kempo 4.2.4 → 4.2.7

package/server/utils/extensions/disableExtension.js

@@ -0,0 +1,26 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { invalidateScopeCache } from './scopeCache.js';
+
+export default async ({ name }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Extension name is required' }, null];
+  }
+
+  try {
+    const updated = await db.update(extension)
+      .set({ enabled: false, updatedAt: new Date() })
+      .where(eq(extension.name, name))
+      .returning();
+
+    if(!updated.length){
+      return [{ code: 404, msg: 'Extension not found' }, null];
+    }
+
+    invalidateScopeCache();
+    return [null, updated[0]];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to disable extension' }, null];
+  }
+};

package/server/utils/extensions/enableExtension.js

@@ -0,0 +1,26 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { invalidateScopeCache } from './scopeCache.js';
+
+export default async ({ name }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Extension name is required' }, null];
+  }
+
+  try {
+    const updated = await db.update(extension)
+      .set({ enabled: true, updatedAt: new Date() })
+      .where(eq(extension.name, name))
+      .returning();
+
+    if(!updated.length){
+      return [{ code: 404, msg: 'Extension not found' }, null];
+    }
+
+    invalidateScopeCache();
+    return [null, updated[0]];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to enable extension' }, null];
+  }
+};

package/server/utils/extensions/getExtension.js

@@ -0,0 +1,34 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { join } from 'path';
+import { readFile } from 'fs/promises';
+
+const NODE_MODULES = join(process.cwd(), 'node_modules');
+
+export default async ({ name }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Extension name is required' }, null];
+  }
+
+  try {
+    const results = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
+    if(!results.length){
+      return [{ code: 404, msg: 'Extension not found' }, null];
+    }
+    const ext = results[0];
+    let pkg = {};
+    try {
+      pkg = JSON.parse(await readFile(join(NODE_MODULES, name, 'package.json'), 'utf-8'));
+    } catch { /* package may not be installed */ }
+    return [null, {
+      ...ext,
+      description: pkg.description || null,
+      author: pkg.author || null,
+      license: pkg.license || null,
+      docs: pkg.kempo?.docs || null,
+    }];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to get extension' }, null];
+  }
+};

package/server/utils/extensions/installExtension.js

@@ -0,0 +1,134 @@
+import db from '../../db/index.js';
+import { extension, hook, permission, group, groupPermission } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import { createRequire } from 'module';
+import { dirname, join } from 'path';
+import { readFile } from 'fs/promises';
+import { randomUUID } from 'crypto';
+import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
+import createHook from '../hooks/createHook.js';
+import setSetting from '../settings/setSetting.js';
+import createTablesFromSchema from './createTablesFromSchema.js';
+import { invalidateScopeCache } from './scopeCache.js';
+
+const requireFromProject = createRequire(join(process.cwd(), 'package.json'));
+
+export default async ({ name }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Extension name is required' }, null];
+  }
+
+  try {
+    const existing = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
+    if(existing.length){
+      return [{ code: 409, msg: 'Extension is already installed' }, null];
+    }
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to check existing extensions' }, null];
+  }
+
+  let pkgPath, extRoot, pkg;
+  try {
+    pkgPath = requireFromProject.resolve(`${name}/package.json`);
+    extRoot = dirname(pkgPath);
+    pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+  } catch {
+    return [{ code: 404, msg: `Extension package "${name}" not found` }, null];
+  }
+
+  const kempoConfig = pkg.kempo || {};
+
+  /*
+    Create tables from declarative schema
+  */
+  if(kempoConfig.schema){
+    try {
+      const schemaModule = await import(join(extRoot, kempoConfig.schema));
+      const [err] = await createTablesFromSchema(schemaModule);
+      if(err) return [err, null];
+    } catch(error){
+      return [{ code: 500, msg: `Failed to load extension schema: ${error.message}` }, null];
+    }
+  }
+
+  /*
+    Run install script
+  */
+  try {
+    const installModule = await import(join(extRoot, 'install.js')).catch(() => null);
+    if(installModule?.default){
+      await installModule.default();
+    }
+  } catch(error) {
+    return [{ code: 500, msg: `Extension install script failed: ${error.message}` }, null];
+  }
+
+  /*
+    Create declarative permissions
+  */
+  for(const { name: permName, description } of kempoConfig.permissions || []){
+    await db.insert(permission).values({
+      name: permName,
+      description: description || null,
+      owner: name,
+      createdAt: new Date(),
+    }).onConflictDoNothing();
+  }
+
+  /*
+    Create declarative settings
+  */
+  for(const { name: settingName, value, type, description } of kempoConfig.settings || []){
+    await setSetting(name, settingName, value, type || null, false, description || null);
+  }
+
+  /*
+    Create declarative groups with permissions
+  */
+  for(const { name: groupName, description, permissions: groupPerms = [] } of kempoConfig.groups || []){
+    await db.insert(group).values({
+      name: groupName,
+      description: description || null,
+      owner: name,
+      createdAt: new Date(),
+    }).onConflictDoNothing();
+    for(const permName of groupPerms){
+      await db.insert(groupPermission).values({
+        id: randomUUID(),
+        groupName,
+        permissionName: permName,
+        createdAt: new Date(),
+      }).onConflictDoNothing();
+    }
+  }
+
+  /*
+    Register hooks from declarative config
+  */
+  for(const [event, callback] of Object.entries(kempoConfig.hooks || {})){
+    await createHook({ owner: name, event, callback });
+  }
+
+  const now = new Date();
+  const entry = {
+    name,
+    version: pkg.version || null,
+    enabled: true,
+    kempo: kempoConfig,
+    installedAt: now,
+    updatedAt: now,
+  };
+
+  try {
+    await db.insert(extension).values(entry);
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to register extension' }, null];
+  }
+
+  clearHandlerCache();
+  invalidateScopeCache();
+  await triggerHook('extension:installed', { name, version: pkg.version });
+
+  return [null, entry];
+};
+

package/server/utils/extensions/listExtensions.js

@@ -0,0 +1,36 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { sql } from 'drizzle-orm';
+import { join } from 'path';
+import { readFile } from 'fs/promises';
+
+const NODE_MODULES = join(process.cwd(), 'node_modules');
+
+const readPkg = async (name) => {
+  try {
+    const raw = await readFile(join(NODE_MODULES, name, 'package.json'), 'utf-8');
+    return JSON.parse(raw);
+  } catch { return {}; }
+};
+
+export default async ({ limit = 50, offset = 0 } = {}) => {
+  try {
+    const [items, [{ count }]] = await Promise.all([
+      db.select().from(extension).limit(limit).offset(offset),
+      db.select({ count: sql`count(*)` }).from(extension),
+    ]);
+    const enriched = await Promise.all(items.map(async (ext) => {
+      const pkg = await readPkg(ext.name);
+      return {
+        ...ext,
+        description: pkg.description || null,
+        author: pkg.author || null,
+        license: pkg.license || null,
+        docs: pkg.kempo?.docs || null,
+      };
+    }));
+    return [null, { items: enriched, total: Number(count), limit, offset }];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to list extensions' }, null];
+  }
+};

package/server/utils/extensions/scopeCache.js

@@ -0,0 +1,18 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+let cache = null;
+
+export const invalidateScopeCache = () => { cache = null; };
+
+export const getEnabledExtensions = async () => {
+  if(cache) return cache;
+  try {
+    cache = await db.select().from(extension).where(eq(extension.enabled, true));
+  } catch(e) {
+    console.error('[scopeCache] DB error fetching enabled extensions:', e.message);
+    return [];
+  }
+  return cache;
+};

package/server/utils/extensions/uninstallExtension.js

@@ -0,0 +1,88 @@
+import db from '../../db/index.js';
+import { extension, hook, permission, setting, group } from '../../db/schema.js';
+import { eq, inArray } from 'drizzle-orm';
+import { createRequire } from 'module';
+import { dirname, join } from 'path';
+import { sql } from 'drizzle-orm';
+import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
+import { invalidateScopeCache } from './scopeCache.js';
+
+const requireFromProject = createRequire(join(process.cwd(), 'package.json'));
+
+export default async ({ name }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Extension name is required' }, null];
+  }
+
+  let kempoConfig;
+  try {
+    const [existing] = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
+    if(!existing){
+      return [{ code: 404, msg: 'Extension not found' }, null];
+    }
+    kempoConfig = existing.kempo || {};
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to find extension' }, null];
+  }
+
+  try {
+    const pkgPath = requireFromProject.resolve(`${name}/package.json`);
+    const extRoot = dirname(pkgPath);
+    const uninstallModule = await import(join(extRoot, 'uninstall.js')).catch(() => null);
+    if(uninstallModule?.default){
+      await uninstallModule.default();
+    }
+  } catch {}
+
+  /*
+    Drop declarative schema tables
+  */
+  if(kempoConfig.schema){
+    try {
+      const pkgPath = requireFromProject.resolve(`${name}/package.json`);
+      const extRoot = dirname(pkgPath);
+      const schemaModule = await import(join(extRoot, kempoConfig.schema));
+      const { getTableConfig } = await import('drizzle-orm/pg-core');
+      for(const exported of Object.values(schemaModule)){
+        if(typeof exported !== 'object' || !exported?.[Symbol.for('drizzle:Name')]) continue;
+        const { name: tableName } = getTableConfig(exported);
+        await db.execute(sql.raw(`DROP TABLE IF EXISTS "${tableName}" CASCADE`));
+      }
+    } catch {}
+  }
+
+  /*
+    Remove declarative groups
+  */
+  const groupNames = (kempoConfig.groups || []).map(g => g.name);
+  if(groupNames.length){
+    await db.delete(group).where(inArray(group.name, groupNames)).catch(() => {});
+  }
+
+  /*
+    Remove declarative permissions
+  */
+  const permNames = (kempoConfig.permissions || []).map(p => p.name);
+  if(permNames.length){
+    await db.delete(permission).where(inArray(permission.name, permNames)).catch(() => {});
+  }
+
+  /*
+    Remove declarative settings (owner-namespaced: "extname:settingname")
+  */
+  await db.delete(setting).where(eq(setting.owner, name)).catch(() => {});
+
+  try {
+    await db.delete(hook).where(eq(hook.owner, name));
+    await db.delete(extension).where(eq(extension.name, name));
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to remove extension' }, null];
+  }
+
+  clearHandlerCache();
+  invalidateScopeCache();
+  await triggerHook('extension:uninstalled', { name });
+
+  return [null, { success: true }];
+};
+

package/server/utils/extensions/updateExtension.js

@@ -0,0 +1,159 @@
+import db from '../../db/index.js';
+import { extension, hook, permission, group, groupPermission } from '../../db/schema.js';
+import { eq, and } from 'drizzle-orm';
+import { createRequire } from 'module';
+import { dirname, join } from 'path';
+import { readFile } from 'fs/promises';
+import { randomUUID } from 'crypto';
+import { execSync } from 'child_process';
+import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
+import createHook from '../hooks/createHook.js';
+import setSetting from '../settings/setSetting.js';
+import createTablesFromSchema from './createTablesFromSchema.js';
+
+const requireFromProject = createRequire(join(process.cwd(), 'package.json'));
+
+export default async ({ name, version = 'latest' }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Extension name is required' }, null];
+  }
+
+  let oldRecord;
+  try {
+    [oldRecord] = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
+    if(!oldRecord){
+      return [{ code: 404, msg: 'Extension not found' }, null];
+    }
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to find extension' }, null];
+  }
+
+  const oldKempo = oldRecord.kempo || {};
+  const oldVersion = oldRecord.version;
+
+  /*
+    Install updated package
+  */
+  try {
+    execSync(`npm install ${name}@${version}`, { cwd: process.cwd(), stdio: 'pipe' });
+  } catch(error){
+    return [{ code: 500, msg: `Failed to update package: ${error.message}` }, null];
+  }
+
+  let pkgPath, extRoot, pkg;
+  try {
+    pkgPath = requireFromProject.resolve(`${name}/package.json`);
+    extRoot = dirname(pkgPath);
+    pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+  } catch {
+    return [{ code: 404, msg: `Updated package "${name}" not found` }, null];
+  }
+
+  const newKempo = pkg.kempo || {};
+
+  /*
+    Create any new tables from schema
+  */
+  if(newKempo.schema){
+    try {
+      const schemaModule = await import(`${join(extRoot, newKempo.schema)}?t=${Date.now()}`);
+      const [err] = await createTablesFromSchema(schemaModule);
+      if(err) return [err, null];
+    } catch(error){
+      return [{ code: 500, msg: `Failed to load extension schema: ${error.message}` }, null];
+    }
+  }
+
+  /*
+    Run update script with diff context
+  */
+  try {
+    const updateModule = await import(`${join(extRoot, 'update.js')}?t=${Date.now()}`).catch(() => null);
+    if(updateModule?.default){
+      await updateModule.default({ oldVersion, newVersion: pkg.version, oldKempo, newKempo });
+    }
+  } catch(error){
+    return [{ code: 500, msg: `Extension update script failed: ${error.message}` }, null];
+  }
+
+  /*
+    Add new permissions (never delete — user data may depend on them)
+  */
+  const oldPermNames = new Set((oldKempo.permissions || []).map(p => p.name));
+  for(const { name: permName, description } of newKempo.permissions || []){
+    if(!oldPermNames.has(permName)){
+      await db.insert(permission).values({
+        name: permName,
+        description: description || null,
+        owner: name,
+        createdAt: new Date(),
+      }).onConflictDoNothing();
+    }
+  }
+
+  /*
+    Add new settings only (never overwrite — user may have changed the value)
+  */
+  const oldSettingNames = new Set((oldKempo.settings || []).map(s => s.name));
+  for(const { name: settingName, value, type, description } of newKempo.settings || []){
+    if(!oldSettingNames.has(settingName)){
+      await setSetting(name, settingName, value, type || null, false, description || null);
+    }
+  }
+
+  /*
+    Add new groups
+  */
+  const oldGroupNames = new Set((oldKempo.groups || []).map(g => g.name));
+  for(const { name: groupName, description, permissions: groupPerms = [] } of newKempo.groups || []){
+    if(!oldGroupNames.has(groupName)){
+      await db.insert(group).values({
+        name: groupName,
+        description: description || null,
+        owner: name,
+        createdAt: new Date(),
+      }).onConflictDoNothing();
+      for(const permName of groupPerms){
+        await db.insert(groupPermission).values({
+          id: randomUUID(),
+          groupName,
+          permissionName: permName,
+          createdAt: new Date(),
+        }).onConflictDoNothing();
+      }
+    }
+  }
+
+  /*
+    Sync hooks: add new, remove deleted
+  */
+  const oldHooks = oldKempo.hooks || {};
+  const newHooks = newKempo.hooks || {};
+  for(const [event, callback] of Object.entries(newHooks)){
+    if(!oldHooks[event]){
+      await createHook({ owner: name, event, callback });
+    }
+  }
+  for(const event of Object.keys(oldHooks)){
+    if(!newHooks[event]){
+      await db.delete(hook).where(and(eq(hook.owner, name), eq(hook.event, event))).catch(() => {});
+    }
+  }
+
+  const now = new Date();
+  try {
+    await db.update(extension).set({
+      version: pkg.version || null,
+      kempo: newKempo,
+      updatedAt: now,
+    }).where(eq(extension.name, name));
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to update extension record' }, null];
+  }
+
+  clearHandlerCache();
+  await triggerHook('extension:updated', { name, oldVersion, newVersion: pkg.version });
+
+  return [null, { name, oldVersion, newVersion: pkg.version }];
+};
+

package/server/utils/fragments/createFragment.js

@@ -0,0 +1,57 @@
+import { writeFile, mkdir } from 'fs/promises';
+import { join, dirname } from 'path';
+import { existsSync } from 'fs';
+
+const slugify = name => name
+  .toLowerCase()
+  .trim()
+  .replace(/[^\w\s-]/g, '')
+  .replace(/[\s_]+/g, '-')
+  .replace(/-+/g, '-')
+  .replace(/^-|-$/g, '');
+
+export default async ({ rootDir, directory, name, author }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!name){
+    return [{ code: 400, msg: 'Fragment name is required' }, null];
+  }
+
+  const slug = slugify(name);
+  if(!slug){
+    return [{ code: 400, msg: 'Fragment name must contain valid characters' }, null];
+  }
+
+  const dir = directory && directory !== '.' && directory !== '/'
+    ? directory.replace(/^\//, '').replace(/\/$/, '')
+    : '';
+  const filePath = dir
+    ? join(rootDir, dir, `${slug}.fragment.html`)
+    : join(rootDir, `${slug}.fragment.html`);
+
+  if(existsSync(filePath)){
+    return [{ code: 409, msg: 'A fragment with this name already exists in this location' }, null];
+  }
+
+  const now = new Date().toISOString();
+  const frontmatter = [
+    '<!--',
+    `  owner: custom`,
+    `  name: ${name}`,
+    `  author: ${author || ''}`,
+    `  created: ${now}`,
+    `  updated: ${now}`,
+    '-->'
+  ].join('\n');
+
+  const content = `${frontmatter}\n`;
+
+  const pageDir = dirname(filePath);
+  await mkdir(pageDir, { recursive: true });
+  await writeFile(filePath, content, 'utf-8');
+
+  const relPath = dir ? `${dir}/${slug}` : slug;
+
+  return [null, { file: `${relPath}.fragment.html`, name, slug }];
+};

package/server/utils/fragments/deleteFragment.js

@@ -0,0 +1,35 @@
+import { readFile, unlink } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, files }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!files?.length) return [{ code: 400, msg: 'No files specified' }, null];
+
+  for(const file of files){
+    const normalized = normalize(file);
+    if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+      return [{ code: 400, msg: 'Invalid file path' }, null];
+    }
+
+    const fullPath = join(rootDir, normalized);
+    let content;
+    try {
+      content = await readFile(fullPath, 'utf-8');
+    } catch {
+      continue;
+    }
+
+    const meta = parseFrontmatter(content);
+    if(meta.locked === 'true'){
+      return [{ code: 403, msg: `Cannot delete locked fragment: ${file}` }, null];
+    }
+    if(meta.owner && meta.owner !== 'custom'){
+      return [{ code: 403, msg: `Cannot delete fragment: ${file}` }, null];
+    }
+
+    await unlink(fullPath);
+  }
+
+  return [null, { deleted: files.length }];
+};

package/server/utils/fragments/disableFragment.js

@@ -0,0 +1,37 @@
+import { readFile, rename } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+
+  const normalized = normalize(file);
+  if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  if(!normalized.endsWith('.fragment.html')){
+    return [{ code: 400, msg: 'File must be a .fragment.html file' }, null];
+  }
+
+  const fullPath = join(rootDir, normalized);
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Fragment not found' }, null];
+  }
+
+  const content = await readFile(fullPath, 'utf-8');
+  const meta = parseFrontmatter(content);
+  if(meta.locked === 'true'){
+    return [{ code: 403, msg: 'Cannot disable a locked fragment' }, null];
+  }
+
+  const disabledPath = fullPath.replace(/\.fragment\.html$/, '.fragment-disabled.html');
+  if(existsSync(disabledPath)){
+    return [{ code: 409, msg: 'A disabled version of this fragment already exists' }, null];
+  }
+
+  await rename(fullPath, disabledPath);
+  return [null, { file: normalized.replace(/\.fragment\.html$/, '.fragment-disabled.html') }];
+};

package/server/utils/fragments/enableFragment.js

@@ -0,0 +1,30 @@
+import { rename } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import { existsSync } from 'fs';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+
+  const normalized = normalize(file);
+  if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  if(!normalized.endsWith('.fragment-disabled.html')){
+    return [{ code: 400, msg: 'File must be a .fragment-disabled.html file' }, null];
+  }
+
+  const fullPath = join(rootDir, normalized);
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Disabled fragment not found' }, null];
+  }
+
+  const enabledPath = fullPath.replace(/\.fragment-disabled\.html$/, '.fragment.html');
+  if(existsSync(enabledPath)){
+    return [{ code: 409, msg: 'An enabled version of this fragment already exists' }, null];
+  }
+
+  await rename(fullPath, enabledPath);
+  return [null, { file: normalized.replace(/\.fragment-disabled\.html$/, '.fragment.html') }];
+};