kempo 4.5.1 → 4.5.3

package/server/utils/dashboard/listDashboardWidgets.js

@@ -0,0 +1,63 @@
+import { eq } from 'drizzle-orm';
+import db from '../../db/index.js';
+import { dashboardWidget, extension } from '../../db/schema.js';
+import userHasPermission from '../permissions/userHasPermission.js';
+import coreWidgets from './coreWidgets.js';
+
+const publicFields = ({ createdAt, updatedAt, ...widget }) => widget;
+
+/*
+  Every widget the dashboard can show: Kempo's own plus those extensions registered. Widgets of a
+  disabled extension are left out, since the module they point at is no longer served.
+
+  Pass `userId` to also drop widgets that person lacks the `permission` for; the check runs once per
+  distinct permission, and administrators hold every one. The same applies to each action's own
+  `permission`. Without `userId` nothing is filtered by permission.
+
+  `unavailable` lists the ids of widgets that exist but are not offered to this person, because their
+  extension is disabled or they lack the permission. A client that remembers a layout keeps those entries
+  so the widget returns to its place when it becomes available again, and drops entries for ids that are in
+  neither list, which is what an uninstalled extension looks like.
+
+  Ordered by `priority`, then title. If the widget table has not been created yet (a site that upgraded
+  without applying the schema), Kempo's own widgets are still returned so the dashboard is not blank.
+*/
+export default async ({ userId } = {}) => {
+  let registered = [];
+  const unavailable = [];
+
+  try {
+    const rows = await db
+      .select({ widget: dashboardWidget, enabled: extension.enabled, installed: extension.name })
+      .from(dashboardWidget)
+      .leftJoin(extension, eq(extension.name, dashboardWidget.owner));
+    rows.forEach(({ widget, enabled, installed }) => {
+      if(installed && !enabled) unavailable.push(widget.id);
+      else registered.push(publicFields(widget));
+    });
+  } catch(error) {
+    console.warn(`Dashboard widgets from extensions are unavailable: ${error.message}`);
+  }
+
+  let widgets = [...coreWidgets, ...registered];
+
+  if(userId){
+    const permissions = [...new Set(widgets.flatMap(widget => [widget.permission, ...(widget.actions || []).map(action => action.permission)]).filter(Boolean))];
+    const granted = new Set();
+
+    await Promise.all(permissions.map(async permission => {
+      const [error, allowed] = await userHasPermission(userId, permission);
+      if(!error && allowed) granted.add(permission);
+    }));
+
+    widgets.filter(widget => widget.permission && !granted.has(widget.permission)).forEach(widget => unavailable.push(widget.id));
+
+    widgets = widgets
+      .filter(widget => !widget.permission || granted.has(widget.permission))
+      .map(widget => ({ ...widget, actions: (widget.actions || []).filter(action => !action.permission || granted.has(action.permission)) }));
+  }
+
+  widgets.sort((a, b) => a.priority - b.priority || a.title.localeCompare(b.title));
+
+  return [null, { widgets, unavailable }];
+};

package/server/utils/dashboard/registerDashboardWidget.js

@@ -0,0 +1,40 @@
+import db from '../../db/index.js';
+import { dashboardWidget } from '../../db/schema.js';
+import { CORE_OWNER, normalizeWidget } from './helpers.js';
+
+/*
+  Adds a widget to the admin dashboard, or updates it when `owner` and `key` already exist, so an
+  extension can call this from `install.js` and again from `update.js` without checking first.
+
+  `element` is the custom element the dashboard creates and `module` is the site path of the script
+  that defines it. The element loads its own data when it connects, so nothing here is fetched until a
+  user has the widget on their dashboard. `permission` hides it from people who do not hold it.
+
+  Sizes are in blocks: width 1 to 4, height 1 to 3. `minWidth`/`maxWidth`/`minHeight`/`maxHeight` bound
+  what a user may resize it to; `priority` orders it among the defaults, lowest first.
+*/
+export default async definition => {
+  const [invalid, widget] = normalizeWidget(definition);
+
+  if(invalid){
+    return [invalid, null];
+  }
+
+  if(widget.owner === CORE_OWNER){
+    return [{ code: 400, msg: `Owner "${CORE_OWNER}" is reserved for Kempo's own widgets` }, null];
+  }
+
+  try {
+    const now = new Date();
+    const { id, ...changes } = widget;
+    const [saved] = await db
+      .insert(dashboardWidget)
+      .values({ ...widget, createdAt: now, updatedAt: now })
+      .onConflictDoUpdate({ target: dashboardWidget.id, set: { ...changes, updatedAt: now } })
+      .returning();
+
+    return [null, saved];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to register dashboard widget' }, null];
+  }
+};

package/server/utils/dashboard/unregisterDashboardWidget.js

@@ -0,0 +1,24 @@
+import { and, eq } from 'drizzle-orm';
+import db from '../../db/index.js';
+import { dashboardWidget } from '../../db/schema.js';
+
+/*
+  Removes one widget, or every widget the owner registered when `key` is omitted. Removing something
+  that is not there is not an error; `removed` says how many rows went.
+*/
+export default async ({ owner, key } = {}) => {
+  if(!owner){
+    return [{ code: 400, msg: 'Owner is required' }, null];
+  }
+
+  try {
+    const removed = await db
+      .delete(dashboardWidget)
+      .where(key ? and(eq(dashboardWidget.owner, owner), eq(dashboardWidget.key, key)) : eq(dashboardWidget.owner, owner))
+      .returning({ id: dashboardWidget.id });
+
+    return [null, { removed: removed.length }];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to remove dashboard widget' }, null];
+  }
+};

package/server/utils/extensions/installExtension.js

@@ -8,6 +8,7 @@ import { readFile } from 'fs/promises';
 import { randomUUID } from 'crypto';
 import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
 import createHook from '../hooks/createHook.js';
+import registerDashboardWidget from '../dashboard/registerDashboardWidget.js';
 import setSetting from '../settings/setSetting.js';
 import declaredValue from '../settings/declaredValue.js';
 import createTablesFromSchema from './createTablesFromSchema.js';
@@ -122,6 +123,16 @@ export default async ({ name }) => {
     await createHook({ owner: name, event, callback });
   }
 
+  /*
+    Register declarative dashboard widgets
+  */
+  for(const widget of kempoConfig.widgets || []){
+    const [widgetError] = await registerDashboardWidget({ ...widget, owner: name });
+    if(widgetError){
+      return [{ code: widgetError.code, msg: `Invalid dashboard widget "${widget.key}": ${widgetError.msg}` }, null];
+    }
+  }
+
   const now = new Date();
   const entry = {
     name,

package/server/utils/extensions/uninstallExtension.js

@@ -1,5 +1,5 @@
 import db from '../../db/index.js';
-import { extension, hook, permission, setting, group, groupPermission, userGroup } from '../../db/schema.js';
+import { extension, hook, permission, setting, group, groupPermission, userGroup, dashboardWidget } from '../../db/schema.js';
 import { eq, inArray, like } from 'drizzle-orm';
 import { join } from 'path';
 import { pathToFileURL } from 'url';
@@ -109,6 +109,7 @@ export default async ({ name, purgeData = false }) => {
 
   try {
     await db.delete(hook).where(eq(hook.owner, name));
+    await db.delete(dashboardWidget).where(eq(dashboardWidget.owner, name));
     await db.delete(extension).where(eq(extension.name, name));
   } catch(error) {
     return [{ code: 500, msg: 'Failed to remove extension' }, null];

package/server/utils/extensions/updateExtension.js

@@ -8,6 +8,8 @@ import { randomUUID } from 'crypto';
 import { execSync } from 'child_process';
 import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
 import createHook from '../hooks/createHook.js';
+import registerDashboardWidget from '../dashboard/registerDashboardWidget.js';
+import unregisterDashboardWidget from '../dashboard/unregisterDashboardWidget.js';
 import setSetting from '../settings/setSetting.js';
 import declaredValue from '../settings/declaredValue.js';
 import createTablesFromSchema from './createTablesFromSchema.js';
@@ -141,6 +143,22 @@ export default async ({ name, version = 'latest' }) => {
     }
   }
 
+  /*
+    Sync dashboard widgets: register or refresh every declared one, remove those no longer declared
+  */
+  const newWidgetKeys = new Set((newKempo.widgets || []).map(w => w.key));
+  for(const widget of newKempo.widgets || []){
+    const [widgetError] = await registerDashboardWidget({ ...widget, owner: name });
+    if(widgetError){
+      return [{ code: widgetError.code, msg: `Invalid dashboard widget "${widget.key}": ${widgetError.msg}` }, null];
+    }
+  }
+  for(const { key } of oldKempo.widgets || []){
+    if(!newWidgetKeys.has(key)){
+      await unregisterDashboardWidget({ owner: name, key });
+    }
+  }
+
   const now = new Date();
   try {
     await db.update(extension).set({