kempo 4.5.8 → 4.6.1

package/server/utils/extensions/enableExtension.js

@@ -1,33 +1,2 @@
-import db from '../../db/index.js';
-import { extension } from '../../db/schema.js';
-import { eq } from 'drizzle-orm';
-import { invalidateScopeCache } from './scopeCache.js';
-import { getUnmetDependencies } from './dependencies.js';
-
-export default async ({ name }) => {
-  if(!name){
-    return [{ code: 400, msg: 'Extension name is required' }, null];
-  }
-
-  try {
-    const [existing] = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
-    if(!existing){
-      return [{ code: 404, msg: 'Extension not found' }, null];
-    }
-
-    const unmet = await getUnmetDependencies(existing.kempo?.dependencies || []);
-    if(unmet.length){
-      return [{ code: 409, msg: `Requires ${unmet.join(', ')} to be enabled first` }, null];
-    }
-
-    const [updated] = await db.update(extension)
-      .set({ enabled: true, updatedAt: new Date() })
-      .where(eq(extension.name, name))
-      .returning();
-
-    invalidateScopeCache();
-    return [null, updated];
-  } catch(error) {
-    return [{ code: 500, msg: 'Failed to enable extension' }, null];
-  }
-};
+/* The name callers import; the implementation, with its cascade over requirements, is in enableExtensionTree.js. */
+export { default } from './enableExtensionTree.js';

package/server/utils/extensions/enableExtensionTree.js

@@ -0,0 +1,54 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq, inArray } from 'drizzle-orm';
+import { invalidateScopeCache } from './scopeCache.js';
+import getRequirementTree from './getRequirementTree.js';
+
+/*
+  Switches an extension on. It cannot run without what it requires, so any of that which is installed
+  but off has to be enabled too: without `cascade` this refuses and returns that whole chain as
+  `requirements` for the caller to show, and with `cascade` they are enabled together with it, in one
+  statement. A requirement that is not installed at all cannot be fixed by enabling, and is refused
+  by name either way.
+
+  It only ever turns on what the extension needs. Whatever else was switched off along with it, for
+  its own reasons, stays off.
+*/
+export default async ({ name, cascade = false }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Extension name is required' }, null];
+  }
+
+  try {
+    const [existing] = await db.select({ name: extension.name }).from(extension).where(eq(extension.name, name)).limit(1);
+    if(!existing){
+      return [{ code: 404, msg: 'Extension not found' }, null];
+    }
+
+    const { disabled, missing } = await getRequirementTree(name);
+
+    if(missing.length){
+      return [{ code: 409, msg: `Requires ${missing.join(', ')}, which ${missing.length === 1 ? 'is' : 'are'} not installed`, missing }, null];
+    }
+
+    if(disabled.length && !cascade){
+      return [{
+        code: 409,
+        msg: `Requires ${disabled.map(requirement => requirement.name).join(', ')} to be enabled first`,
+        requirements: disabled,
+      }, null];
+    }
+
+    const names = [name, ...disabled.map(requirement => requirement.name)];
+    await db.update(extension)
+      .set({ enabled: true, updatedAt: new Date() })
+      .where(inArray(extension.name, names));
+
+    const [updated] = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
+
+    invalidateScopeCache();
+    return [null, { ...updated, enabled: true, enabledNames: names }];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to enable extension' }, null];
+  }
+};

package/server/utils/extensions/getDependentTree.js

@@ -0,0 +1,47 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+/*
+  Everything that has to go along with `name`: the extensions that require it, the ones that require
+  those, and so on. Each entry says which members of the affected set (the extension itself included)
+  it requires directly, so the chain can be shown, and whether it is currently enabled. Deepest
+  dependents first, which is the order they would have to be dealt with one at a time.
+
+  By default only enabled extensions count, which is what disabling needs: one that is already off
+  does not have to be switched off again. Uninstalling needs `includeDisabled`, because an extension
+  that is installed but switched off is still installed, and must not be left behind without what it
+  requires.
+*/
+export default async (name, { includeDisabled = false } = {}) => {
+  const rows = await (includeDisabled
+    ? db.select({ name: extension.name, kempo: extension.kempo, enabled: extension.enabled }).from(extension)
+    : db.select({ name: extension.name, kempo: extension.kempo, enabled: extension.enabled }).from(extension).where(eq(extension.enabled, true)));
+
+  const requires = new Map(rows.map(row => [row.name, row.kempo?.dependencies || []]));
+  const enabled = new Map(rows.map(row => [row.name, row.enabled]));
+  const depth = new Map([[name, 0]]);
+  let frontier = [name];
+
+  while(frontier.length){
+    const next = [];
+    for(const [candidate, needs] of requires){
+      if(depth.has(candidate)) continue;
+      const via = frontier.find(need => needs.includes(need));
+      if(via !== undefined){
+        depth.set(candidate, depth.get(via) + 1);
+        next.push(candidate);
+      }
+    }
+    frontier = next;
+  }
+
+  return [...depth.entries()]
+    .filter(([candidate]) => candidate !== name)
+    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .map(([candidate]) => ({
+      name: candidate,
+      requires: requires.get(candidate).filter(need => depth.has(need)),
+      enabled: enabled.get(candidate) === true,
+    }));
+};

package/server/utils/extensions/getMarketplaceClient.js

@@ -0,0 +1,20 @@
+import getSetting from '../settings/getSetting.js';
+import { createCatalogClient, DEFAULT_CATALOG_URL } from './catalogClient.js';
+
+const clients = new Map();
+
+/*
+  This site's marketplace client. The address is the `system:extensions_catalog_url` setting: it
+  defaults to https://kempo.dev/api/v1, and an empty value turns the marketplace off. It is
+  deliberately not one of the seeded default settings, because seeding rewrites those on every run and
+  would put a site's chosen address back.
+
+  One client per address, so its in-memory cache outlives a request.
+*/
+export default async () => {
+  const [, configured] = await getSetting('system', 'extensions_catalog_url', DEFAULT_CATALOG_URL);
+  const baseUrl = typeof configured === 'string' ? configured.trim() : DEFAULT_CATALOG_URL;
+
+  if(!clients.has(baseUrl)) clients.set(baseUrl, createCatalogClient({ baseUrl }));
+  return clients.get(baseUrl);
+};

package/server/utils/extensions/getRequirementTree.js

@@ -0,0 +1,43 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+
+/*
+  What an extension needs in order to run, followed all the way down: the extensions it requires, the
+  ones those require, and so on.
+
+    disabled   installed but switched off, so they have to be enabled first. Each says which of its
+               own requirements it needs, and they come dependencies-first, the order they could be
+               enabled one at a time.
+    missing    not installed at all. Enabling cannot fix that.
+
+  The mirror of getDependentTree.js, which walks the other way (what needs this one).
+*/
+export default async name => {
+  const rows = await db.select({ name: extension.name, kempo: extension.kempo, enabled: extension.enabled }).from(extension);
+  const byName = new Map(rows.map(row => [row.name, row]));
+
+  const disabled = [];
+  const missing = [];
+  const seen = new Set([name]);
+
+  const visit = current => {
+    for(const required of byName.get(current)?.kempo?.dependencies || []){
+      if(seen.has(required)) continue;
+      seen.add(required);
+
+      const row = byName.get(required);
+      if(!row){
+        missing.push(required);
+        continue;
+      }
+
+      visit(required);
+      if(!row.enabled){
+        disabled.push({ name: required, requires: (row.kempo?.dependencies || []).filter(need => byName.has(need)) });
+      }
+    }
+  };
+  visit(name);
+
+  return { disabled, missing };
+};

package/server/utils/extensions/getSiteInstallId.js

@@ -0,0 +1,21 @@
+import { randomUUID } from 'crypto';
+import getSetting from '../settings/getSetting.js';
+import setSetting from '../settings/setSetting.js';
+
+/*
+  The random id this site uses to identify itself to the extension marketplace, so an install is
+  counted once however many times an extension is uninstalled and reinstalled, and a site can have one
+  rating per extension. Generated the first time it is needed and kept in `system:install_id`.
+
+  It identifies nothing but this install: no name, address or account is attached to it.
+*/
+export default async () => {
+  const [error, existing] = await getSetting('system', 'install_id', null);
+  if(error) return [error, null];
+  if(typeof existing === 'string' && existing) return [null, existing];
+
+  const installId = randomUUID();
+  const [setError] = await setSetting('system', 'install_id', installId, 'string', false, 'Random id this site uses to identify itself to the extension marketplace');
+  if(setError) return [setError, null];
+  return [null, installId];
+};

package/server/utils/extensions/installFromCatalog.js

@@ -0,0 +1,127 @@
+import { existsSync } from 'fs';
+import { join } from 'path';
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import installExtension from './installExtension.js';
+import installPackage from './installPackage.js';
+import enableExtension from './enableExtension.js';
+import { NAME_PATTERN } from './catalogClient.js';
+
+const isInstalled = async name => {
+  const [row] = await db.select({ name: extension.name }).from(extension).where(eq(extension.name, name)).limit(1);
+  return !!row;
+};
+
+const isEnabled = async name => {
+  const [row] = await db.select({ enabled: extension.enabled }).from(extension).where(eq(extension.name, name)).limit(1);
+  return row?.enabled === true;
+};
+
+const hasPackage = name => existsSync(join(process.cwd(), 'node_modules', name, 'package.json'));
+
+/*
+  Installs an extension, and with `withDependencies` every extension it needs first, in dependency
+  order, downloading what is not in node_modules. What is installed is exactly the marketplace's tree
+  for that extension: the caller is expected to have shown it to the administrator for approval.
+
+  Without `withDependencies` only `name` is installed, and a dependency that is not installed yet is
+  an error that names them (`needs`), so the caller can ask.
+
+  A package that is already in node_modules is not downloaded again. A failure part way leaves what
+  was installed before it installed (each one is a normal, complete install) and says which.
+
+  `deps` exists so the order and the refusals can be tested without npm or a database.
+*/
+export default async ({ name, withDependencies = false, client, installId, report = true, deps = {} }) => {
+  const download = deps.download || installPackage;
+  const install = deps.install || installExtension;
+  const installed = deps.isInstalled || isInstalled;
+  const enabled = deps.isEnabled || isEnabled;
+  const enable = deps.enable || enableExtension;
+  const present = deps.hasPackage || hasPackage;
+
+  if(typeof name !== 'string' || !NAME_PATTERN.test(name)){
+    return [{ code: 400, msg: 'Extension name is not a valid package name' }, null];
+  }
+
+  if(await installed(name)){
+    return [{ code: 409, msg: 'Extension is already installed' }, null];
+  }
+
+  const [detailsError, details] = await client.details(name);
+
+  /*
+    Without the marketplace an extension that is already in node_modules can still be installed the
+    way it always could be; one that has to be downloaded cannot.
+  */
+  if(detailsError){
+    if(!present(name)) return [detailsError, null];
+    const [error, data] = await install({ name });
+    if(error) return [error, null];
+    return [null, { name, installed: [name], ...data }];
+  }
+
+  const plan = [...details.dependencies.extensions, { name, version: details.version, installable: details.installable }];
+
+  for(const missing of details.dependencies.unresolved){
+    if(!(await installed(missing)) && !present(missing)){
+      return [{ code: 409, msg: `Requires ${missing}, which is not in the extension catalogue` }, null];
+    }
+  }
+
+  if(!withDependencies){
+    const needs = [];
+    for(const step of plan.slice(0, -1)){
+      if(!(await installed(step.name)) || !(await enabled(step.name))) needs.push(step.name);
+    }
+    if(needs.length){
+      return [{ code: 409, msg: `Requires ${needs.join(', ')} to be installed and enabled first`, needs }, null];
+    }
+  }
+
+  const done = [];
+  const switchedOn = [];
+  let result = {};
+
+  for(const step of withDependencies ? plan : plan.slice(-1)){
+    /*
+      Installed but switched off is not usable as a requirement. The administrator approved this chain,
+      so it is switched on rather than refused.
+    */
+    if(await installed(step.name)){
+      if(!(await enabled(step.name))){
+        const [enableError] = await enable({ name: step.name, cascade: true });
+        if(enableError) return [{ ...enableError, installed: done, enabled: switchedOn }, null];
+        switchedOn.push(step.name);
+      }
+      continue;
+    }
+
+    if(!present(step.name)){
+      if(!step.installable){
+        return [{ code: 409, msg: `"${step.name}" is listed but not published yet, so it cannot be installed`, installed: done }, null];
+      }
+      const [downloadError] = await download({ name: step.name, version: step.version || 'latest' });
+      if(downloadError) return [{ ...downloadError, installed: done }, null];
+    }
+
+    const [installError, data] = await install({ name: step.name });
+    if(installError) return [{ ...installError, installed: done }, null];
+
+    done.push(step.name);
+    if(step.name === name) result = data;
+  }
+
+  /*
+    Tell the marketplace, once per extension, after the fact and without making the install wait for
+    it: a marketplace that is down must not make an install fail.
+  */
+  if(report && installId){
+    for(const installedName of done){
+      client.report({ installId, extension: installedName }).catch(() => {});
+    }
+  }
+
+  return [null, { name, installed: done, enabled: switchedOn, ...result }];
+};

package/server/utils/extensions/installPackage.js

@@ -0,0 +1,36 @@
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { NAME_PATTERN } from './catalogClient.js';
+
+const run = promisify(execFile);
+
+/*
+  Downloads an extension's package into this site's node_modules with `npm install`, which also adds it
+  to the site's package.json. Only an exact package name and a plain version or tag are accepted, which
+  is what makes passing them to a shell on Windows (where npm is a .cmd) safe.
+
+  Note for container deployments: this changes the running container's files. A redeploy that rebuilds
+  the image from the repository's package.json does not include it, so add the package there too.
+*/
+export default async ({ name, version = 'latest' }) => {
+  if(typeof name !== 'string' || !NAME_PATTERN.test(name)){
+    return [{ code: 400, msg: 'Extension name is not a valid package name' }, null];
+  }
+  if(typeof version !== 'string' || !/^[A-Za-z0-9._-]+$/.test(version)){
+    return [{ code: 400, msg: 'Extension version is not valid' }, null];
+  }
+
+  try {
+    await run('npm', ['install', `${name}@${version}`, '--no-audit', '--no-fund'], {
+      cwd: process.cwd(),
+      shell: process.platform === 'win32',
+      timeout: 5 * 60 * 1000,
+      maxBuffer: 10 * 1024 * 1024,
+    });
+  } catch(error) {
+    const detail = String(error.stderr || error.message || '').trim().split('\n').filter(Boolean).slice(-3).join(' ');
+    return [{ code: 500, msg: `Failed to download "${name}": ${detail}` }, null];
+  }
+
+  return [null, { name, version }];
+};

package/server/utils/extensions/scopeCache.js

@@ -1,18 +1,27 @@
 import db from '../../db/index.js';
 import { extension } from '../../db/schema.js';
-import { eq } from 'drizzle-orm';
 
 let cache = null;
 
 export const invalidateScopeCache = () => { cache = null; };
 
-export const getEnabledExtensions = async () => {
+/* One read of the extension table serves both questions, until an install/enable/disable/uninstall. */
+const load = async () => {
   if(cache) return cache;
   try {
-    cache = await db.select().from(extension).where(eq(extension.enabled, true));
+    const rows = await db.select().from(extension);
+    cache = {
+      enabled: rows.filter(row => row.enabled),
+      disabled: new Set(rows.filter(row => !row.enabled).map(row => row.name)),
+    };
   } catch(e) {
-    console.error('[scopeCache] DB error fetching enabled extensions:', e.message);
-    return [];
+    console.error('[scopeCache] DB error fetching extensions:', e.message);
+    return { enabled: [], disabled: new Set() };
   }
   return cache;
 };
+
+export const getEnabledExtensions = async () => (await load()).enabled;
+
+/* Names of extensions that are installed but switched off. Not-installed owners (core, a site) are never in it. */
+export const getDisabledExtensionNames = async () => (await load()).disabled;

package/server/utils/extensions/uninstallExtension.js

@@ -1,124 +1,2 @@
-import db from '../../db/index.js';
-import { extension, hook, permission, setting, group, groupPermission, userGroup, dashboardWidget } from '../../db/schema.js';
-import { eq, inArray, like } from 'drizzle-orm';
-import { join } from 'path';
-import { pathToFileURL } from 'url';
-import { sql } from 'drizzle-orm';
-import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
-import { invalidateScopeCache } from './scopeCache.js';
-import { getEnabledDependents } from './dependencies.js';
-
-/*
-  Uninstall an extension.
-
-  `purgeData` false (the default) deregisters the extension but leaves everything it created in
-  place — its tables and their rows, group memberships, permissions, groups and settings — so
-  reinstalling restores the site exactly as it was. This is the right mode for reinstalling to pick
-  up a fix.
-
-  `purgeData` true additionally destroys all of that. For an extension like kempo-blog that means
-  every post and comment, so it must always be a deliberate choice rather than a default.
-
-  Hooks and the extension row are removed either way. A registered hook whose module is no longer
-  installed cannot be tolerated: `middleware:before_page` is triggered with `bail: true`, so a
-  handler that fails to import now aborts the render and every page 404s.
-*/
-export default async ({ name, purgeData = false }) => {
-  if(!name){
-    return [{ code: 400, msg: 'Extension name is required' }, null];
-  }
-
-  let kempoConfig;
-  try {
-    const [existing] = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
-    if(!existing){
-      return [{ code: 404, msg: 'Extension not found' }, null];
-    }
-    kempoConfig = existing.kempo || {};
-  } catch(error) {
-    return [{ code: 500, msg: 'Failed to find extension' }, null];
-  }
-
-  const dependents = await getEnabledDependents(name);
-  if(dependents.length){
-    return [{ code: 409, msg: `${dependents.join(', ')} depends on this extension and is still enabled` }, null];
-  }
-
-  try {
-    const extRoot = join(process.cwd(), 'node_modules', name);
-    const uninstallModule = await import(pathToFileURL(join(extRoot, 'uninstall.js')).href + `?t=${Date.now()}`).catch(() => null);
-    if(uninstallModule?.default){
-      await uninstallModule.default();
-    }
-  } catch {}
-
-  /*
-    Drop declarative schema tables. Only when purging — these hold the extension's actual content.
-  */
-  if(purgeData && kempoConfig.schema){
-    try {
-      const extRoot = join(process.cwd(), 'node_modules', name);
-      const schemaModule = await import(pathToFileURL(join(extRoot, kempoConfig.schema)).href);
-      const { getTableConfig } = await import('drizzle-orm/pg-core');
-      for(const exported of Object.values(schemaModule)){
-        if(typeof exported !== 'object' || !exported?.[Symbol.for('drizzle:Name')]) continue;
-        const { name: tableName } = getTableConfig(exported);
-        await db.execute(sql.raw(`DROP TABLE IF EXISTS "${tableName}" CASCADE`));
-      }
-    } catch {}
-  }
-
-  /*
-    Remove declarative groups, permissions and settings. Only when purging: these are what a
-    reinstall would otherwise restore, and group memberships in particular represent real user
-    state — every registered user of kempo-blog belongs to kempo-blog:member.
-
-    userGroup and groupPermission both reference group.name, and groupPermission also references
-    permission.name, none of them cascading. The membership and grant rows therefore have to go
-    first or these deletes fail the foreign key — which they used to do silently, leaving every
-    uninstalled extension's groups and permissions behind forever.
-  */
-  if(purgeData){
-    const groupNames = (kempoConfig.groups || []).map(g => g.name);
-    const permNames = (kempoConfig.permissions || []).map(p => p.name);
-
-    try {
-      if(groupNames.length){
-        await db.delete(userGroup).where(inArray(userGroup.groupName, groupNames));
-        await db.delete(groupPermission).where(inArray(groupPermission.groupName, groupNames));
-      }
-      if(permNames.length){
-        await db.delete(groupPermission).where(inArray(groupPermission.permissionName, permNames));
-      }
-      if(groupNames.length){
-        await db.delete(group).where(inArray(group.name, groupNames));
-      }
-      if(permNames.length){
-        await db.delete(permission).where(inArray(permission.name, permNames));
-      }
-    } catch(error) {
-      return [{ code: 500, msg: `Failed to remove extension groups and permissions: ${error.message}` }, null];
-    }
-
-    /*
-      Ownership is encoded in the setting name as "extname:settingname" — the setting table has no
-      owner column, so these have to be matched by prefix.
-    */
-    await db.delete(setting).where(like(setting.name, `${name}:%`));
-  }
-
-  try {
-    await db.delete(hook).where(eq(hook.owner, name));
-    await db.delete(dashboardWidget).where(eq(dashboardWidget.owner, name));
-    await db.delete(extension).where(eq(extension.name, name));
-  } catch(error) {
-    return [{ code: 500, msg: 'Failed to remove extension' }, null];
-  }
-
-  clearHandlerCache();
-  invalidateScopeCache();
-  await triggerHook('extension:uninstalled', { name });
-
-  return [null, { success: true }];
-};
-
+/* The name callers import; the implementation, with its cascade over dependents, is in uninstallExtensionTree.js. */
+export { default } from './uninstallExtensionTree.js';