kempo 4.2.4 → 4.2.5

package/server/utils/pages/listTemplates.js

@@ -0,0 +1,52 @@
+import { readFile } from 'fs/promises';
+import { relative, dirname } from 'path';
+import scanDir from '../fs/scanDir.js';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+const parseLocations = content => {
+  const locations = [];
+  const regex = /<location\s([^/]*?)\s*\/>/g;
+  let match;
+  while((match = regex.exec(content)) !== null){
+    const attrs = match[1];
+    const nameMatch = /name="([^"]*)"/.exec(attrs);
+    const labelMatch = /label="([^"]*)"/.exec(attrs);
+    locations.push({
+      name: nameMatch?.[1] || 'default',
+      label: labelMatch?.[1] || null
+    });
+  }
+  return locations;
+};
+
+export default async ({ rootDir }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  const templates = await scanDir(rootDir, rootDir, async (fullPath, entry, root) => {
+    const isDisabled = entry.name.endsWith('.template-disabled.html');
+    if(entry.isDirectory() || (!entry.name.endsWith('.template.html') && !isDisabled)) return null;
+    const content = await readFile(fullPath, 'utf-8');
+    const meta = parseFrontmatter(content);
+    const name = entry.name
+      .replace('.template-disabled.html', '')
+      .replace('.template.html', '');
+    const relDir = relative(root, dirname(fullPath)).replace(/\\/g, '/');
+    return {
+      name,
+      directory: relDir || '.',
+      path: relative(root, fullPath).replace(/\\/g, '/'),
+      owner: meta.owner || 'custom',
+      locked: meta.locked === 'true',
+      disabled: isDisabled,
+      author: meta.author || '',
+      createdAt: meta.created || '',
+      updatedAt: meta.updated || '',
+      locations: parseLocations(content)
+    };
+  });
+
+  return [null, { templates, total: templates.length }];
+};
+

package/server/utils/pages/movePage.js

@@ -0,0 +1,54 @@
+import { readFile, rename, mkdir, readdir, rmdir } from 'fs/promises';
+import { join, normalize, dirname, sep } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+const isTraversal = path => path.startsWith('..') || path.includes('..' + sep);
+
+export default async ({ rootDir, file, newFile }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+  if(!newFile) return [{ code: 400, msg: 'New file path is required' }, null];
+
+  const normalizedFile = normalize(file);
+  const normalizedNewFile = normalize(newFile);
+
+  if(isTraversal(normalizedFile) || isTraversal(normalizedNewFile)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  const fullPath = join(rootDir, normalizedFile);
+  const fullNewPath = join(rootDir, normalizedNewFile);
+
+  let content;
+  try {
+    content = await readFile(fullPath, 'utf-8');
+  } catch {
+    return [{ code: 404, msg: 'Page not found' }, null];
+  }
+
+  const meta = parseFrontmatter(content);
+  if(meta.locked === 'true'){
+    return [{ code: 403, msg: 'Cannot move a locked page' }, null];
+  }
+  if(meta.owner && meta.owner !== 'custom'){
+    return [{ code: 403, msg: 'Cannot move system pages' }, null];
+  }
+
+  if(existsSync(fullNewPath)){
+    return [{ code: 409, msg: 'A page already exists at the new location' }, null];
+  }
+
+  await mkdir(dirname(fullNewPath), { recursive: true });
+  await rename(fullPath, fullNewPath);
+
+  let dir = dirname(fullPath);
+  while(dir.startsWith(rootDir) && dir !== rootDir){
+    const entries = await readdir(dir);
+    if(entries.length > 0) break;
+    await rmdir(dir);
+    dir = dirname(dir);
+  }
+
+  return [null, { file: newFile }];
+};

package/server/utils/pages/updatePage.js

@@ -0,0 +1,74 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+
+export default async ({ rootDir, file, name, title, description, author, template, contents }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!file){
+    return [{ code: 400, msg: 'File path is required' }, null];
+  }
+
+  const safePath = file.replace(/\.\./g, '').replace(/^\//, '');
+  const fullPath = join(rootDir, safePath);
+
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Page not found' }, null];
+  }
+
+  const raw = await readFile(fullPath, 'utf-8');
+
+  const frontmatterMatch = raw.match(/^<!--\s*\n([\s\S]*?)\n\s*-->/);
+  const lockedMatch = raw.match(/^<!--[\s\S]*?locked:\s*true[\s\S]*?-->/);
+  if(lockedMatch) return [{ code: 403, msg: 'This page is locked and cannot be edited' }, null];
+  const existingMeta = {};
+  if(frontmatterMatch){
+    for(const line of frontmatterMatch[1].split('\n')){
+      const idx = line.indexOf(':');
+      if(idx === -1) continue;
+      const key = line.slice(0, idx).trim();
+      const value = line.slice(idx + 1).trim();
+      if(key) existingMeta[key] = value;
+    }
+  }
+
+  const now = new Date().toISOString();
+  const newMeta = {
+    ...existingMeta,
+    updated: now
+  };
+  if(name !== undefined) newMeta.name = name;
+  if(title !== undefined) newMeta.title = title;
+  if(description !== undefined) newMeta.description = description;
+  if(author !== undefined) newMeta.author = author;
+
+  const templateMatch = raw.match(/<page\s[^>]*template="([^"]*)"/)
+  const resolvedTemplate = template !== undefined ? template : (templateMatch ? templateMatch[1] : 'default');
+
+  const frontmatter = '<!--\n' +
+    Object.entries(newMeta).map(([k, v]) => `  ${k}: ${v}`).join('\n') +
+    '\n-->';
+
+  const titleMatch = raw.match(/<page\s[^>]*title="[^"]*"/);
+  const newTitle = title !== undefined ? title : (titleMatch ? titleMatch[0].match(/title="([^"]*)"/)[1] : '');
+
+  let contentBlocks = '';
+  if(contents && contents.length){
+    contentBlocks = contents
+      .filter(({ content }) => content.trim())
+      .map(({ location, content }) => location === 'default'
+        ? `<content>\n${content}\n</content>`
+        : `<content location="${location}">\n${content}\n</content>`)
+      .join('\n');
+  } else {
+    const originalBlocks = raw.match(/<content[\s\S]*?<\/content>/g) || [];
+    contentBlocks = originalBlocks.join('\n');
+  }
+
+  const newPageContent = `${frontmatter}\n<page template="${resolvedTemplate}" title="${newTitle}">\n${contentBlocks}\n</page>\n`;
+
+  await writeFile(fullPath, newPageContent, 'utf-8');
+
+  return [null, { file: safePath, updatedAt: now }];
+};

package/server/utils/permissions/addPermissionToGroup.js

@@ -0,0 +1,43 @@
+import crypto from 'crypto';
+import db from '../../db/index.js';
+import { groupPermission } from '../../db/schema.js';
+import { eq, and } from 'drizzle-orm';
+
+export default async (groupName, permissionName) => {
+  if(!groupName){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+
+  if(!permissionName){
+    return [{ code: 400, msg: 'Permission name is required' }, null];
+  }
+
+  try {
+    const [existing] = await db
+      .select()
+      .from(groupPermission)
+      .where(and(
+        eq(groupPermission.groupName, groupName),
+        eq(groupPermission.permissionName, permissionName)
+      ))
+      .limit(1);
+
+    if(existing){
+      return [null, existing];
+    }
+
+    const [result] = await db
+      .insert(groupPermission)
+      .values({
+        id: crypto.randomBytes(16).toString('base64url'),
+        groupName,
+        permissionName,
+        createdAt: new Date()
+      })
+      .returning();
+
+    return [null, result];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to add permission to group' }, null];
+  }
+};

package/server/utils/permissions/createPermission.js

@@ -0,0 +1,43 @@
+import db from '../../db/index.js';
+import { permission } from '../../db/schema.js';
+
+export default async ({ resource, action, description, owner }) => {
+  if(!resource){
+    return [{ code: 400, msg: 'Resource name is required' }, null];
+  }
+
+  if(resource.includes(':')){
+    return [{ code: 400, msg: 'Resource name cannot contain ":"' }, null];
+  }
+
+  if(!action){
+    return [{ code: 400, msg: 'Action is required' }, null];
+  }
+
+  if(action.includes(':')){
+    return [{ code: 400, msg: 'Action cannot contain ":"' }, null];
+  }
+
+  if(!owner){
+    return [{ code: 400, msg: 'Permission owner is required' }, null];
+  }
+
+  try {
+    const [result] = await db
+      .insert(permission)
+      .values({
+        name: `${owner}:${resource}:${action}`,
+        description,
+        owner,
+        createdAt: new Date()
+      })
+      .returning();
+
+    return [null, result];
+  } catch(error){
+    if(error.code === '23505'){
+      return [{ code: 409, msg: 'Permission already exists' }, null];
+    }
+    return [{ code: 500, msg: 'Failed to create permission' }, null];
+  }
+};

package/server/utils/permissions/currentUserHasAllPermissions.js

@@ -0,0 +1,24 @@
+import getSession from '../auth/getSession.js';
+import userHasAllPermissions from './userHasAllPermissions.js';
+
+export default async (sessionToken, permissionNames) => {
+  if(!sessionToken){
+    return [{ code: 400, msg: 'Session token is required' }, null];
+  }
+  
+  if(!permissionNames || permissionNames.length === 0){
+    return [{ code: 400, msg: 'Permission names are required' }, null];
+  }
+  
+  const [error, sessionData] = await getSession({ token: sessionToken });
+  
+  if(error){
+    return [null, false];
+  }
+  
+  if(!sessionData || !sessionData.user){
+    return [null, false];
+  }
+  
+  return await userHasAllPermissions(sessionData.user.id, permissionNames);
+};

package/server/utils/permissions/currentUserHasPermission.js

@@ -0,0 +1,24 @@
+import getSession from '../auth/getSession.js';
+import userHasPermission from './userHasPermission.js';
+
+export default async (token, permissionName) => {
+  if(!token){
+    return [{ code: 400, msg: 'Session token is required' }, null];
+  }
+  
+  if(!permissionName){
+    return [{ code: 400, msg: 'Permission name is required' }, null];
+  }
+  
+  const [error, sessionData] = await getSession({ token });
+  
+  if(error){
+    return [null, false];
+  }
+  
+  if(!sessionData || !sessionData.user){
+    return [null, false];
+  }
+  
+  return await userHasPermission(sessionData.user.id, permissionName);
+};

package/server/utils/permissions/currentUserHasSomePermissions.js

@@ -0,0 +1,24 @@
+import getSession from '../auth/getSession.js';
+import userHasSomePermissions from './userHasSomePermissions.js';
+
+export default async (sessionToken, permissionNames) => {
+  if(!sessionToken){
+    return [{ code: 400, msg: 'Session token is required' }, null];
+  }
+  
+  if(!permissionNames || permissionNames.length === 0){
+    return [{ code: 400, msg: 'Permission names are required' }, null];
+  }
+  
+  const [error, sessionData] = await getSession({ token: sessionToken });
+  
+  if(error){
+    return [null, false];
+  }
+  
+  if(!sessionData || !sessionData.user){
+    return [null, false];
+  }
+  
+  return await userHasSomePermissions(sessionData.user.id, permissionNames);
+};

package/server/utils/permissions/deletePermission.js

@@ -0,0 +1,29 @@
+import db from '../../db/index.js';
+import { permission } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (name) => {
+  if(!name){
+    return [{ code: 400, msg: 'Permission name is required' }, null];
+  }
+
+  const owner = name.includes(':') ? name.split(':')[0] : null;
+  if(owner && owner !== 'admin'){
+    return [{ code: 403, msg: `Cannot delete ${owner}-owned permissions` }, null];
+  }
+
+  try {
+    const [result] = await db
+      .delete(permission)
+      .where(eq(permission.name, name))
+      .returning();
+
+    if(!result){
+      return [{ code: 404, msg: 'Permission not found' }, null];
+    }
+
+    return [null, result];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to delete permission' }, null];
+  }
+};

package/server/utils/permissions/getAllPermissions.js

@@ -0,0 +1,21 @@
+import db from '../../db/index.js';
+import { permission } from '../../db/schema.js';
+import { eq, sql, and, ne } from 'drizzle-orm';
+
+export default async ({ limit = 50, offset = 0, owner } = {}) => {
+  try {
+    let where;
+    if(owner === 'extension'){
+      where = and(ne(permission.owner, 'system'), ne(permission.owner, 'custom'));
+    } else if(owner !== undefined){
+      where = eq(permission.owner, owner);
+    }
+    const baseQuery = db.select().from(permission);
+    const countQuery = db.select({ count: sql`count(*)` }).from(permission);
+    const permissions = await (where ? baseQuery.where(where) : baseQuery).limit(limit).offset(offset);
+    const [{ count }] = await (where ? countQuery.where(where) : countQuery);
+    return [null, { permissions, total: Number(count), limit, offset }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve permissions' }, null];
+  }
+};

package/server/utils/permissions/getPermissionsForGroups.js

@@ -0,0 +1,26 @@
+import db from '../../db/index.js';
+import * as schema from '../../db/schema.js';
+import { inArray } from 'drizzle-orm';
+
+export default async (groups) => {
+  if(!groups){
+    return [{ code: 400, msg: 'Groups are required' }, null];
+  }
+  
+  if(groups.length === 0){
+    return [null, []];
+  }
+
+  try {
+    const groupNames = groups.map(g => g.name);
+    
+    const results = await db
+      .select({ permissionName: schema.groupPermission.permissionName })
+      .from(schema.groupPermission)
+      .where(inArray(schema.groupPermission.groupName, groupNames));
+
+    return [null, [...new Set(results.map(r => r.permissionName))]];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve permissions for groups' }, null];
+  }
+};

package/server/utils/permissions/getUserGroups.js

@@ -0,0 +1,31 @@
+import db from '../../db/index.js';
+import * as schema from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (userId) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+
+  try {
+    const [usersGroup] = await db
+      .select()
+      .from(schema.group)
+      .where(eq(schema.group.name, 'system:Users'))
+      .limit(1);
+
+    if(!usersGroup){
+      return [{ code: 500, msg: 'Users group not found - run init-db.js to initialize the database' }, null];
+    }
+
+    const explicitGroups = await db
+      .select({ group: schema.group })
+      .from(schema.userGroup)
+      .leftJoin(schema.group, eq(schema.userGroup.groupName, schema.group.name))
+      .where(eq(schema.userGroup.userId, userId));
+
+    return [null, [usersGroup, ...explicitGroups.map(g => g.group)]];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve user groups' }, null];
+  }
+};

package/server/utils/permissions/getUserPermission.js

@@ -0,0 +1,30 @@
+import getUserGroups from './getUserGroups.js';
+import getPermissionsForGroups from './getPermissionsForGroups.js';
+
+export default async (userId, permissionName) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  if(!permissionName){
+    return [{ code: 400, msg: 'Permission name is required' }, null];
+  }
+  
+  const [groupsError, userGroups] = await getUserGroups(userId);
+  
+  if(groupsError){
+    return [groupsError, null];
+  }
+  
+  if(userGroups.some(g => g.name === 'system:Administrators')){
+    return [null, true];
+  }
+  
+  const [permsError, userPermissions] = await getPermissionsForGroups(userGroups);
+  
+  if(permsError){
+    return [permsError, null];
+  }
+  
+  return [null, userPermissions.includes(permissionName)];
+};

package/server/utils/permissions/getUserPermissions.js

@@ -0,0 +1,16 @@
+import getUserGroups from './getUserGroups.js';
+import getPermissionsForGroups from './getPermissionsForGroups.js';
+
+export default async (userId) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  const [groupsError, userGroups] = await getUserGroups(userId);
+  
+  if(groupsError){
+    return [groupsError, null];
+  }
+  
+  return await getPermissionsForGroups(userGroups);
+};

package/server/utils/permissions/removePermissionFromGroup.js

@@ -0,0 +1,31 @@
+import db from '../../db/index.js';
+import { groupPermission } from '../../db/schema.js';
+import { eq, and } from 'drizzle-orm';
+
+export default async (groupName, permissionName) => {
+  if(!groupName){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+
+  if(!permissionName){
+    return [{ code: 400, msg: 'Permission name is required' }, null];
+  }
+
+  try {
+    const [result] = await db
+      .delete(groupPermission)
+      .where(and(
+        eq(groupPermission.groupName, groupName),
+        eq(groupPermission.permissionName, permissionName)
+      ))
+      .returning();
+
+    if(!result){
+      return [{ code: 404, msg: 'Permission is not assigned to this group' }, null];
+    }
+
+    return [null, result];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to remove permission from group' }, null];
+  }
+};

package/server/utils/permissions/updatePermission.js

@@ -0,0 +1,33 @@
+import db from '../../db/index.js';
+import { permission } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (name, updates) => {
+  if(!name){
+    return [{ code: 400, msg: 'Permission name is required' }, null];
+  }
+
+  if(name.startsWith('system:')){
+    return [{ code: 403, msg: 'System permissions cannot be modified' }, null];
+  }
+
+  if(!updates || Object.keys(updates).length === 0){
+    return [{ code: 400, msg: 'Updates are required' }, null];
+  }
+
+  try {
+    const [result] = await db
+      .update(permission)
+      .set(updates)
+      .where(eq(permission.name, name))
+      .returning();
+
+    if(!result){
+      return [{ code: 404, msg: 'Permission not found' }, null];
+    }
+
+    return [null, result];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to update permission' }, null];
+  }
+};

package/server/utils/permissions/userHasAllPermissions.js

@@ -0,0 +1,31 @@
+import getUserGroups from './getUserGroups.js';
+import getPermissionsForGroups from './getPermissionsForGroups.js';
+
+export default async (userId, permissionNames) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  if(!permissionNames || permissionNames.length === 0){
+    return [{ code: 400, msg: 'Permission names are required' }, null];
+  }
+  
+  const [groupsError, userGroups] = await getUserGroups(userId);
+  
+  if(groupsError){
+    return [groupsError, null];
+  }
+  
+  if(userGroups.some(g => g.name === 'system:Administrators')){
+    return [null, true];
+  }
+
+  const [permsError, userPermissions] = await getPermissionsForGroups(userGroups);
+  
+  if(permsError){
+    return [permsError, null];
+  }
+  
+  const userPermissionSet = new Set(userPermissions);
+  return [null, permissionNames.every(name => userPermissionSet.has(name))];
+};

package/server/utils/permissions/userHasPermission.js

@@ -0,0 +1,13 @@
+import userHasAllPermissions from './userHasAllPermissions.js';
+
+export default async (userId, permissionName) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  if(!permissionName){
+    return [{ code: 400, msg: 'Permission name is required' }, null];
+  }
+  
+  return await userHasAllPermissions(userId, [permissionName]);
+};

package/server/utils/permissions/userHasSomePermissions.js

@@ -0,0 +1,31 @@
+import getUserGroups from './getUserGroups.js';
+import getPermissionsForGroups from './getPermissionsForGroups.js';
+
+export default async (userId, permissionNames) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  if(!permissionNames || permissionNames.length === 0){
+    return [{ code: 400, msg: 'Permission names are required' }, null];
+  }
+  
+  const [groupsError, userGroups] = await getUserGroups(userId);
+  
+  if(groupsError){
+    return [groupsError, null];
+  }
+  
+  if(userGroups.some(g => g.name === 'system:Administrators')){
+    return [null, true];
+  }
+
+  const [permsError, userPermissions] = await getPermissionsForGroups(userGroups);
+  
+  if(permsError){
+    return [permsError, null];
+  }
+  
+  const userPermissionSet = new Set(userPermissions);
+  return [null, permissionNames.some(name => userPermissionSet.has(name))];
+};