kempo 4.5.7 → 4.5.8

package/README.md

@@ -359,7 +359,7 @@ Extensions can push live updates to browsers: declare a channel, publish to it f
 
 ## Admin Dashboard
 
-The admin home page is a grid of widgets one to four blocks wide and one to three tall. Kempo provides widgets for pages, content, users, notifications and extensions; extensions add their own with `kempo.widgets` or `registerDashboardWidget`. Each person chooses which are shown, their order and size, kept in their browser's localStorage, and a widget only loads its script and data once it is shown. Existing sites need `npx drizzle-kit push` to add the `dashboardWidget` table (until then only Kempo's own widgets appear). See [docs/dashboard.md](docs/dashboard.md).
+The admin home page is a grid of widgets one to four blocks wide and one to three tall. Kempo provides widgets for pages, content, users, notifications and extensions; extensions add their own with `widgets` in `kempo-config.json` or `registerDashboardWidget`. Each person chooses which are shown, their order and size, kept in their browser's localStorage, and a widget only loads its script and data once it is shown. Existing sites need `npx drizzle-kit push` to add the `dashboardWidget` table (until then only Kempo's own widgets appear). See [docs/dashboard.md](docs/dashboard.md).
 
 ## Notifications
 

package/middleware/kempo.js

@@ -6,6 +6,7 @@ import getSession from '../server/utils/auth/getSession.js';
 import currentUserHasPermission from '../server/utils/permissions/currentUserHasPermission.js';
 import { LEXICAL_BASE, bundleFileName as lexicalBundleFileName } from '../server/utils/lexical/packages.js';
 import { getEnabledExtensions } from '../server/utils/extensions/scopeCache.js';
+import readKempoConfig from '../server/utils/extensions/readKempoConfig.js';
 import { extensionAdminDirs, extensionPublicDirs } from '../server/utils/extensions/contentDirs.js';
 import triggerHook from '../server/utils/hooks/triggerHook.js';
 import { ADMIN_GLOBALS_DIR } from '../server/utils/admin-global-content/helpers.js';
@@ -394,19 +395,21 @@ export default config => {
     const publicContentDirs = await extensionPublicDirs();
 
     for(const ext of extensions){
-      let pkgPath, pkg;
+      const extRoot = join(NODE_MODULES, ext.name);
+      let kempo;
       try {
-        pkgPath = join(NODE_MODULES, ext.name, 'package.json');
-        pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
-      } catch { continue; }
+        ({ kempo } = await readKempoConfig(extRoot));
+      } catch {
+        continue;
+      }
 
-      const scope = pkg.kempo?.['public-scope'];
+      const scope = kempo['public-scope'];
       if(!scope) continue;
 
       const scopePrefix = `/${scope}`;
       if(url !== scopePrefix && !url.startsWith(`${scopePrefix}/`)) continue;
 
-      const publicDir = join(dirname(pkgPath), 'public');
+      const publicDir = join(extRoot, 'public');
       const subPath = url.slice(scopePrefix.length) || '/';
       const method = request.method?.toUpperCase() || 'GET';
       const resolveDir = buildResolveDir(PROJECT_PUBLIC, url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo",
-  "version": "4.5.7",
+  "version": "4.5.8",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {

package/server/utils/extensions/getExtension.js

@@ -2,7 +2,7 @@ import db from '../../db/index.js';
 import { extension } from '../../db/schema.js';
 import { eq } from 'drizzle-orm';
 import { join } from 'path';
-import { readFile } from 'fs/promises';
+import readKempoConfig from './readKempoConfig.js';
 
 const NODE_MODULES = join(process.cwd(), 'node_modules');
 
@@ -18,15 +18,16 @@ export default async ({ name }) => {
     }
     const ext = results[0];
     let pkg = {};
+    let kempo = {};
     try {
-      pkg = JSON.parse(await readFile(join(NODE_MODULES, name, 'package.json'), 'utf-8'));
+      ({ pkg, kempo } = await readKempoConfig(join(NODE_MODULES, name)));
     } catch { /* package may not be installed */ }
     return [null, {
       ...ext,
       description: pkg.description || null,
       author: pkg.author || null,
       license: pkg.license || null,
-      docs: pkg.kempo?.docs || null,
+      docs: kempo.docs || null,
     }];
   } catch(error) {
     return [{ code: 500, msg: 'Failed to get extension' }, null];

package/server/utils/extensions/installExtension.js

@@ -4,7 +4,6 @@ import { eq } from 'drizzle-orm';
 import { join } from 'path';
 import { pathToFileURL } from 'url';
 import { existsSync } from 'fs';
-import { readFile } from 'fs/promises';
 import { randomUUID } from 'crypto';
 import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
 import createHook from '../hooks/createHook.js';
@@ -12,6 +11,7 @@ import registerDashboardWidget from '../dashboard/registerDashboardWidget.js';
 import setSetting from '../settings/setSetting.js';
 import declaredValue from '../settings/declaredValue.js';
 import createTablesFromSchema from './createTablesFromSchema.js';
+import readKempoConfig from './readKempoConfig.js';
 import { invalidateScopeCache } from './scopeCache.js';
 import { getUnmetDependencies } from './dependencies.js';
 
@@ -31,7 +31,6 @@ export default async ({ name }) => {
 
   const extRoot = join(process.cwd(), 'node_modules', name);
   const extPkgPath = join(extRoot, 'package.json');
-  const kempoConfigPath = join(extRoot, 'kempo-config.json');
 
   if(!existsSync(extPkgPath)){
     return [{ code: 404, msg: `Extension package "${name}" not found` }, null];
@@ -39,10 +38,7 @@ export default async ({ name }) => {
 
   let pkg, kempoConfig;
   try {
-    pkg = JSON.parse(await readFile(extPkgPath, 'utf-8'));
-    kempoConfig = existsSync(kempoConfigPath)
-      ? JSON.parse(await readFile(kempoConfigPath, 'utf-8'))
-      : {};
+    ({ pkg, kempo: kempoConfig } = await readKempoConfig(extRoot));
   } catch {
     return [{ code: 500, msg: `Failed to read extension package files` }, null];
   }

package/server/utils/extensions/listExtensions.js

@@ -2,15 +2,16 @@ import db from '../../db/index.js';
 import { extension } from '../../db/schema.js';
 import { sql } from 'drizzle-orm';
 import { join } from 'path';
-import { readFile } from 'fs/promises';
+import readKempoConfig from './readKempoConfig.js';
 
 const NODE_MODULES = join(process.cwd(), 'node_modules');
 
-const readPkg = async (name) => {
+const readConfig = async name => {
   try {
-    const raw = await readFile(join(NODE_MODULES, name, 'package.json'), 'utf-8');
-    return JSON.parse(raw);
-  } catch { return {}; }
+    return await readKempoConfig(join(NODE_MODULES, name));
+  } catch {
+    return { pkg: {}, kempo: {} };
+  }
 };
 
 export default async ({ limit = 50, offset = 0 } = {}) => {
@@ -20,13 +21,13 @@ export default async ({ limit = 50, offset = 0 } = {}) => {
       db.select({ count: sql`count(*)` }).from(extension),
     ]);
     const enriched = await Promise.all(items.map(async (ext) => {
-      const pkg = await readPkg(ext.name);
+      const { pkg, kempo } = await readConfig(ext.name);
       return {
         ...ext,
         description: pkg.description || null,
         author: pkg.author || null,
         license: pkg.license || null,
-        docs: pkg.kempo?.docs || null,
+        docs: kempo.docs || null,
       };
     }));
     return [null, { items: enriched, total: Number(count), limit, offset }];

package/server/utils/extensions/readKempoConfig.js

@@ -0,0 +1,20 @@
+import { join } from 'path';
+import { readFile } from 'fs/promises';
+
+/*
+  What an installed extension declares to kempo: its `public-scope`, `docs`, `git`, `schema`, `hooks`,
+  `permissions`, `settings`, `groups`, `dependencies` and `widgets`.
+
+  It lives in the extension's kempo-config.json, which is the one place it is written. package.json's own
+  `kempo` field is still read, as the fallback for an older extension that put everything there, and
+  kempo-config.json wins field by field. Nothing should add new keys to package.json.
+
+  Reads both files fresh each time, so an extension replaced on disk is seen without a restart.
+  Throws when package.json cannot be read, which is how a caller knows the package is not installed.
+*/
+export default async extRoot => {
+  const pkg = JSON.parse(await readFile(join(extRoot, 'package.json'), 'utf-8'));
+  const config = await readFile(join(extRoot, 'kempo-config.json'), 'utf-8').then(JSON.parse, () => ({}));
+
+  return { pkg, kempo: { ...(pkg.kempo || {}), ...config } };
+};

package/server/utils/extensions/updateExtension.js

@@ -3,7 +3,6 @@ import { extension, hook, permission, group, groupPermission } from '../../db/sc
 import { eq, and } from 'drizzle-orm';
 import { createRequire } from 'module';
 import { dirname, join } from 'path';
-import { readFile } from 'fs/promises';
 import { randomUUID } from 'crypto';
 import { execSync } from 'child_process';
 import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
@@ -13,6 +12,7 @@ import unregisterDashboardWidget from '../dashboard/unregisterDashboardWidget.js
 import setSetting from '../settings/setSetting.js';
 import declaredValue from '../settings/declaredValue.js';
 import createTablesFromSchema from './createTablesFromSchema.js';
+import readKempoConfig from './readKempoConfig.js';
 
 const requireFromProject = createRequire(join(process.cwd(), 'package.json'));
 
@@ -43,17 +43,19 @@ export default async ({ name, version = 'latest' }) => {
     return [{ code: 500, msg: `Failed to update package: ${error.message}` }, null];
   }
 
-  let pkgPath, extRoot, pkg;
+  /*
+    What the new version declares comes from its kempo-config.json (package.json's own `kempo` field is
+    only the fallback for an older extension). Reading package.json alone meant that no extension's new
+    permissions, settings, groups, hooks or widgets ever reached the database through this update.
+  */
+  let extRoot, pkg, newKempo;
   try {
-    pkgPath = requireFromProject.resolve(`${name}/package.json`);
-    extRoot = dirname(pkgPath);
-    pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+    extRoot = dirname(requireFromProject.resolve(`${name}/package.json`));
+    ({ pkg, kempo: newKempo } = await readKempoConfig(extRoot));
   } catch {
     return [{ code: 404, msg: `Updated package "${name}" not found` }, null];
   }
 
-  const newKempo = pkg.kempo || {};
-
   /*
     Create any new tables from schema
   */