  }
+  if(!event){
+    return [{ code: 400, msg: 'Event is required' }, null];
+  }
+  if(!callback){
+    return [{ code: 400, msg: 'Callback is required' }, null];
+  }
+
+  try {
+    const entry = {
+      id: crypto.randomUUID(),
+      owner,
+      event,
+      callback,
+      createdAt: new Date(),
+    };
+    await db.insert(hook).values(entry);
+    return [null, entry];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to create hook' }, null];
+  }
+};

package/server/utils/hooks/deleteHook.js

@@ -0,0 +1,19 @@
+import db from '../../db/index.js';
+import { hook } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async ({ id }) => {
+  if(!id){
+    return [{ code: 400, msg: 'Hook ID is required' }, null];
+  }
+
+  try {
+    const deleted = await db.delete(hook).where(eq(hook.id, id)).returning();
+    if(!deleted.length){
+      return [{ code: 404, msg: 'Hook not found' }, null];
+    }
+    return [null, { success: true }];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to delete hook' }, null];
+  }
+};

package/server/utils/hooks/getHook.js

@@ -0,0 +1,19 @@
+import db from '../../db/index.js';
+import { hook } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async ({ id }) => {
+  if(!id){
+    return [{ code: 400, msg: 'Hook ID is required' }, null];
+  }
+
+  try {
+    const results = await db.select().from(hook).where(eq(hook.id, id)).limit(1);
+    if(!results.length){
+      return [{ code: 404, msg: 'Hook not found' }, null];
+    }
+    return [null, results[0]];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to get hook' }, null];
+  }
+};

package/server/utils/hooks/listHooks.js

@@ -0,0 +1,30 @@
+import db from '../../db/index.js';
+import { hook } from '../../db/schema.js';
+import { eq, sql } from 'drizzle-orm';
+
+export default async ({ event, owner, limit = 50, offset = 0 } = {}) => {
+  try {
+    const conditions = [];
+    if(event) conditions.push(eq(hook.event, event));
+    if(owner) conditions.push(eq(hook.owner, owner));
+
+    const query = db.select().from(hook);
+    const countQuery = db.select({ count: sql`count(*)` }).from(hook);
+
+    if(conditions.length){
+      const { and } = await import('drizzle-orm');
+      const where = conditions.length === 1 ? conditions[0] : and(...conditions);
+      query.where(where);
+      countQuery.where(where);
+    }
+
+    const [items, [{ count }]] = await Promise.all([
+      query.limit(limit).offset(offset),
+      countQuery,
+    ]);
+
+    return [null, { items, total: Number(count), limit, offset }];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to list hooks' }, null];
+  }
+};

package/server/utils/hooks/triggerHook.js

@@ -0,0 +1,61 @@
+import db from '../../db/index.js';
+import { hook } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { createRequire } from 'module';
+import { dirname, join } from 'path';
+
+const handlerCache = new Map();
+
+export const clearHandlerCache = () => handlerCache.clear();
+
+const requireFromProject = createRequire(join(process.cwd(), 'package.json'));
+
+const resolveHandler = (owner, callback) => {
+  if(callback.startsWith('./') || callback.startsWith('../')){
+    try {
+      const pkgPath = requireFromProject.resolve(`${owner}/package.json`);
+      return join(dirname(pkgPath), callback);
+    } catch {
+      return null;
+    }
+  }
+  return callback;
+};
+
+export default async (event, data = {}) => {
+  if(!event){
+    return [{ code: 400, msg: 'Event is required' }, null];
+  }
+
+  try {
+    const hooks = await db.select().from(hook).where(eq(hook.event, event));
+    const results = [];
+
+    for(const h of hooks){
+      const handlerPath = resolveHandler(h.owner, h.callback);
+      if(!handlerPath) continue;
+
+      let handler = handlerCache.get(handlerPath);
+      if(!handler){
+        try {
+          const mod = await import(handlerPath);
+          handler = mod.default || mod;
+          handlerCache.set(handlerPath, handler);
+        } catch {
+          continue;
+        }
+      }
+
+      try {
+        const result = await handler(data);
+        results.push({ hookId: h.id, owner: h.owner, result });
+      } catch(err) {
+        results.push({ hookId: h.id, owner: h.owner, error: err.message });
+      }
+    }
+
+    return [null, { results }];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to trigger hooks' }, null];
+  }
+};

package/server/utils/hooks/updateHook.js

@@ -0,0 +1,27 @@
+import db from '../../db/index.js';
+import { hook } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async ({ id, callback }) => {
+  if(!id){
+    return [{ code: 400, msg: 'Hook ID is required' }, null];
+  }
+  if(!callback){
+    return [{ code: 400, msg: 'Callback is required' }, null];
+  }
+
+  try {
+    const updated = await db.update(hook)
+      .set({ callback })
+      .where(eq(hook.id, id))
+      .returning();
+
+    if(!updated.length){
+      return [{ code: 404, msg: 'Hook not found' }, null];
+    }
+
+    return [null, updated[0]];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to update hook' }, null];
+  }
+};

package/server/utils/pages/createPage.js

@@ -0,0 +1,60 @@
+import { writeFile, mkdir } from 'fs/promises';
+import { join, dirname } from 'path';
+import { existsSync } from 'fs';
+
+const slugify = name => name
+  .toLowerCase()
+  .trim()
+  .replace(/[^\w\s-]/g, '')
+  .replace(/[\s_]+/g, '-')
+  .replace(/-+/g, '-')
+  .replace(/^-|-$/g, '');
+
+export default async ({ rootDir, directory, name, template, author }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!name){
+    return [{ code: 400, msg: 'Page name is required' }, null];
+  }
+
+  const slug = slugify(name);
+  if(!slug){
+    return [{ code: 400, msg: 'Page name must contain valid characters' }, null];
+  }
+
+  const dir = directory && directory !== '.' && directory !== '/'
+    ? directory.replace(/^\//, '').replace(/\/$/, '')
+    : '';
+  const filePath = dir
+    ? join(rootDir, dir, `${slug}.page.html`)
+    : join(rootDir, `${slug}.page.html`);
+
+  if(existsSync(filePath)){
+    return [{ code: 409, msg: 'A page with this name already exists in this location' }, null];
+  }
+
+  const templateName = template || 'default';
+
+  const now = new Date().toISOString();
+  const frontmatter = [
+    '<!--',
+    `  owner: custom`,
+    `  name: ${name}`,
+    `  author: ${author || ''}`,
+    `  created: ${now}`,
+    `  updated: ${now}`,
+    '-->'
+  ].join('\n');
+
+  const pageContent = `${frontmatter}\n<page template="${templateName}" title="${name}">\n</page>\n`;
+
+  const pageDir = dirname(filePath);
+  await mkdir(pageDir, { recursive: true });
+  await writeFile(filePath, pageContent, 'utf-8');
+
+  const relPath = (dir ? `${dir}/${slug}` : slug);
+  const url = '/' + relPath;
+
+  return [null, { file: `${relPath}.page.html`, url, title: name, slug }];
+};

package/server/utils/pages/deletePage.js

@@ -0,0 +1,35 @@
+import { readFile, unlink } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, files }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!files?.length) return [{ code: 400, msg: 'No files specified' }, null];
+
+  for(const file of files){
+    const normalized = normalize(file);
+    if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+      return [{ code: 400, msg: 'Invalid file path' }, null];
+    }
+
+    const fullPath = join(rootDir, normalized);
+    let content;
+    try {
+      content = await readFile(fullPath, 'utf-8');
+    } catch {
+      continue;
+    }
+
+    const meta = parseFrontmatter(content);
+    if(meta.locked === 'true'){
+      return [{ code: 403, msg: `Cannot delete locked page: ${file}` }, null];
+    }
+    if(meta.owner && meta.owner !== 'custom'){
+      return [{ code: 403, msg: `Cannot delete page: ${file}` }, null];
+    }
+
+    await unlink(fullPath);
+  }
+
+  return [null, { deleted: files.length }];
+};

package/server/utils/pages/disablePage.js

@@ -0,0 +1,37 @@
+import { readFile, rename } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+
+  const normalized = normalize(file);
+  if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  if(!normalized.endsWith('.page.html')){
+    return [{ code: 400, msg: 'File must be a .page.html file' }, null];
+  }
+
+  const fullPath = join(rootDir, normalized);
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Page not found' }, null];
+  }
+
+  const content = await readFile(fullPath, 'utf-8');
+  const meta = parseFrontmatter(content);
+  if(meta.locked === 'true'){
+    return [{ code: 403, msg: 'Cannot disable a locked page' }, null];
+  }
+
+  const disabledPath = fullPath.replace(/\.page\.html$/, '.page-disabled.html');
+  if(existsSync(disabledPath)){
+    return [{ code: 409, msg: 'A disabled version of this page already exists' }, null];
+  }
+
+  await rename(fullPath, disabledPath);
+  return [null, { file: normalized.replace(/\.page\.html$/, '.page-disabled.html') }];
+};

package/server/utils/pages/enablePage.js

@@ -0,0 +1,30 @@
+import { rename } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import { existsSync } from 'fs';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+
+  const normalized = normalize(file);
+  if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  if(!normalized.endsWith('.page-disabled.html')){
+    return [{ code: 400, msg: 'File must be a .page-disabled.html file' }, null];
+  }
+
+  const fullPath = join(rootDir, normalized);
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Disabled page not found' }, null];
+  }
+
+  const enabledPath = fullPath.replace(/\.page-disabled\.html$/, '.page.html');
+  if(existsSync(enabledPath)){
+    return [{ code: 409, msg: 'An enabled version of this page already exists' }, null];
+  }
+
+  await rename(fullPath, enabledPath);
+  return [null, { file: normalized.replace(/\.page-disabled\.html$/, '.page.html') }];
+};

package/server/utils/pages/getPage.js

@@ -0,0 +1,53 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+const parseContents = content => {
+  const blocks = [];
+  const regex = /<content(?:\s+location="([^"]*)")?\s*>([\s\S]*?)<\/content>/g;
+  let match;
+  while((match = regex.exec(content)) !== null){
+    blocks.push({
+      location: match[1] || 'default',
+      content: match[2].trim()
+    });
+  }
+  return blocks;
+};
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!file){
+    return [{ code: 400, msg: 'File path is required' }, null];
+  }
+
+  const safePath = file.replace(/\.\./g, '').replace(/^\//, '');
+  const fullPath = join(rootDir, safePath);
+
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Page not found' }, null];
+  }
+
+  const raw = await readFile(fullPath, 'utf-8');
+  const meta = parseFrontmatter(raw);
+  const titleMatch = raw.match(/<page\s[^>]*title="([^"]*)"/);
+  const templateMatch = raw.match(/<page\s[^>]*template="([^"]*)"/);
+  const contents = parseContents(raw);
+
+  return [null, {
+    file: safePath,
+    name: meta.name || '',
+    title: titleMatch ? titleMatch[1] : (meta.title || ''),
+    template: templateMatch ? templateMatch[1] : 'default',
+    owner: meta.owner || 'custom',
+    locked: meta.locked === 'true',
+    author: meta.author || '',
+    description: meta.description || '',
+    createdAt: meta.created || '',
+    updatedAt: meta.updated || '',
+    contents
+  }];
+};

package/server/utils/pages/listDirectories.js

@@ -0,0 +1,18 @@
+import { relative } from 'path';
+import scanDir from '../fs/scanDir.js';
+
+export default async ({ rootDir }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  const dirs = await scanDir(rootDir, rootDir, (fullPath, entry, root) => {
+    if(!entry.isDirectory()) return null;
+    return relative(root, fullPath).replace(/\\/g, '/');
+  });
+  dirs.sort();
+  dirs.unshift('.');
+
+  return [null, { directories: dirs }];
+};
+

package/server/utils/pages/listPages.js

@@ -0,0 +1,40 @@
+import { readFile } from 'fs/promises';
+import { relative } from 'path';
+import scanDir from '../fs/scanDir.js';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  const pages = await scanDir(rootDir, rootDir, async (fullPath, entry, root) => {
+    const isDisabled = entry.name.endsWith('.page-disabled.html');
+    if(entry.isDirectory() || (!entry.name.endsWith('.page.html') && !isDisabled)) return null;
+    const content = await readFile(fullPath, 'utf-8');
+    const meta = parseFrontmatter(content);
+    const pageTitle = content.match(/<page\s[^>]*title="([^"]*)">/);
+    if(!meta.title && pageTitle) meta.title = pageTitle[1];
+    const relPath = relative(root, fullPath).replace(/\\/g, '/');
+    const urlPath = '/' + relPath
+      .replace(/\.page-disabled\.html$/, '')
+      .replace(/\.page\.html$/, '')
+      .replace(/(^|\/)index$/, '$1');
+    return {
+      file: relPath,
+      url: urlPath || '/',
+      name: meta.name || meta.title || '',
+      title: meta.title || '',
+      owner: meta.owner || 'custom',
+      locked: meta.locked === 'true',
+      disabled: isDisabled,
+      author: meta.author || '',
+      description: meta.description || '',
+      createdAt: meta.created || '',
+      updatedAt: meta.updated || ''
+    };
+  });
+
+  return [null, { pages, total: pages.length }];
+};
+