kempo 4.6.1 → 4.7.0

package/middleware/kempo.js

@@ -5,11 +5,16 @@ import { renderExternalPage } from 'kempo-server/templating';
 import getSession from '../server/utils/auth/getSession.js';
 import currentUserHasPermission from '../server/utils/permissions/currentUserHasPermission.js';
 import { LEXICAL_BASE, bundleFileName as lexicalBundleFileName } from '../server/utils/lexical/packages.js';
-import { getEnabledExtensions } from '../server/utils/extensions/scopeCache.js';
+import { getEnabledExtensions, onExtensionsChanged } from '../server/utils/extensions/scopeCache.js';
+import { resyncMenus } from '../server/utils/menus/store.js';
 import readKempoConfig from '../server/utils/extensions/readKempoConfig.js';
 import { extensionAdminDirs, extensionPublicDirs } from '../server/utils/extensions/contentDirs.js';
 import triggerHook from '../server/utils/hooks/triggerHook.js';
 import { ADMIN_GLOBALS_DIR } from '../server/utils/admin-global-content/helpers.js';
+import { startScheduler } from '../server/utils/scheduler/scheduler.js';
+import { ensureEncryptionKey } from '../server/utils/settings/ensureEncryptionKey.js';
+import { resolveAlias } from '../server/utils/extensions/aliases.js';
+import { normalizeScopes } from '../server/utils/extensions/scopes.js';
 
 const MIME_TYPES = {
   '.js': 'application/javascript',
@@ -177,10 +182,30 @@ const serveDir = async (dirPath, method, request, response, resolveDir, rootDir,
 };
 
 export default config => {
+  startScheduler();
+
+  /*
+    The key that encrypts stored credentials exists before any request needs it, generated into .env the
+    first time when the site has none. Opt out with `autoEncryptionKey: false` in the server config or
+    KEMPO_AUTO_ENCRYPTION_KEY=off, and never in the in-memory test database.
+  */
+  const encryptionKeyReady = config.autoEncryptionKey === false || process.env.KEMPO_AUTO_ENCRYPTION_KEY === 'off' || process.env.KEMPO_DB === 'pglite'
+    ? Promise.resolve()
+    : ensureEncryptionKey().then(([error]) => {
+      if(error) console.error(`[kempo] ${error.msg}`);
+    });
   const PROJECT_PUBLIC = config.rootPath || join(process.cwd(), 'public');
   const ADMIN_ROOT = resolveAdminRoot(config.adminRoot);
 
+  /*
+    A menu holds a copy of what an extension supplied, so it is brought up to date whenever extensions are
+    installed, enabled, disabled or removed: what an extension supplied leaves the site with it. Not at
+    start, when the database may not be answering yet and every extension would look absent.
+  */
+  onExtensionsChanged(() => resyncMenus(PROJECT_PUBLIC));
+
   return async (request, response, next) => {
+    await encryptionKeyReady;
     const { path } = request;
     const url = request.url.split('?')[0];
 
@@ -394,23 +419,34 @@ export default config => {
     */
     const publicContentDirs = await extensionPublicDirs();
 
+    const loaded = [];
     for(const ext of extensions){
       const extRoot = join(NODE_MODULES, ext.name);
-      let kempo;
       try {
-        ({ kempo } = await readKempoConfig(extRoot));
-      } catch {
-        continue;
-      }
+        loaded.push({ extRoot, kempo: (await readKempoConfig(extRoot)).kempo });
+      } catch { /* not readable: nothing to route */ }
+    }
 
-      const scope = kempo['public-scope'];
-      if(!scope) continue;
+    /*
+      An extension may answer on a short address it declares in `aliases` (`/cart` for `/commerce/cart`);
+      the routing below then treats the request as if it had arrived at the real address. A page the
+      site has of its own at that address always wins (see server/utils/extensions/aliases.js).
+    */
+    const routedUrl = await resolveAlias(url, loaded, PROJECT_PUBLIC);
 
-      const scopePrefix = `/${scope}`;
-      if(url !== scopePrefix && !url.startsWith(`${scopePrefix}/`)) continue;
+    for(const { extRoot, kempo } of loaded){
+      /*
+        An extension may claim several scopes, each serving a folder of its package ("public-scope" serves
+        public/, "public-scopes" names others). Installing or enabling one that claims an address another
+        enabled extension has is refused, so at most one extension matches any request.
+      */
+      const [, scopes] = normalizeScopes(kempo);
+      const claimed = scopes.find(({ scope }) => routedUrl === `/${scope}` || routedUrl.startsWith(`/${scope}/`));
+      if(!claimed) continue;
 
-      const publicDir = join(extRoot, 'public');
-      const subPath = url.slice(scopePrefix.length) || '/';
+      const scopePrefix = `/${claimed.scope}`;
+      const publicDir = join(extRoot, claimed.dir);
+      const subPath = routedUrl.slice(scopePrefix.length) || '/';
       const method = request.method?.toUpperCase() || 'GET';
       const resolveDir = buildResolveDir(PROJECT_PUBLIC, url);
       const segments = subPath.replace(/^\//, '').split('/').filter(Boolean);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo",
-  "version": "4.6.1",
+  "version": "4.7.0",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {
@@ -60,7 +60,7 @@
   "peerDependencies": {
     "kempo-css": ">=2.2.5",
     "kempo-server": ">=3.4.0",
-    "kempo-ui": ">=0.5.1"
+    "kempo-ui": ">=0.6.0"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.9",

package/server/db/schema.js

@@ -115,6 +115,29 @@ export const extension = pgTable('extension', {
   updatedAt: timestamp('updatedAt').notNull(),
 });
 
+/*
+  Scheduled jobs: recurring work an extension declares in its kempo-config.json `jobs`. A row per job
+  is the schedule and the lease: `nextRunAt` is when it is next due and `lockedUntil` is held while a
+  process runs it, so several server processes sharing one database run each job once per interval.
+  `lastStatus` is 'ok' or 'error'.
+*/
+export const scheduledJob = pgTable('scheduledJob', {
+  id: text('id').primaryKey(),
+  owner: text('owner').notNull(),
+  name: text('name').notNull(),
+  everyMs: integer('everyMs').notNull(),
+  callback: text('callback').notNull(),
+  nextRunAt: timestamp('nextRunAt').notNull(),
+  lockedUntil: timestamp('lockedUntil'),
+  lastRunAt: timestamp('lastRunAt'),
+  lastStatus: text('lastStatus'),
+  lastError: text('lastError'),
+  createdAt: timestamp('createdAt').notNull(),
+}, table => [
+  index('scheduledJob_owner_idx').on(table.owner),
+  index('scheduledJob_next_idx').on(table.nextRunAt),
+]);
+
 /*
   Realtime System
 */
@@ -203,6 +226,7 @@ export const dashboardWidget = pgTable('dashboardWidget', {
   title: text('title').notNull(),
   description: text('description'),
   icon: text('icon'),
+  iconSrc: text('iconSrc'),
   element: text('element').notNull(),
   module: text('module').notNull(),
   defaultWidth: integer('defaultWidth').notNull().default(2),

package/server/sdk.js

@@ -144,6 +144,16 @@ export { default as enableGlobalContent } from './utils/global-content/enableGlo
 export { default as getGlobalContent } from './utils/global-content/getGlobalContent.js';
 export { default as listGlobalContent } from './utils/global-content/listGlobalContent.js';
 export { default as setGlobalContentLocked } from './utils/global-content/setGlobalContentLocked.js';
+export { default as listMenus } from './utils/menus/listMenus.js';
+export { default as findNavItems } from './utils/menus/findNavItems.js';
+export { default as saveMenu } from './utils/menus/saveMenu.js';
+export { default as deleteMenu } from './utils/menus/deleteMenu.js';
+export { default as assignMenuLocation } from './utils/menus/assignMenuLocation.js';
+export { default as saveMenuItem } from './utils/menus/saveMenuItem.js';
+export { default as deleteMenuItems } from './utils/menus/deleteMenuItems.js';
+export { default as setMenuItemEnabled } from './utils/menus/setMenuItemEnabled.js';
+export { default as reorderMenuItems } from './utils/menus/reorderMenuItems.js';
+export { default as adoptMenuItem } from './utils/menus/adoptMenuItem.js';
 export { default as updateGlobalContent } from './utils/global-content/updateGlobalContent.js';
 
 /*
@@ -159,12 +169,23 @@ export { default as getAdminGlobalContent } from './utils/admin-global-content/g
 export { default as listAdminGlobalContent } from './utils/admin-global-content/listAdminGlobalContent.js';
 export { default as updateAdminGlobalContent } from './utils/admin-global-content/updateAdminGlobalContent.js';
 
+/*
+  Scheduled Jobs
+*/
+
+export { default as listJobs } from './utils/scheduler/listJobs.js';
+export { default as registerJobs } from './utils/scheduler/registerJobs.js';
+export { default as unregisterJobs } from './utils/scheduler/unregisterJobs.js';
+export { runDueJobs, runJob } from './utils/scheduler/runJobs.js';
+export { startScheduler, stopScheduler } from './utils/scheduler/scheduler.js';
+
 /*
   Email
 */
 
 export { default as sendEmail } from './utils/email/sendEmail.js';
 export { default as sendEmailFromTemplate } from './utils/email/sendEmailFromTemplate.js';
+export { default as renderEmailTemplate } from './utils/email/renderEmailTemplate.js';
 
 /*
   Filesystem Utilities

package/server/utils/auth/requestPasswordReset.js

@@ -7,7 +7,13 @@ import getSetting from '../settings/getSetting.js';
 
 const generateToken = () => crypto.randomBytes(32).toString('hex');
 
-export default async ({ email }) => {
+/*
+  `subject` and `template` let a caller send its own wording with the same link, for example an
+  extension that creates an account for someone at checkout and wants the email to say "set your
+  password". `template` is a name for sendEmailFromTemplate, including an extension's "owner/name".
+  The template receives `name` and `resetLink`.
+*/
+export default async ({ email, subject = 'Reset Your Password', template = 'reset-password' }) => {
   if(!email){
     return [{ code: 400, msg: 'Email is required' }, null];
   }
@@ -42,8 +48,8 @@ export default async ({ email }) => {
 
     const [emailError] = await sendEmailFromTemplate({
       to: email,
-      subject: 'Reset Your Password',
-      template: 'reset-password',
+      subject,
+      template,
       data: {
         name,
         resetLink,

package/server/utils/auth/verifyEmail.js

@@ -1,6 +1,7 @@
 import db from '../../db/index.js';
 import { verificationToken, user } from '../../db/schema.js';
 import { eq, and, gt } from 'drizzle-orm';
+import triggerHook from '../hooks/triggerHook.js';
 
 export default async ({ token }) => {
   if(!token){
@@ -36,7 +37,15 @@ export default async ({ token }) => {
       .delete(verificationToken)
       .where(eq(verificationToken.token, token));
 
-    return [null, { 
+    /*
+      Someone has just proved they own this address, which is what an extension needs before it hands
+      them something that was only ever tied to the address (guest orders, say). Fires
+      `user:email_verified` with `{ userId, email }`.
+    */
+    const [verified] = await db.select({ email: user.email }).from(user).where(eq(user.id, tokenRecord.userId)).limit(1);
+    await triggerHook('user:email_verified', { userId: tokenRecord.userId, email: verified?.email ?? null });
+
+    return [null, {
       success: true,
       userId: tokenRecord.userId
     }];

package/server/utils/dashboard/coreWidgets.js

@@ -4,6 +4,7 @@ const core = widget => ({
   owner: CORE_OWNER,
   description: null,
   icon: null,
+  iconSrc: null,
   defaultWidth: 2,
   defaultHeight: 1,
   minWidth: 1,

package/server/utils/dashboard/helpers.js

@@ -24,6 +24,7 @@ export const normalizeWidget = ({
   title,
   description = null,
   icon = null,
+  iconSrc = null,
   element,
   module,
   defaultWidth = 2,
@@ -57,6 +58,10 @@ export const normalizeWidget = ({
     return [{ code: 400, msg: 'Icon must be an icon name' }, null];
   }
 
+  if(iconSrc !== null && !(isLocalPath(iconSrc) && iconSrc.length <= 200)){
+    return [{ code: 400, msg: 'iconSrc must be the path to an icon file on this site, beginning with a single "/"' }, null];
+  }
+
   if(typeof element !== 'string' || !ELEMENT_PATTERN.test(element)){
     return [{ code: 400, msg: 'Element must be a custom element tag name such as "my-ext-widget"' }, null];
   }
@@ -128,6 +133,7 @@ export const normalizeWidget = ({
     title: title.trim(),
     description,
     icon,
+    iconSrc,
     element,
     module,
     defaultWidth,

package/server/utils/email/renderEmailTemplate.js

@@ -0,0 +1,63 @@
+import { existsSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+import { renderPage, renderExternalPage } from 'kempo-server/templating';
+import shake from 'kempo-css/shake';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+/*
+  Renders an email template to HTML, without sending it.
+
+  A plain name ("verify-email") is looked up in the site's `templates/emails`, then in kempo's own.
+
+  A name with an owner ("my-extension/order-paid") is an extension's template. The site may override
+  it at `templates/emails/my-extension/order-paid.page.html`; otherwise it is the extension's own
+  `emails/order-paid.page.html`. Either way the layout (`<page template="email">`) is the site's
+  `templates/emails/email.template.html` when it has one, and kempo's otherwise, so every email a site
+  sends looks the same.
+
+  Returns [error, html].
+*/
+export default async ({ template, data = {} } = {}) => {
+  if(!template){
+    return [{ code: 400, msg: 'Template name is required' }, null];
+  }
+  if(!/^[a-z0-9][a-z0-9-]*(\/[a-z0-9][a-z0-9-]*)?$/.test(template)){
+    return [{ code: 400, msg: `Invalid email template name: ${template}` }, null];
+  }
+
+  const consumerDir = join(process.cwd(), 'templates/emails');
+  const moduleDir = join(__dirname, '../../../app-templates/emails');
+  const [owner, name] = template.includes('/') ? template.split('/') : [null, template];
+
+  let pagePath;
+  let rootDir;
+  if(owner){
+    const override = join(consumerDir, owner, `${name}.page.html`);
+    pagePath = existsSync(override) ? override : join(process.cwd(), 'node_modules', owner, 'emails', `${name}.page.html`);
+    rootDir = existsSync(join(consumerDir, 'email.template.html')) ? consumerDir : moduleDir;
+  } else {
+    rootDir = existsSync(join(consumerDir, `${name}.page.html`)) ? consumerDir : moduleDir;
+    pagePath = join(rootDir, `${name}.page.html`);
+  }
+
+  if(!existsSync(pagePath)){
+    return [{ code: 404, msg: `Email template not found: ${template}` }, null];
+  }
+
+  const themePath = join(process.cwd(), 'public/styles.css');
+  const themeOpts = existsSync(themePath) ? { theme: themePath } : {};
+
+  try {
+    let html = owner
+      ? await renderExternalPage(pagePath, rootDir, rootDir, {}, data)
+      : await renderPage(pagePath, rootDir, {}, data);
+    const css = shake(html, { ...themeOpts, colorMode: 'light' });
+    html = html.replace('</head>', `<style>${css}</style></head>`);
+    return [null, html];
+  } catch(error){
+    console.error('Email render error:', error);
+    return [{ code: 500, msg: 'Failed to render the email template' }, null];
+  }
+};

package/server/utils/email/sendEmailFromTemplate.js

@@ -1,13 +1,10 @@
-import { existsSync } from 'fs';
-import { fileURLToPath } from 'url';
-import { dirname, join } from 'path';
-import { renderPage } from 'kempo-server/templating';
-import shake from 'kempo-css/shake';
+import renderEmailTemplate from './renderEmailTemplate.js';
 import sendEmail from './sendEmail.js';
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
+/*
+  `template` is a plain name for kempo's and the site's templates, or "owner/name" for an extension's;
+  see renderEmailTemplate.js.
+*/
 export default async ({ to, subject, template, data = {} }) => {
   if(!to){
     return [{ code: 400, msg: 'Recipient email is required' }, null];
@@ -21,25 +18,10 @@ export default async ({ to, subject, template, data = {} }) => {
     return [{ code: 400, msg: 'Template name is required' }, null];
   }
 
-  const consumerDir = join(process.cwd(), 'templates/emails');
-  const moduleDir = join(__dirname, '../../../app-templates/emails');
-  const rootDir = existsSync(join(consumerDir, `${template}.page.html`)) ? consumerDir : moduleDir;
-  const pagePath = join(rootDir, `${template}.page.html`);
-
-  if(!existsSync(pagePath)){
-    return [{ code: 404, msg: `Email template not found: ${template}` }, null];
+  const [error, html] = await renderEmailTemplate({ template, data });
+  if(error){
+    return [error, null];
   }
 
-  const themePath = join(process.cwd(), 'public/styles.css');
-  const themeOpts = existsSync(themePath) ? { theme: themePath } : {};
-
-  try {
-    let html = await renderPage(pagePath, rootDir, {}, data);
-    const css = shake(html, { ...themeOpts, colorMode: 'light' });
-    html = html.replace('</head>', `<style>${css}</style></head>`);
-    return await sendEmail({ to, subject, html });
-  } catch(error){
-    console.error('Email render error:', error);
-    return [{ code: 500, msg: 'Failed to send email from template' }, null];
-  }
+  return await sendEmail({ to, subject, html });
 };

package/server/utils/extensions/aliases.js

@@ -0,0 +1,71 @@
+import { join } from 'path';
+import { stat } from 'fs/promises';
+import { scopeNames } from './scopes.js';
+
+/*
+  Aliases let an extension answer on a short, familiar address instead of only under its public scope:
+  an extension with the scope `commerce` can declare `"aliases": { "/cart": "/commerce/cart" }` and its
+  cart page is then reachable at /cart/ too. The address stays as typed (it is a rewrite, not a redirect).
+
+  An alias must point inside one of the extension's own scopes, so an extension can only ever give a
+  second address to its own pages. It never shadows a page the site has of its own at that address, and
+  it cannot take over anything under /admin or /api. The alias address is a claim, like a scope, and no
+  other enabled extension may claim it (see claims.js).
+*/
+
+const RESERVED = /^\/(admin|api|kempo|kempo-css|kempo-ui)(\/|$)/;
+
+const trim = value => String(value).replace(/\/+$/, '');
+
+/*
+  Checks the `aliases` an extension declares: { "/from": "/scope/to" }. `scope` is the extension's
+  scope, or the list of its scopes. Returns [error, aliases].
+*/
+export const normalizeAliases = (aliases, scope) => {
+  const scopes = [scope].flat().filter(Boolean);
+  if(aliases === undefined || aliases === null) return [null, {}];
+  if(typeof aliases !== 'object' || Array.isArray(aliases)) return [{ code: 400, msg: 'aliases must be an object of address to address' }, null];
+
+  const result = {};
+  for(const [from, to] of Object.entries(aliases)){
+    const source = trim(from);
+    const target = trim(to);
+    if(!source.startsWith('/') || source === '' || RESERVED.test(source)) return [{ code: 400, msg: `Alias "${from}" must be an address such as /cart, outside /admin and /api` }, null];
+    if(!scopes.some(name => target === `/${name}` || target.startsWith(`/${name}/`))) return [{ code: 400, msg: `Alias "${from}" must point inside the extension's own scope (/${scopes.join(', /') || '…'}/…)` }, null];
+    result[source] = target;
+  }
+  return [null, result];
+};
+
+/* True when the site itself has a page, directory or file at this address, which always wins over an alias. */
+const siteHasPath = async (publicDir, address) => {
+  const base = join(publicDir, ...address.split('/').filter(Boolean));
+  const candidates = [base, `${base}.page.html`, `${base}.html`, join(base, 'index.page.html'), join(base, 'index.html'), join(base, 'index.js'), join(base, 'GET.js')];
+  for(const candidate of candidates){
+    try {
+      const info = await stat(candidate);
+      if(candidate === base ? info.isFile() : true) return true;
+    } catch { /* not there */ }
+  }
+  return false;
+};
+
+/*
+  The address to serve for `url`: the alias target when an enabled extension declares one for it and
+  the site has no page there, otherwise `url` unchanged. `loaded` is [{ kempo }] for the enabled extensions.
+*/
+export const resolveAlias = async (url, loaded, publicDir) => {
+  const clean = trim(url) || '/';
+  for(const { kempo } of loaded){
+    const scopes = scopeNames(kempo);
+    if(!scopes.length || !kempo.aliases) continue;
+    const [error, aliases] = normalizeAliases(kempo.aliases, scopes);
+    if(error) continue;
+    for(const [from, to] of Object.entries(aliases)){
+      if(clean !== from && !clean.startsWith(`${from}/`)) continue;
+      if(await siteHasPath(publicDir, from)) return url;
+      return to + url.slice(from.length);
+    }
+  }
+  return url;
+};

package/server/utils/extensions/checkClaims.js

@@ -0,0 +1,32 @@
+import { join } from 'path';
+import readKempoConfig from './readKempoConfig.js';
+import { getEnabledExtensions } from './scopeCache.js';
+import { findClaimConflicts, describeConflict } from './claims.js';
+
+const configOf = async name => {
+  try {
+    return { name, kempo: (await readKempoConfig(join(process.cwd(), 'node_modules', name))).kempo };
+  } catch {
+    return null;
+  }
+};
+
+/*
+  Refuses to put an extension on the site when another one that is on already uses an address it
+  claims. "names" are the extensions about to be switched on (installed, or enabled together with what
+  they require) and "verb" is what is being done ("install", "enable" or "update"). Returns [error] with
+  a 409 and the whole list as "conflicts", or [null].
+
+  An extension whose package cannot be read is skipped, as it cannot be routed to anyway. "kempo" gives
+  the config of a name to check instead of reading it, for one that has just changed.
+*/
+export default async ({ names, verb, kempo = {} }) => {
+  const candidates = (await Promise.all(names.map(async name => kempo[name] ? { name, kempo: kempo[name] } : configOf(name)))).filter(Boolean);
+  const enabled = (await getEnabledExtensions()).map(row => row.name).filter(name => !names.includes(name));
+  const others = (await Promise.all(enabled.map(configOf))).filter(Boolean);
+
+  const conflicts = findClaimConflicts(candidates, others);
+  if(!conflicts.length) return [null];
+
+  return [{ code: 409, msg: describeConflict(conflicts[0], verb), conflicts }];
+};

package/server/utils/extensions/claims.js

@@ -0,0 +1,54 @@
+import { scopeNames } from './scopes.js';
+import { normalizeAliases } from './aliases.js';
+
+/*
+  An address an extension answers on is a *claim*, and the router can give an address to only one
+  extension. Whichever one it reaches first gets every request for it, and the other's pages, scripts
+  and API routes under it answer 404 without any error, so two extensions may not claim the same
+  address or one inside the other.
+
+  Every claim is a path: each of the extension's scopes (/products) and each of its alias addresses
+  (/cart). An alias that is invalid is left out here, since it is refused on its own.
+*/
+export const claimsOf = kempo => {
+  const names = scopeNames(kempo);
+  const [, aliases] = normalizeAliases(kempo?.aliases, names);
+  return [...names.map(scope => `/${scope}`), ...Object.keys(aliases ?? {})];
+};
+
+/* Two claims collide when they are the same address, or one is inside the other. */
+export const overlaps = (a, b) => a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+
+/*
+  The collisions between extensions. "candidates" is what is about to be installed or switched on and
+  "others" what is on already, both as [{ name, kempo }]. Candidates are checked against each other as
+  well. Returns [{ name, claim, other, otherClaim }], one per colliding pair of claims. An extension
+  never collides with itself, so one that claims a scope and an alias in another of its own is fine.
+*/
+export const findClaimConflicts = (candidates, others) => {
+  const withClaims = list => list.map(({ name, kempo }) => ({ name, claims: claimsOf(kempo) }));
+  const mine = withClaims(candidates);
+  const theirs = withClaims(others);
+  const conflicts = [];
+
+  const compare = (left, right) => {
+    for(const claim of left.claims){
+      for(const otherClaim of right.claims){
+        if(overlaps(claim, otherClaim)) conflicts.push({ name: left.name, claim, other: right.name, otherClaim });
+      }
+    }
+  };
+
+  mine.forEach((left, index) => {
+    theirs.filter(right => right.name !== left.name).forEach(right => compare(left, right));
+    mine.slice(index + 1).forEach(right => compare(left, right));
+  });
+
+  return conflicts;
+};
+
+/* The sentence a person is shown, naming who holds the address and what to do about it. */
+export const describeConflict = ({ name, claim, other, otherClaim }, verb) => {
+  const what = claim === otherClaim ? otherClaim : `${otherClaim}, which overlaps ${claim}`;
+  return `Cannot ${verb} ${name}: ${other} already uses ${what}. Disable or uninstall ${other} first.`;
+};

package/server/utils/extensions/createTablesFromSchema.js

@@ -2,24 +2,18 @@ import { getTableConfig } from 'drizzle-orm/pg-core';
 import { sql } from 'drizzle-orm';
 import db from '../../db/index.js';
 
-const TYPE_MAP = {
-  PgText: 'text',
-  PgVarchar: 'varchar',
-  PgChar: 'char',
-  PgBoolean: 'boolean',
-  PgInteger: 'integer',
-  PgBigInt53: 'bigint',
-  PgSerial: 'serial',
-  PgSmallInt: 'smallint',
-  PgDoublePrecision: 'double precision',
-  PgReal: 'real',
-  PgNumeric: 'numeric',
-  PgTimestamp: 'timestamp',
-  PgDate: 'date',
-  PgTime: 'time',
-  PgJsonb: 'jsonb',
-  PgJson: 'json',
-  PgUUID: 'uuid',
+/*
+  A column's SQL type is whatever Drizzle says it is (`bigserial`, `varchar(255)`, `timestamp`, `text[]`), never a
+  guess. A hand-kept map of types once sent `bigserial` to `text` with no sequence, which made a table that could
+  not take an insert. An enum has a type of its own that does not exist here yet, so it is stored as text.
+*/
+const sqlTypeOf = column => {
+  if(column.columnType === 'PgEnumColumn') return 'text';
+  try {
+    return column.getSQLType();
+  } catch {
+    return 'text';
+  }
 };
 
 const serializeDefault = (value) => {
@@ -33,8 +27,7 @@ const tableToSql = (table) => {
   const config = getTableConfig(table);
   const primaryKeys = config.columns.filter(c => c.primary).map(c => c.name);
   const cols = config.columns.map(c => {
-    const type = TYPE_MAP[c.columnType] || 'text';
-    let def = `"${c.name}" ${type}`;
+    let def = `"${c.name}" ${sqlTypeOf(c)}`;
     if(c.notNull) def += ' NOT NULL';
     if(c.hasDefault && c.default !== undefined) def += ` DEFAULT ${serializeDefault(c.default)}`;
     if(c.primary && primaryKeys.length === 1) def += ' PRIMARY KEY';

package/server/utils/extensions/enableExtensionTree.js

@@ -3,6 +3,7 @@ import { extension } from '../../db/schema.js';
 import { eq, inArray } from 'drizzle-orm';
 import { invalidateScopeCache } from './scopeCache.js';
 import getRequirementTree from './getRequirementTree.js';
+import checkClaims from './checkClaims.js';
 
 /*
   Switches an extension on. It cannot run without what it requires, so any of that which is installed
@@ -40,6 +41,13 @@ export default async ({ name, cascade = false }) => {
     }
 
     const names = [name, ...disabled.map(requirement => requirement.name)];
+
+    /* Switching on what claims an address another enabled extension already has would silently break one of them. */
+    const [claimsError] = await checkClaims({ names, verb: 'enable' });
+    if(claimsError){
+      return [claimsError, null];
+    }
+
     await db.update(extension)
       .set({ enabled: true, updatedAt: new Date() })
       .where(inArray(extension.name, names));

package/server/utils/extensions/{getMarketplaceClient.js → getSiteMarketplaceClient.js}

@@ -1,5 +1,5 @@
 import getSetting from '../settings/getSetting.js';
-import { createCatalogClient, DEFAULT_CATALOG_URL } from './catalogClient.js';
+import { createCatalogClient, DEFAULT_CATALOG_URL } from './marketplaceClient.js';
 
 const clients = new Map();