npm - openlearn-next - Versions diffs - 0.2.5 → 0.2.7 - Mend

openlearn-next 0.2.5 → 0.2.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

package/dist/index.html CHANGED Viewed

@@ -15,7 +15,7 @@
       }
     }
     </script>
-    <script type="module" crossorigin src="/assets/index-BxA9vp--.js"></script>
+    <script type="module" crossorigin src="/assets/index-eXp-qZdm.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-CATki2cp.css">
   </head>
   <body>

package/dist/server.cjs CHANGED Viewed

@@ -2659,6 +2659,21 @@ parentPort.on('message', async function(msg) {
         },
         db: dbApi,
         require: function(moduleName) {
+          var BLOCKED_NATIVE_MODULES = [
+            'child_process', 'node:child_process',
+            'fs', 'node:fs', 'fs/promises', 'node:fs/promises',
+            'net', 'node:net',
+            'http', 'node:http', 'https', 'node:https', 'http2', 'node:http2',
+            'dgram', 'node:dgram', 'dns', 'node:dns',
+            'cluster', 'node:cluster',
+            'worker_threads', 'node:worker_threads',
+            'vm', 'node:vm',
+            'v8', 'node:v8',
+            'wasi', 'node:wasi'
+          ];
+          if (BLOCKED_NATIVE_MODULES.indexOf(moduleName) !== -1) {
+            throw new Error('[SecurityError] Direct access to Node.js native module "' + moduleName + '" is forbidden in plugin worker sandbox.');
+          }
           if (PLUGIN_SHARED_MODULES.indexOf(moduleName) !== -1) {
             try {
               return requireFn(moduleName);
@@ -3374,7 +3389,16 @@ var CapabilityGuard = class {
   constructor() {
     this.actorCapabilities = /* @__PURE__ */ new Map();
     this.actorCapabilities.set("user-demo", ["*:*:*"]);
-    this.actorCapabilities.set("user-frontend", ["*:*:*"]);
+    this.actorCapabilities.set("user-frontend", [
+      "lesson:*",
+      "whiteboard:*",
+      "management:*",
+      "quiz:*",
+      "vfs:*",
+      "process:*",
+      "plugin:*"
+    ]);
+    this.actorCapabilities.set("anonymous", []);
     this.actorCapabilities.set("agent-system-0", [
       "lesson:write",
       "lesson:delete",
@@ -3388,8 +3412,8 @@ var CapabilityGuard = class {
       "process:write",
       "process:read"
     ]);
-    this.actorCapabilities.set("teacher-demo", ["lesson:write", "lesson:read"]);
-    this.actorCapabilities.set("student-demo", ["student:write"]);
+    this.actorCapabilities.set("teacher-demo", ["lesson:*", "whiteboard:*", "management:*", "quiz:*", "vfs:*"]);
+    this.actorCapabilities.set("student-demo", ["student:write", "lesson:read", "whiteboard:read"]);
   }
   grant(actorId, cap) {
     const caps = this.actorCapabilities.get(actorId) || [];
@@ -3402,8 +3426,28 @@ var CapabilityGuard = class {
     this.actorCapabilities.delete(actorId);
   }
   check(actorId, requiredCap) {
-    const isAdmin = actorId === "role:administrator" || actorId?.endsWith(":administrator") || actorId === "admin-demo";
+    const isAdmin = actorId === "role:administrator" || actorId?.endsWith(":administrator") || actorId === "admin" || actorId === "usr_admin" || actorId === "admin-demo";
     if (isAdmin) return true;
+    if (actorId?.endsWith(":teacher")) {
+      const teacherCaps = ["lesson:*", "whiteboard:*", "management:*", "quiz:*", "vfs:*", "process:*", "plugin:*"];
+      const [reqRes2, reqAct2] = requiredCap.split(":");
+      if (teacherCaps.some((c) => {
+        const [res, act] = c.split(":");
+        return (res === reqRes2 || res === "*") && (act === reqAct2 || act === "*");
+      })) {
+        return true;
+      }
+    }
+    if (actorId?.endsWith(":student")) {
+      const studentCaps = ["student:write", "lesson:read", "whiteboard:read"];
+      const [reqRes2, reqAct2] = requiredCap.split(":");
+      if (studentCaps.some((c) => {
+        const [res, act] = c.split(":");
+        return (res === reqRes2 || res === "*") && (act === reqAct2 || act === "*");
+      })) {
+        return true;
+      }
+    }
     const caps = this.actorCapabilities.get(actorId) || [];
     if (caps.includes("*:*:*") || caps.includes("*")) return true;
     if (caps.includes(requiredCap)) return true;
@@ -3638,7 +3682,7 @@ var classroomToolSchema = import_zod.z.object({
   icon: import_zod.z.string().optional(),
   description: import_zod.z.string().optional(),
   commandType: import_zod.z.string().min(1),
-  payload: import_zod.z.record(import_zod.z.unknown()).optional()
+  payload: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
 });
 var contributesSchema = import_zod.z.object({
   "classroom.tool": import_zod.z.array(classroomToolSchema).optional(),
@@ -3665,7 +3709,10 @@ var contributesSchema = import_zod.z.object({
     label: import_zod.z.string().min(1),
     icon: import_zod.z.string().optional()
   })).optional()
-}).optional();
+  // v0.2.6: 锚点槽位（anchor:*）为开放命名空间，由宿主公布锚点 id。
+  // .passthrough() 保留任意 anchor:* 键（运行时透传），避免被 zod 默认 strip。
+  // 锚点条目的运行时校验由前端注册时（ExtensionPointConfig）完成。
+}).passthrough().optional();
 var deploySchema = import_zod.z.object({
   script: import_zod.z.string().min(1, { error: "deploy.script \u4E0D\u80FD\u4E3A\u7A7A" }).optional(),
   staticRoute: import_zod.z.string().optional(),
@@ -3689,7 +3736,7 @@ var manifestSchema = import_zod.z.object({
   pluginDependencies: import_zod.z.array(import_zod.z.string().min(1)).optional(),
   provides: import_zod.z.array(import_zod.z.string().min(1)).optional(),
   configuration: import_zod.z.object({
-    properties: import_zod.z.record(import_zod.z.object({
+    properties: import_zod.z.record(import_zod.z.string(), import_zod.z.object({
       type: import_zod.z.enum(["string", "number", "boolean", "integer"]),
       default: import_zod.z.unknown().optional(),
       description: import_zod.z.string().optional(),
@@ -3774,6 +3821,7 @@ if (process.env.OPENLEARN_DB_PATH) {
 var db = new import_better_sqlite3.default(dbPath);
 db.pragma("journal_mode = WAL");
 db.pragma("synchronous = NORMAL");
+db.pragma("foreign_keys = ON");
 db.exec(`
   CREATE TABLE IF NOT EXISTS events (
     id TEXT PRIMARY KEY,
@@ -4116,6 +4164,17 @@ db.exec(`
     status TEXT NOT NULL DEFAULT 'draft',
     graded_at INTEGER
   );
+  -- Performance Indexes
+  CREATE INDEX IF NOT EXISTS idx_whiteboard_lesson ON whiteboard_elements(lesson_id);
+  CREATE INDEX IF NOT EXISTS idx_class_students_class ON class_students(class_id);
+  CREATE INDEX IF NOT EXISTS idx_class_students_student ON class_students(student_id);
+  CREATE INDEX IF NOT EXISTS idx_schedules_class_date ON schedules(class_id, scheduled_date);
+  CREATE INDEX IF NOT EXISTS idx_courseware_attempt_cw_st ON courseware_attempt(courseware_id, student_id);
+  CREATE INDEX IF NOT EXISTS idx_submission_result_attempt ON submission_result(attempt_id);
+  CREATE INDEX IF NOT EXISTS idx_events_type_time ON events(type, timestamp);
+  CREATE INDEX IF NOT EXISTS idx_assignments_class ON assignments(class_id);
+  CREATE INDEX IF NOT EXISTS idx_attendance_schedule ON attendance(schedule_id);
 `);
 try {
   db.exec(`ALTER TABLE plugins ADD COLUMN execution_mode TEXT DEFAULT 'inline'`);
@@ -4250,7 +4309,7 @@ var VfsPlugin = {
       "@openlearn/core:IDatabase@^1.0.0"
     ],
     capabilitiesProposed: ["vfs:read", "vfs:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -4416,7 +4475,7 @@ var ProcessPlugin = {
       "@openlearn/core:IDatabase@^1.0.0"
     ],
     capabilitiesProposed: ["process:read", "process:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -4547,7 +4606,7 @@ var ManagementPlugin = {
       "@openlearn/core:IDatabase@^1.0.0"
     ],
     capabilitiesProposed: ["class:read", "class:write", "student:read", "student:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -5446,7 +5505,7 @@ var AiSubmitInjectorPlugin = {
       "@openlearn/core:IAIService@^1.0.0"
     ],
     capabilitiesProposed: [],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const eventBus = ctx.services.eventBus;
@@ -5538,7 +5597,7 @@ var BuiltinPlugin = {
       "@openlearn/core:IPluginHost@^1.0.0"
     ],
     capabilitiesProposed: ["lesson:read", "lesson:write", "whiteboard:read", "whiteboard:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -6923,7 +6982,7 @@ var AiPlannerPlugin = {
       "@openlearn/core:IEventBusService@^1.0.0"
     ],
     capabilitiesProposed: ["process:write", "lesson:write", "assignment:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -7109,7 +7168,7 @@ var AssignmentEvalPlugin = {
       "@openlearn/core:ISemesterGradeService@^1.0.0"
     ],
     capabilitiesProposed: ["lesson:read", "lesson:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -7695,7 +7754,7 @@ var ContributionRegistry = class {
   register(pluginId, contributes) {
     this.unregister(pluginId);
     for (const [slot, configs] of Object.entries(contributes)) {
-      if (!configs || configs.length === 0) continue;
+      if (!Array.isArray(configs) || configs.length === 0) continue;
       if (!this.contributions.has(slot)) {
         this.contributions.set(slot, /* @__PURE__ */ new Map());
       }
@@ -8057,7 +8116,7 @@ var PluginRuntimeComposition = class {
     this.workerManager = workerManager;
     this.id = "srv_plugin_runtime_composition";
     this.name = "PluginRuntimeComposition";
-    this.version = "0.2.3";
+    this.version = "0.2.5";
     this._isStarted = false;
   }
   get isStarted() {
@@ -8111,7 +8170,7 @@ var PluginLifecycleManager = class {
     this.pluginHost = pluginHost;
     this.id = "srv_plugin_lifecycle_manager";
     this.name = "PluginLifecycleManager";
-    this.version = "0.2.3";
+    this.version = "0.2.5";
   }
   getPluginState(pluginId) {
     return this.pluginHost.getPluginState(pluginId);
@@ -8158,7 +8217,7 @@ var PluginCapabilityGateway = class {
     this.capabilityRegistry = capabilityRegistry;
     this.id = "srv_plugin_capability_gateway";
     this.name = "PluginCapabilityGateway";
-    this.version = "0.2.3";
+    this.version = "0.2.5";
   }
   listCapabilities() {
     const rawCaps = this.capabilityRegistry.listCapabilities();
@@ -8212,7 +8271,7 @@ var UnifiedExtensionRegistry = class {
   constructor() {
     this.id = "srv_unified_extension_registry";
     this.name = "UnifiedExtensionRegistry";
-    this.version = "0.2.3";
+    this.version = "0.2.5";
     this._extensions = /* @__PURE__ */ new Map();
   }
   registerExtension(category, id, impl, meta) {
@@ -8317,7 +8376,7 @@ var PluginDistributionManager = class {
     this.pluginHost = pluginHost;
     this.id = "srv_plugin_distribution_manager";
     this.name = "PluginDistributionManager";
-    this.version = "0.2.3";
+    this.version = "0.2.5";
     this._repositories = /* @__PURE__ */ new Map();
   }
   registerRepository(repo) {
@@ -8406,7 +8465,7 @@ function validatePluginStateTransition(currentState, nextState, pluginId) {
 }
 var ACTIVATION_TIMEOUT_MS = 5e3;
 var DEACTIVATION_TIMEOUT_MS = 5e3;
-var OPENLEARN_VERSION = "0.2.3";
+var OPENLEARN_VERSION = "0.2.5";
 var PluginHost = class {
   constructor(serviceRegistry, esmLoader, db2, pluginsDir) {
     this.serviceRegistry = serviceRegistry;
@@ -10431,7 +10490,7 @@ var HotReloadController = class {
     }
     if (this.enabled) return;
     this.enabled = true;
-    await this.fileWatcher.startWatch(this.watchDir, (event) => {
+    await this.fileWatcher.startWatch(this.watchDir, async (event) => {
       this.handleFileChange(event.pluginId, event.filePath);
     });
     console.log("[HotReload] Hot reload enabled \u2014 watching for plugin changes");
@@ -16020,7 +16079,7 @@ var StartupTimeoutError = class extends PlatformBootstrapError {
     this.name = "StartupTimeoutError";
   }
 };
-var PLATFORM_VERSION = "0.2.3";
+var PLATFORM_VERSION = "0.2.5";
 var BOOTSTRAP_STAGE_NAMES = Object.freeze([
   "Created" /* Created */,
   "Configuring" /* Configuring */,
@@ -16722,10 +16781,10 @@ var PluginCompositionModule = class {
     const realPluginHost = options?.infrastructureRefs?.get("pluginHost") ?? { name: "PluginHostService", isReady: true, pluginsCount: 0 };
     const realContributionRegistry = options?.infrastructureRefs?.get("contributionRegistry") ?? { name: "ContributionRegistry", slotsCount: 0 };
     const realRuntimeComposition = options?.infrastructureRefs?.get("runtimeComposition") ?? { name: "PluginRuntimeComposition", isStarted: true };
-    const realLifecycleManager = options?.infrastructureRefs?.get("lifecycleManager") ?? { name: "PluginLifecycleManager", version: "2.5.0" };
-    const realCapabilityGateway = options?.infrastructureRefs?.get("capabilityGateway") ?? { name: "PluginCapabilityGateway", version: "2.5.0" };
-    const realExtensionRegistry = options?.infrastructureRefs?.get("extensionRegistry") ?? { name: "UnifiedExtensionRegistry", version: "2.5.0" };
-    const realDistributionManager = options?.infrastructureRefs?.get("distributionManager") ?? { name: "PluginDistributionManager", version: "2.5.0" };
+    const realLifecycleManager = options?.infrastructureRefs?.get("lifecycleManager") ?? { name: "PluginLifecycleManager", version: "0.2.5" };
+    const realCapabilityGateway = options?.infrastructureRefs?.get("capabilityGateway") ?? { name: "PluginCapabilityGateway", version: "0.2.5" };
+    const realExtensionRegistry = options?.infrastructureRefs?.get("extensionRegistry") ?? { name: "UnifiedExtensionRegistry", version: "0.2.5" };
+    const realDistributionManager = options?.infrastructureRefs?.get("distributionManager") ?? { name: "PluginDistributionManager", version: "0.2.5" };
     registerOrReplace({
       id: "srv_plugin_host",
       lifetime: "Singleton",
@@ -16893,7 +16952,7 @@ var Kernel = class {
             throw new Error(`[PayloadValidationError] Invalid command payload for ${command.type}: ${errors.join("; ")}`);
           }
         }
-        const isAdmin = command.actorId === "role:administrator" || command.actorId === "admin" || command.actorId === "usr_admin" || command.actorId === "admin-demo" || command.actorId?.endsWith(":administrator") || command.actorId?.endsWith(":admin") || command.actorId?.includes(":administrator") || command.actorId?.includes(":admin");
+        const isAdmin = command.actorId === "role:administrator" || command.actorId === "admin" || command.actorId === "usr_admin" || command.actorId === "admin-demo" || command.actorId?.endsWith(":administrator") || command.actorId?.endsWith(":admin");
         if (action.capabilityRequired && !isAdmin) {
           const allowed = this.capabilityGuard.check(command.actorId, action.capabilityRequired);
           if (!allowed) {
@@ -18367,10 +18426,10 @@ function getCookieToken(req) {
 }
 function getActorId(req) {
   const token = getCookieToken(req);
-  if (!token) return "user-frontend";
+  if (!token) return "anonymous";
   try {
     const session = getValidSession(token);
-    if (!session) return "user-frontend";
+    if (!session) return "anonymous";
     let role = session.subRole || session.role;
     if (session.username === "admin" || session.userId === "usr_admin" || role === "admin" || role === "administrator") {
       role = "administrator";
@@ -18378,9 +18437,9 @@ function getActorId(req) {
     if (role) {
       return `user:${session.userId || "demo"}:${role}`;
     }
-    return "user-frontend";
+    return "anonymous";
   } catch {
-    return "user-frontend";
+    return "anonymous";
   }
 }
 function requireAuth(...roles) {
@@ -19163,7 +19222,7 @@ function registerOsRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/commands", async (req, res) => {
+  app.post("/api/commands", requireAuth(), async (req, res) => {
     try {
       const { commandType, payload } = req.body;
       const cmd = kernelContainer.commandBus.createCommand(
@@ -23078,7 +23137,7 @@ function registerGradingRoutes(ctx) {
       if (!lessonId || !studentId || grade === void 0) {
         return res.status(400).json({ success: false, error: "lessonId, studentId, and grade are required" });
       }
-      const gradeService = await kernelContainer.registry.resolve(ISemesterGradeServiceToken);
+      const gradeService = await kernelContainer.serviceRegistry.resolve(ISemesterGradeServiceToken);
       await gradeService.saveSemesterGrade(lessonId, studentId, Math.round(Number(grade)));
       res.json({ success: true });
     } catch (e) {
@@ -23087,7 +23146,7 @@ function registerGradingRoutes(ctx) {
   });
   app.get("/api/classes/:classId/points-dimensions", async (req, res) => {
     try {
-      const dimensionRegistry = await kernelContainer.registry.resolve(IPointsDimensionRegistryToken);
+      const dimensionRegistry = await kernelContainer.serviceRegistry.resolve(IPointsDimensionRegistryToken);
       const dimensions = dimensionRegistry.listDimensions();
       res.json({ success: true, dimensions });
     } catch (e) {
@@ -23104,7 +23163,7 @@ function registerGradingRoutes(ctx) {
       if (!classId || !dimensionId || deltaPoints === void 0 || !reason) {
         return res.status(400).json({ success: false, error: "classId, dimensionId, deltaPoints, and reason are required" });
       }
-      const ledgerService = await kernelContainer.registry.resolve(IPointsLedgerServiceToken);
+      const ledgerService = await kernelContainer.serviceRegistry.resolve(IPointsLedgerServiceToken);
       const logItem = await ledgerService.addPoints(studentId, classId, dimensionId, Number(deltaPoints), reason, pluginId);
       kernelContainer.eventBus.publish({
         id: logItem.id,
@@ -23122,7 +23181,7 @@ function registerGradingRoutes(ctx) {
     try {
       const { studentId } = req.params;
       const { classId } = req.query;
-      const ledgerService = await kernelContainer.registry.resolve(IPointsLedgerServiceToken);
+      const ledgerService = await kernelContainer.serviceRegistry.resolve(IPointsLedgerServiceToken);
       const logs = await ledgerService.getLogs(studentId, classId);
       const summary = await ledgerService.getStudentDimensionSummary(studentId, classId || "");
       res.json({ success: true, logs, summary });
@@ -24013,6 +24072,10 @@ function registerPluginsRoutes(ctx) {
       if (!cleanUrl.endsWith("/chat/completions")) {
         cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
       }
+      const urlSafety = isSafeExternalUrl(cleanUrl);
+      if (!urlSafety.safe) {
+        return res.status(400).json({ error: `Blocked unsafe AI provider URL: ${urlSafety.reason}` });
+      }
       const response = await fetch(cleanUrl, {
         method: "POST",
         headers: {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "openlearn-next",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "private": false,
   "description": "A plugin-driven Educational OS / LMS platform with AI agent teaching assistant",
   "keywords": [