kempo 4.6.2 → 4.7.0

package/server/utils/dashboard/helpers.js

@@ -24,6 +24,7 @@ export const normalizeWidget = ({
   title,
   description = null,
   icon = null,
+  iconSrc = null,
   element,
   module,
   defaultWidth = 2,
@@ -57,6 +58,10 @@ export const normalizeWidget = ({
     return [{ code: 400, msg: 'Icon must be an icon name' }, null];
   }
 
+  if(iconSrc !== null && !(isLocalPath(iconSrc) && iconSrc.length <= 200)){
+    return [{ code: 400, msg: 'iconSrc must be the path to an icon file on this site, beginning with a single "/"' }, null];
+  }
+
   if(typeof element !== 'string' || !ELEMENT_PATTERN.test(element)){
     return [{ code: 400, msg: 'Element must be a custom element tag name such as "my-ext-widget"' }, null];
   }
@@ -128,6 +133,7 @@ export const normalizeWidget = ({
     title: title.trim(),
     description,
     icon,
+    iconSrc,
     element,
     module,
     defaultWidth,

package/server/utils/email/renderEmailTemplate.js

@@ -0,0 +1,63 @@
+import { existsSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+import { renderPage, renderExternalPage } from 'kempo-server/templating';
+import shake from 'kempo-css/shake';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+/*
+  Renders an email template to HTML, without sending it.
+
+  A plain name ("verify-email") is looked up in the site's `templates/emails`, then in kempo's own.
+
+  A name with an owner ("my-extension/order-paid") is an extension's template. The site may override
+  it at `templates/emails/my-extension/order-paid.page.html`; otherwise it is the extension's own
+  `emails/order-paid.page.html`. Either way the layout (`<page template="email">`) is the site's
+  `templates/emails/email.template.html` when it has one, and kempo's otherwise, so every email a site
+  sends looks the same.
+
+  Returns [error, html].
+*/
+export default async ({ template, data = {} } = {}) => {
+  if(!template){
+    return [{ code: 400, msg: 'Template name is required' }, null];
+  }
+  if(!/^[a-z0-9][a-z0-9-]*(\/[a-z0-9][a-z0-9-]*)?$/.test(template)){
+    return [{ code: 400, msg: `Invalid email template name: ${template}` }, null];
+  }
+
+  const consumerDir = join(process.cwd(), 'templates/emails');
+  const moduleDir = join(__dirname, '../../../app-templates/emails');
+  const [owner, name] = template.includes('/') ? template.split('/') : [null, template];
+
+  let pagePath;
+  let rootDir;
+  if(owner){
+    const override = join(consumerDir, owner, `${name}.page.html`);
+    pagePath = existsSync(override) ? override : join(process.cwd(), 'node_modules', owner, 'emails', `${name}.page.html`);
+    rootDir = existsSync(join(consumerDir, 'email.template.html')) ? consumerDir : moduleDir;
+  } else {
+    rootDir = existsSync(join(consumerDir, `${name}.page.html`)) ? consumerDir : moduleDir;
+    pagePath = join(rootDir, `${name}.page.html`);
+  }
+
+  if(!existsSync(pagePath)){
+    return [{ code: 404, msg: `Email template not found: ${template}` }, null];
+  }
+
+  const themePath = join(process.cwd(), 'public/styles.css');
+  const themeOpts = existsSync(themePath) ? { theme: themePath } : {};
+
+  try {
+    let html = owner
+      ? await renderExternalPage(pagePath, rootDir, rootDir, {}, data)
+      : await renderPage(pagePath, rootDir, {}, data);
+    const css = shake(html, { ...themeOpts, colorMode: 'light' });
+    html = html.replace('</head>', `<style>${css}</style></head>`);
+    return [null, html];
+  } catch(error){
+    console.error('Email render error:', error);
+    return [{ code: 500, msg: 'Failed to render the email template' }, null];
+  }
+};

package/server/utils/email/sendEmailFromTemplate.js

@@ -1,13 +1,10 @@
-import { existsSync } from 'fs';
-import { fileURLToPath } from 'url';
-import { dirname, join } from 'path';
-import { renderPage } from 'kempo-server/templating';
-import shake from 'kempo-css/shake';
+import renderEmailTemplate from './renderEmailTemplate.js';
 import sendEmail from './sendEmail.js';
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
+/*
+  `template` is a plain name for kempo's and the site's templates, or "owner/name" for an extension's;
+  see renderEmailTemplate.js.
+*/
 export default async ({ to, subject, template, data = {} }) => {
   if(!to){
     return [{ code: 400, msg: 'Recipient email is required' }, null];
@@ -21,25 +18,10 @@ export default async ({ to, subject, template, data = {} }) => {
     return [{ code: 400, msg: 'Template name is required' }, null];
   }
 
-  const consumerDir = join(process.cwd(), 'templates/emails');
-  const moduleDir = join(__dirname, '../../../app-templates/emails');
-  const rootDir = existsSync(join(consumerDir, `${template}.page.html`)) ? consumerDir : moduleDir;
-  const pagePath = join(rootDir, `${template}.page.html`);
-
-  if(!existsSync(pagePath)){
-    return [{ code: 404, msg: `Email template not found: ${template}` }, null];
+  const [error, html] = await renderEmailTemplate({ template, data });
+  if(error){
+    return [error, null];
   }
 
-  const themePath = join(process.cwd(), 'public/styles.css');
-  const themeOpts = existsSync(themePath) ? { theme: themePath } : {};
-
-  try {
-    let html = await renderPage(pagePath, rootDir, {}, data);
-    const css = shake(html, { ...themeOpts, colorMode: 'light' });
-    html = html.replace('</head>', `<style>${css}</style></head>`);
-    return await sendEmail({ to, subject, html });
-  } catch(error){
-    console.error('Email render error:', error);
-    return [{ code: 500, msg: 'Failed to send email from template' }, null];
-  }
+  return await sendEmail({ to, subject, html });
 };

package/server/utils/extensions/aliases.js

@@ -0,0 +1,71 @@
+import { join } from 'path';
+import { stat } from 'fs/promises';
+import { scopeNames } from './scopes.js';
+
+/*
+  Aliases let an extension answer on a short, familiar address instead of only under its public scope:
+  an extension with the scope `commerce` can declare `"aliases": { "/cart": "/commerce/cart" }` and its
+  cart page is then reachable at /cart/ too. The address stays as typed (it is a rewrite, not a redirect).
+
+  An alias must point inside one of the extension's own scopes, so an extension can only ever give a
+  second address to its own pages. It never shadows a page the site has of its own at that address, and
+  it cannot take over anything under /admin or /api. The alias address is a claim, like a scope, and no
+  other enabled extension may claim it (see claims.js).
+*/
+
+const RESERVED = /^\/(admin|api|kempo|kempo-css|kempo-ui)(\/|$)/;
+
+const trim = value => String(value).replace(/\/+$/, '');
+
+/*
+  Checks the `aliases` an extension declares: { "/from": "/scope/to" }. `scope` is the extension's
+  scope, or the list of its scopes. Returns [error, aliases].
+*/
+export const normalizeAliases = (aliases, scope) => {
+  const scopes = [scope].flat().filter(Boolean);
+  if(aliases === undefined || aliases === null) return [null, {}];
+  if(typeof aliases !== 'object' || Array.isArray(aliases)) return [{ code: 400, msg: 'aliases must be an object of address to address' }, null];
+
+  const result = {};
+  for(const [from, to] of Object.entries(aliases)){
+    const source = trim(from);
+    const target = trim(to);
+    if(!source.startsWith('/') || source === '' || RESERVED.test(source)) return [{ code: 400, msg: `Alias "${from}" must be an address such as /cart, outside /admin and /api` }, null];
+    if(!scopes.some(name => target === `/${name}` || target.startsWith(`/${name}/`))) return [{ code: 400, msg: `Alias "${from}" must point inside the extension's own scope (/${scopes.join(', /') || '…'}/…)` }, null];
+    result[source] = target;
+  }
+  return [null, result];
+};
+
+/* True when the site itself has a page, directory or file at this address, which always wins over an alias. */
+const siteHasPath = async (publicDir, address) => {
+  const base = join(publicDir, ...address.split('/').filter(Boolean));
+  const candidates = [base, `${base}.page.html`, `${base}.html`, join(base, 'index.page.html'), join(base, 'index.html'), join(base, 'index.js'), join(base, 'GET.js')];
+  for(const candidate of candidates){
+    try {
+      const info = await stat(candidate);
+      if(candidate === base ? info.isFile() : true) return true;
+    } catch { /* not there */ }
+  }
+  return false;
+};
+
+/*
+  The address to serve for `url`: the alias target when an enabled extension declares one for it and
+  the site has no page there, otherwise `url` unchanged. `loaded` is [{ kempo }] for the enabled extensions.
+*/
+export const resolveAlias = async (url, loaded, publicDir) => {
+  const clean = trim(url) || '/';
+  for(const { kempo } of loaded){
+    const scopes = scopeNames(kempo);
+    if(!scopes.length || !kempo.aliases) continue;
+    const [error, aliases] = normalizeAliases(kempo.aliases, scopes);
+    if(error) continue;
+    for(const [from, to] of Object.entries(aliases)){
+      if(clean !== from && !clean.startsWith(`${from}/`)) continue;
+      if(await siteHasPath(publicDir, from)) return url;
+      return to + url.slice(from.length);
+    }
+  }
+  return url;
+};

package/server/utils/extensions/checkClaims.js

@@ -0,0 +1,32 @@
+import { join } from 'path';
+import readKempoConfig from './readKempoConfig.js';
+import { getEnabledExtensions } from './scopeCache.js';
+import { findClaimConflicts, describeConflict } from './claims.js';
+
+const configOf = async name => {
+  try {
+    return { name, kempo: (await readKempoConfig(join(process.cwd(), 'node_modules', name))).kempo };
+  } catch {
+    return null;
+  }
+};
+
+/*
+  Refuses to put an extension on the site when another one that is on already uses an address it
+  claims. "names" are the extensions about to be switched on (installed, or enabled together with what
+  they require) and "verb" is what is being done ("install", "enable" or "update"). Returns [error] with
+  a 409 and the whole list as "conflicts", or [null].
+
+  An extension whose package cannot be read is skipped, as it cannot be routed to anyway. "kempo" gives
+  the config of a name to check instead of reading it, for one that has just changed.
+*/
+export default async ({ names, verb, kempo = {} }) => {
+  const candidates = (await Promise.all(names.map(async name => kempo[name] ? { name, kempo: kempo[name] } : configOf(name)))).filter(Boolean);
+  const enabled = (await getEnabledExtensions()).map(row => row.name).filter(name => !names.includes(name));
+  const others = (await Promise.all(enabled.map(configOf))).filter(Boolean);
+
+  const conflicts = findClaimConflicts(candidates, others);
+  if(!conflicts.length) return [null];
+
+  return [{ code: 409, msg: describeConflict(conflicts[0], verb), conflicts }];
+};

package/server/utils/extensions/claims.js

@@ -0,0 +1,54 @@
+import { scopeNames } from './scopes.js';
+import { normalizeAliases } from './aliases.js';
+
+/*
+  An address an extension answers on is a *claim*, and the router can give an address to only one
+  extension. Whichever one it reaches first gets every request for it, and the other's pages, scripts
+  and API routes under it answer 404 without any error, so two extensions may not claim the same
+  address or one inside the other.
+
+  Every claim is a path: each of the extension's scopes (/products) and each of its alias addresses
+  (/cart). An alias that is invalid is left out here, since it is refused on its own.
+*/
+export const claimsOf = kempo => {
+  const names = scopeNames(kempo);
+  const [, aliases] = normalizeAliases(kempo?.aliases, names);
+  return [...names.map(scope => `/${scope}`), ...Object.keys(aliases ?? {})];
+};
+
+/* Two claims collide when they are the same address, or one is inside the other. */
+export const overlaps = (a, b) => a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+
+/*
+  The collisions between extensions. "candidates" is what is about to be installed or switched on and
+  "others" what is on already, both as [{ name, kempo }]. Candidates are checked against each other as
+  well. Returns [{ name, claim, other, otherClaim }], one per colliding pair of claims. An extension
+  never collides with itself, so one that claims a scope and an alias in another of its own is fine.
+*/
+export const findClaimConflicts = (candidates, others) => {
+  const withClaims = list => list.map(({ name, kempo }) => ({ name, claims: claimsOf(kempo) }));
+  const mine = withClaims(candidates);
+  const theirs = withClaims(others);
+  const conflicts = [];
+
+  const compare = (left, right) => {
+    for(const claim of left.claims){
+      for(const otherClaim of right.claims){
+        if(overlaps(claim, otherClaim)) conflicts.push({ name: left.name, claim, other: right.name, otherClaim });
+      }
+    }
+  };
+
+  mine.forEach((left, index) => {
+    theirs.filter(right => right.name !== left.name).forEach(right => compare(left, right));
+    mine.slice(index + 1).forEach(right => compare(left, right));
+  });
+
+  return conflicts;
+};
+
+/* The sentence a person is shown, naming who holds the address and what to do about it. */
+export const describeConflict = ({ name, claim, other, otherClaim }, verb) => {
+  const what = claim === otherClaim ? otherClaim : `${otherClaim}, which overlaps ${claim}`;
+  return `Cannot ${verb} ${name}: ${other} already uses ${what}. Disable or uninstall ${other} first.`;
+};

package/server/utils/extensions/createTablesFromSchema.js

@@ -2,24 +2,18 @@ import { getTableConfig } from 'drizzle-orm/pg-core';
 import { sql } from 'drizzle-orm';
 import db from '../../db/index.js';
 
-const TYPE_MAP = {
-  PgText: 'text',
-  PgVarchar: 'varchar',
-  PgChar: 'char',
-  PgBoolean: 'boolean',
-  PgInteger: 'integer',
-  PgBigInt53: 'bigint',
-  PgSerial: 'serial',
-  PgSmallInt: 'smallint',
-  PgDoublePrecision: 'double precision',
-  PgReal: 'real',
-  PgNumeric: 'numeric',
-  PgTimestamp: 'timestamp',
-  PgDate: 'date',
-  PgTime: 'time',
-  PgJsonb: 'jsonb',
-  PgJson: 'json',
-  PgUUID: 'uuid',
+/*
+  A column's SQL type is whatever Drizzle says it is (`bigserial`, `varchar(255)`, `timestamp`, `text[]`), never a
+  guess. A hand-kept map of types once sent `bigserial` to `text` with no sequence, which made a table that could
+  not take an insert. An enum has a type of its own that does not exist here yet, so it is stored as text.
+*/
+const sqlTypeOf = column => {
+  if(column.columnType === 'PgEnumColumn') return 'text';
+  try {
+    return column.getSQLType();
+  } catch {
+    return 'text';
+  }
 };
 
 const serializeDefault = (value) => {
@@ -33,8 +27,7 @@ const tableToSql = (table) => {
   const config = getTableConfig(table);
   const primaryKeys = config.columns.filter(c => c.primary).map(c => c.name);
   const cols = config.columns.map(c => {
-    const type = TYPE_MAP[c.columnType] || 'text';
-    let def = `"${c.name}" ${type}`;
+    let def = `"${c.name}" ${sqlTypeOf(c)}`;
     if(c.notNull) def += ' NOT NULL';
     if(c.hasDefault && c.default !== undefined) def += ` DEFAULT ${serializeDefault(c.default)}`;
     if(c.primary && primaryKeys.length === 1) def += ' PRIMARY KEY';

package/server/utils/extensions/enableExtensionTree.js

@@ -3,6 +3,7 @@ import { extension } from '../../db/schema.js';
 import { eq, inArray } from 'drizzle-orm';
 import { invalidateScopeCache } from './scopeCache.js';
 import getRequirementTree from './getRequirementTree.js';
+import checkClaims from './checkClaims.js';
 
 /*
   Switches an extension on. It cannot run without what it requires, so any of that which is installed
@@ -40,6 +41,13 @@ export default async ({ name, cascade = false }) => {
     }
 
     const names = [name, ...disabled.map(requirement => requirement.name)];
+
+    /* Switching on what claims an address another enabled extension already has would silently break one of them. */
+    const [claimsError] = await checkClaims({ names, verb: 'enable' });
+    if(claimsError){
+      return [claimsError, null];
+    }
+
     await db.update(extension)
       .set({ enabled: true, updatedAt: new Date() })
       .where(inArray(extension.name, names));

package/server/utils/extensions/installExtension.js

@@ -14,6 +14,11 @@ import createTablesFromSchema from './createTablesFromSchema.js';
 import readKempoConfig from './readKempoConfig.js';
 import { invalidateScopeCache } from './scopeCache.js';
 import { getUnmetDependencies } from './dependencies.js';
+import registerJobs from '../scheduler/registerJobs.js';
+import { normalizeJobs } from '../scheduler/helpers.js';
+import { normalizeAliases } from './aliases.js';
+import { normalizeScopes, scopeNames } from './scopes.js';
+import checkClaims from './checkClaims.js';
 
 export default async ({ name }) => {
   if(!name){
@@ -48,6 +53,22 @@ export default async ({ name }) => {
     return [{ code: 409, msg: `Requires ${unmet.join(', ')} to be installed and enabled first` }, null];
   }
 
+  const [jobsError] = normalizeJobs(kempoConfig.jobs);
+  if(jobsError) return [jobsError, null];
+
+  const [scopesError] = normalizeScopes(kempoConfig);
+  if(scopesError) return [scopesError, null];
+
+  const [aliasesError] = normalizeAliases(kempoConfig.aliases, scopeNames(kempoConfig));
+  if(aliasesError) return [aliasesError, null];
+
+  /*
+    An address can belong to one extension only. Installing a second one that claims it would leave
+    it with no public pages and no error, so it is refused here and the first has to be disabled.
+  */
+  const [claimsError] = await checkClaims({ names: [name], verb: 'install', kempo: { [name]: kempoConfig } });
+  if(claimsError) return [claimsError, null];
+
   /*
     Create tables from declarative schema
   */
@@ -131,6 +152,17 @@ export default async ({ name }) => {
     }
   }
 
+  /*
+    Register declarative scheduled jobs. Like a widget, a job that cannot be registered (a site that has
+    not applied the scheduledJob table yet) is reported and skipped rather than failing the install.
+  */
+  if((kempoConfig.jobs || []).length){
+    const [registerError] = await registerJobs({ owner: name, jobs: kempoConfig.jobs });
+    if(registerError){
+      console.warn(`[${name}] scheduled jobs were not registered: ${registerError.msg}`);
+    }
+  }
+
   const now = new Date();
   const entry = {
     name,

package/server/utils/extensions/readKempoConfig.js

@@ -2,8 +2,8 @@ import { join } from 'path';
 import { readFile } from 'fs/promises';
 
 /*
-  What an installed extension declares to kempo: its `public-scope`, `docs`, `git`, `schema`, `hooks`,
-  `permissions`, `settings`, `groups`, `dependencies` and `widgets`.
+  What an installed extension declares to kempo: its `public-scope` and `public-scopes`, `docs`, `git`, `schema`, `hooks`,
+  `permissions`, `settings`, `groups`, `dependencies`, `widgets`, `jobs` and `aliases`.
 
   It lives in the extension's kempo-config.json, which is the one place it is written. package.json's own
   `kempo` field is still read, as the fallback for an older extension that put everything there, and

package/server/utils/extensions/scopeCache.js

@@ -3,7 +3,20 @@ import { extension } from '../../db/schema.js';
 
 let cache = null;
 
-export const invalidateScopeCache = () => { cache = null; };
+const listeners = new Set();
+
+/*
+  For what has to follow the set of enabled extensions, such as menus holding an extension's items.
+  Called after every install, enable, disable and uninstall; a listener's failure never reaches them.
+*/
+export const onExtensionsChanged = listener => listeners.add(listener);
+
+export const invalidateScopeCache = () => {
+  cache = null;
+  for(const listener of listeners){
+    Promise.resolve().then(listener).catch(error => console.error('[kempo] An extension change listener failed:', error.message));
+  }
+};
 
 /* One read of the extension table serves both questions, until an install/enable/disable/uninstall. */
 const load = async () => {

package/server/utils/extensions/scopes.js

@@ -0,0 +1,72 @@
+/*
+  The addresses an extension answers on, read from its kempo-config.json.
+
+  An extension serves a folder of its package at an address under its scope: with the scope `products`,
+  `public/index.page.html` is `/products/` and `public/api/products/GET.js` is `/products/api/products`.
+  It can claim more than one scope, each serving its own folder:
+
+    "public-scope": "products",                              // shorthand for "products": "public"
+    "public-scopes": { "categories": "public-categories" }   // /categories/ serves public-categories/
+
+  `aliases` give pages under a scope a second, shorter address (see aliases.js). Every scope and every
+  alias address is a *claim*: no two enabled extensions may claim the same address, or one inside the
+  other, because the router can only give an address to one of them (see claims.js).
+*/
+
+const NAME = /^[a-z0-9][a-z0-9_-]*$/;
+
+/* What kempo itself serves at the top level of the site. */
+export const RESERVED_SCOPES = ['admin', 'api', 'kempo', 'kempo-css', 'kempo-ui', 'monaco-editor'];
+
+const cleanDir = dir => String(dir).replace(/\\/g, '/').replace(/^(\.\/)+/, '').replace(/\/+$/, '');
+
+const badDir = dir => !dir || dir.startsWith('/') || /^[a-z]:/i.test(dir) || dir.split('/').some(part => part === '..' || part === '');
+
+/*
+  The scopes an extension declares, each with the folder of its package it serves: [error, [{ scope, dir }]].
+  An extension with no scope gets an empty list. A bad name, a reserved one, a folder that leaves the
+  package, or the same scope pointed at two folders is an error.
+*/
+export const normalizeScopes = kempo => {
+  const found = new Map();
+
+  const add = (scope, folder) => {
+    if(typeof scope !== 'string' || !NAME.test(scope)){
+      return { code: 400, msg: `Scope "${scope}" must be lowercase letters, numbers, dashes or underscores, such as "products"` };
+    }
+    if(RESERVED_SCOPES.includes(scope)){
+      return { code: 400, msg: `Scope "${scope}" is used by kempo itself` };
+    }
+    const dir = cleanDir(folder);
+    if(typeof folder !== 'string' || badDir(dir)){
+      return { code: 400, msg: `The folder for scope "${scope}" must be a folder inside the package, such as "public"` };
+    }
+    if(found.has(scope) && found.get(scope) !== dir){
+      return { code: 400, msg: `Scope "${scope}" is given two different folders` };
+    }
+    found.set(scope, dir);
+    return null;
+  };
+
+  const single = kempo?.['public-scope'];
+  if(single !== undefined && single !== null && single !== ''){
+    const error = add(single, 'public');
+    if(error) return [error, null];
+  }
+
+  const several = kempo?.['public-scopes'];
+  if(several !== undefined && several !== null){
+    if(typeof several !== 'object' || Array.isArray(several)){
+      return [{ code: 400, msg: 'public-scopes must be an object of scope to folder' }, null];
+    }
+    for(const [scope, folder] of Object.entries(several)){
+      const error = add(scope, folder);
+      if(error) return [error, null];
+    }
+  }
+
+  return [null, [...found].map(([scope, dir]) => ({ scope, dir }))];
+};
+
+/* Just the scope names, for what only needs to know them (an alias must point inside one). */
+export const scopeNames = kempo => (normalizeScopes(kempo)[1] ?? []).map(({ scope }) => scope);

package/server/utils/extensions/uninstallExtensionTree.js

@@ -1,5 +1,5 @@
 import db from '../../db/index.js';
-import { extension, hook, permission, setting, group, groupPermission, userGroup, dashboardWidget } from '../../db/schema.js';
+import { extension, hook, permission, setting, group, groupPermission, userGroup, dashboardWidget, scheduledJob } from '../../db/schema.js';
 import { eq, inArray, like } from 'drizzle-orm';
 import { join } from 'path';
 import { pathToFileURL } from 'url';
@@ -105,6 +105,7 @@ const uninstallOne = async ({ name, purgeData = false }) => {
   try {
     await db.delete(hook).where(eq(hook.owner, name));
     await db.delete(dashboardWidget).where(eq(dashboardWidget.owner, name));
+    await db.delete(scheduledJob).where(eq(scheduledJob.owner, name)).catch(() => {});
     await db.delete(extension).where(eq(extension.name, name));
   } catch(error) {
     return [{ code: 500, msg: 'Failed to remove extension' }, null];

package/server/utils/extensions/updateExtension.js

@@ -9,10 +9,14 @@ import triggerHook, { clearHandlerCache } from '../hooks/triggerHook.js';
 import createHook from '../hooks/createHook.js';
 import registerDashboardWidget from '../dashboard/registerDashboardWidget.js';
 import unregisterDashboardWidget from '../dashboard/unregisterDashboardWidget.js';
+import registerJobs from '../scheduler/registerJobs.js';
 import setSetting from '../settings/setSetting.js';
 import declaredValue from '../settings/declaredValue.js';
 import createTablesFromSchema from './createTablesFromSchema.js';
 import readKempoConfig from './readKempoConfig.js';
+import { normalizeAliases } from './aliases.js';
+import { normalizeScopes, scopeNames } from './scopes.js';
+import checkClaims from './checkClaims.js';
 
 const requireFromProject = createRequire(join(process.cwd(), 'package.json'));
 
@@ -56,6 +60,27 @@ export default async ({ name, version = 'latest' }) => {
     return [{ code: 404, msg: `Updated package "${name}" not found` }, null];
   }
 
+  /*
+    The new version may claim addresses the old one did not. If it is on and another extension has one
+    of them, put the old version back before anything else changes: leaving the new one would break
+    one of the two, silently.
+  */
+  const [scopesError] = normalizeScopes(newKempo);
+  const [aliasesError] = scopesError ? [null] : normalizeAliases(newKempo.aliases, scopeNames(newKempo));
+  const [claimsError] = scopesError || aliasesError || !oldRecord.enabled
+    ? [null]
+    : await checkClaims({ names: [name], verb: 'update', kempo: { [name]: newKempo } });
+  const refusal = scopesError || aliasesError || claimsError;
+  if(refusal){
+    let msg = refusal.msg;
+    try {
+      if(oldVersion) execSync(`npm install ${name}@${oldVersion}`, { cwd: process.cwd(), stdio: 'pipe' });
+    } catch {
+      msg += ` The previous version could not be put back automatically: run npm install ${name}@${oldVersion}.`;
+    }
+    return [{ ...refusal, msg }, null];
+  }
+
   /*
     Create any new tables from schema
   */
@@ -161,6 +186,16 @@ export default async ({ name, version = 'latest' }) => {
     }
   }
 
+  /*
+    Sync scheduled jobs: the schedule becomes exactly what is declared now
+  */
+  if((newKempo.jobs || []).length || (oldKempo.jobs || []).length){
+    const [jobsError] = await registerJobs({ owner: name, jobs: newKempo.jobs || [] });
+    if(jobsError){
+      console.warn(`[${name}] scheduled jobs were not registered: ${jobsError.msg}`);
+    }
+  }
+
   const now = new Date();
   try {
     await db.update(extension).set({

package/server/utils/global-content/createGlobalContent.js

@@ -2,25 +2,10 @@ import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
 import crypto from 'crypto';
-import { GLOBAL_FILE, parseEntries } from './helpers.js';
+import { GLOBAL_FILE, parseEntries, serializeEntries } from './helpers.js';
 import triggerHook from '../hooks/triggerHook.js';
 
-const serializeEntries = entries => entries.map(e => {
-  const attrs = [
-    `id="${e.id}"`,
-    `name="${e.name}"`,
-    `owner="${e.owner}"`,
-    `author="${e.author}"`,
-    `created="${e.createdAt}"`,
-    `updated="${e.updatedAt}"`,
-    `locked="${e.locked}"`,
-    `location="${e.location}"`,
-    `priority="${e.priority}"`
-  ].join(' ');
-  return `<content ${attrs}>\n${e.markup}\n</content>`;
-}).join('\n');
-
-export default async ({ rootDir, name, location, priority, author, owner = 'custom' }) => {
+export default async ({ rootDir, name, location, priority, author, owner = 'custom', markup = '' }) => {
   if(!rootDir){
     return [{ code: 400, msg: 'Root directory is required' }, null];
   }
@@ -45,11 +30,16 @@ export default async ({ rootDir, name, location, priority, author, owner = 'cust
     owner,
     author: author || '',
     locked: false,
+    menu: '',
+    menuLocations: null,
+    menuCopyOf: '',
+    navItem: '',
+    extra: {},
     location,
     priority: parseInt(priority || '0', 10),
     createdAt: now,
     updatedAt: now,
-    markup: ''
+    markup
   };
 
   entries.push(entry);