superacli 1.1.22 → 1.1.26

package/server/routes/plugins.js

@@ -10,6 +10,10 @@ const {
   removeServerPlugin,
   getPluginArchiveBuffer,
 } = require("../services/pluginsService")
+const { getStorage } = require("../storage/adapter")
+const { registerPluginResources, unregisterPluginResources } = require("../services/pluginResourceService")
+const { bumpVersion } = require("../services/configService")
+const { requireAuth } = require("../middleware/auth")
 
 const router = Router()
 
@@ -147,7 +151,7 @@ async function parseMultipartFormData(req) {
   }
 }
 
-router.get("/", async (req, res) => {
+router.get("/", requireAuth, async (req, res) => {
   try {
     const plugins = await listServerPlugins()
     const settings = await getSettings()
@@ -160,25 +164,7 @@ router.get("/", async (req, res) => {
   }
 })
 
-router.get("/settings", async (req, res) => {
-  try {
-    const settings = await getSettings()
-    res.json(settings)
-  } catch (err) {
-    handleError(res, err)
-  }
-})
-
-router.put("/settings", async (req, res) => {
-  try {
-    const settings = await updateSettings(req.body || {})
-    res.json({ ok: true, settings })
-  } catch (err) {
-    handleError(res, err)
-  }
-})
-
-router.post("/", async (req, res) => {
+router.post("/", requireAuth, async (req, res) => {
   try {
     const sourceType = String((req.body && req.body.source_type) || "json").trim().toLowerCase()
     const plugin = sourceType === "zip"
@@ -190,7 +176,7 @@ router.post("/", async (req, res) => {
   }
 })
 
-router.post("/upload", async (req, res) => {
+router.post("/upload", requireAuth, async (req, res) => {
   try {
     const contentType = String(req.headers["content-type"] || "")
     const payload = contentType.includes("multipart/form-data")
@@ -203,7 +189,7 @@ router.post("/upload", async (req, res) => {
   }
 })
 
-router.get("/:name", async (req, res) => {
+router.get("/:name", requireAuth, async (req, res) => {
   try {
     const plugin = await getServerPlugin(req.params.name)
     if (!plugin) {
@@ -215,7 +201,7 @@ router.get("/:name", async (req, res) => {
   }
 })
 
-router.patch("/:name", async (req, res) => {
+router.patch("/:name", requireAuth, async (req, res) => {
   try {
     const plugin = await updatePluginMetadata(req.params.name, req.body || {})
     res.json({ ok: true, plugin })
@@ -224,7 +210,7 @@ router.patch("/:name", async (req, res) => {
   }
 })
 
-router.delete("/:name", async (req, res) => {
+router.delete("/:name", requireAuth, async (req, res) => {
   try {
     const removed = await removeServerPlugin(req.params.name)
     res.json({ ok: true, removed })
@@ -233,7 +219,7 @@ router.delete("/:name", async (req, res) => {
   }
 })
 
-router.get("/:name/manifest", async (req, res) => {
+router.get("/:name/manifest", requireAuth, async (req, res) => {
   try {
     const plugin = await getServerPlugin(req.params.name)
     if (!plugin) {
@@ -245,7 +231,7 @@ router.get("/:name/manifest", async (req, res) => {
   }
 })
 
-router.get("/:name/archive", async (req, res) => {
+router.get("/:name/archive", requireAuth, async (req, res) => {
   try {
     const archive = await getPluginArchiveBuffer(req.params.name)
     if (!archive) {
@@ -259,4 +245,101 @@ router.get("/:name/archive", async (req, res) => {
   }
 })
 
+router.post("/client-resources", requireAuth, async (req, res) => {
+  try {
+    const storage = getStorage()
+    const { client_id, plugins } = req.body || {}
+    
+    if (!Array.isArray(plugins)) {
+      return res.status(400).json({ error: "plugins must be an array", type: "invalid_argument" })
+    }
+    
+    if (!client_id || typeof client_id !== "string") {
+      return res.status(400).json({ error: "client_id is required", type: "invalid_argument" })
+    }
+    
+    // Update client last_seen
+    await storage.set(`client:${client_id}`, {
+      client_id: client_id,
+      last_seen: new Date(),
+      plugin_count: plugins.length
+    })
+    
+    // Remove existing cli resources from this specific client only
+    const allMcpKeys = await storage.listKeys("mcp:")
+    const allSpecKeys = await storage.listKeys("spec:")
+    const clientMcpKeys = allMcpKeys.filter(k => k.startsWith(`mcp:cli:${client_id}:`))
+    const clientSpecKeys = allSpecKeys.filter(k => k.startsWith(`spec:cli:${client_id}:`))
+    
+    // Remove this client's existing resources
+    for (const key of clientMcpKeys) {
+      await storage.delete(key)
+    }
+    for (const key of clientSpecKeys) {
+      await storage.delete(key)
+    }
+    
+    // Store plugin metadata and register resources
+    const results = { synced: plugins.length, registered_mcp: 0, registered_specs: 0, errors: [] }
+    
+    for (const plugin of plugins) {
+      if (!plugin.name || !plugin.server_resources) continue
+      
+      try {
+        // Store plugin metadata with client_id
+        await storage.set(`plugin_client:${client_id}:${plugin.name}`, {
+          name: plugin.name,
+          server_resources: plugin.server_resources,
+          client_id: client_id,
+          synced_at: new Date()
+        })
+        
+        // Register resources with client_id in key
+        const regResults = await registerPluginResources(plugin.name, plugin.server_resources, "cli", client_id)
+        results.registered_mcp += regResults.mcp.length
+        results.registered_specs += regResults.specs.length
+        results.errors.push(...regResults.errors)
+      } catch (err) {
+        results.errors.push(`Failed to sync plugin ${plugin.name}: ${err.message}`)
+      }
+    }
+    
+    await bumpVersion()
+    res.json({ ok: true, ...results })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+// List clients endpoint
+router.get("/clients", async (req, res) => {
+  try {
+    const storage = getStorage()
+    const clientKeys = await storage.listKeys("client:")
+    const clients = []
+    
+    for (const key of clientKeys) {
+      try {
+        const client = await storage.get(key)
+        if (client && client.client_id) {
+          clients.push(client)
+        }
+      } catch (err) {
+        // Skip if client read fails
+      }
+    }
+    
+    // Sort by last_seen descending
+    clients.sort((a, b) => new Date(b.last_seen) - new Date(a.last_seen))
+    
+    if (req.query.format !== "json" && req.accepts("html") && !req.xhr && !req.headers["x-requested-with"]) {
+      return res.render("clients", { clients })
+    }
+    
+    res.json({ clients })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
 module.exports = router

package/server/routes/settings.js

@@ -0,0 +1,93 @@
+const { Router } = require("express");
+const { getSettings, updateSettings } = require("../services/pluginsService");
+
+const router = Router();
+
+// Helper function to handle errors
+function handleError(res, err) {
+  console.error(err);
+  const status = err.status || 500;
+  const error = err.error || { code: 500, type: "internal_error", message: err.message || "Internal server error" };
+  res.status(status).json({ error });
+}
+
+// GET /settings - Render settings view
+router.get("/settings", async (req, res) => {
+  try {
+    const settings = await getSettings()
+    if (req.query.format !== "json" && req.accepts("html") && !req.xhr && !req.headers["x-requested-with"]) {
+      return res.render("settings", { settings })
+    }
+    res.json(settings)
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+// PUT /settings - Update settings
+router.put("/settings", async (req, res) => {
+  try {
+    const settings = await updateSettings(req.body || {})
+    res.json({ ok: true, settings })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+// GET /api-keys - Render API keys view
+router.get("/api-keys", async (req, res) => {
+  try {
+    const settings = await getSettings()
+    if (req.query.format !== "json" && req.accepts("html") && !req.xhr && !req.headers["x-requested-with"]) {
+      return res.render("api-keys", { settings })
+    }
+    res.json({ api_keys: settings.api_keys || [] })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+// POST /api-keys - Create API key
+router.post("/api-keys", async (req, res) => {
+  try {
+    const { name } = req.body || {}
+    if (!name || typeof name !== "string") {
+      return res.status(400).json({ error: "name is required", type: "invalid_argument" })
+    }
+
+    const settings = await getSettings()
+    const crypto = require("crypto")
+    const key = crypto.randomBytes(32).toString("hex")
+
+    const newApiKey = {
+      name: String(name).trim(),
+      key,
+      created_at: new Date().toISOString()
+    }
+
+    const apiKeys = Array.isArray(settings.api_keys) ? settings.api_keys : []
+    apiKeys.push(newApiKey)
+
+    await updateSettings({ api_keys: apiKeys })
+    res.status(201).json(newApiKey)
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+// DELETE /api-keys/:key - Delete API key
+router.delete("/api-keys/:key", async (req, res) => {
+  try {
+    const keyToDelete = req.params.key
+    const settings = await getSettings()
+    const apiKeys = Array.isArray(settings.api_keys) ? settings.api_keys : []
+    const filtered = apiKeys.filter(k => k.key !== keyToDelete)
+
+    await updateSettings({ api_keys: filtered })
+    res.json({ ok: true })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+module.exports = router;

package/server/routes/specs.js

@@ -28,9 +28,12 @@ router.get("/", async (req, res) => {
 router.post("/", async (req, res) => {
   try {
     const storage = getStorage()
-    const { name, url, auth } = req.body
+    const { name, url, auth, pluginSource } = req.body
     const key = `spec:${name}`
-    const doc = { _id: key, name, url, auth: auth || "none", createdAt: new Date() }
+    // Support both simple string auth and object auth
+    const authValue = auth || "none"
+    const doc = { _id: key, name, url, auth: authValue, createdAt: new Date() }
+    if (typeof pluginSource === "string") doc.pluginSource = pluginSource
     await storage.set(key, doc)
     await bumpVersion()
     if (req.headers["content-type"]?.includes("urlencoded")) {
@@ -54,7 +57,9 @@ router.put("/:id", async (req, res) => {
       await storage.delete(id)
     }
 
-    const doc = { _id: newKey, name, url, auth: auth || "none" }
+    // Support both simple string auth and object auth
+    const authValue = auth || "none"
+    const doc = { _id: newKey, name, url, auth: authValue }
     await storage.set(newKey, doc)
     await bumpVersion()
     res.json({ ok: true })

package/server/services/adaptersService.js

@@ -65,6 +65,7 @@ async function listAdapters() {
   const records = await Promise.all(keys.map(k => storage.get(k)))
   return records
     .filter(Boolean)
+    .filter(record => record.name) // Filter out records without name (e.g., package records)
     .sort((a, b) => String(a.name || "").localeCompare(String(b.name || "")))
     .map(toPublicAdapter)
 }

package/server/services/pluginResourceService.js

@@ -0,0 +1,262 @@
+/**
+ * Plugin Resource Service
+ * Handles registration and cleanup of server resources (MCP/OpenAPI) from plugins
+ */
+const { getStorage } = require("../storage/adapter")
+
+async function registerPluginResources(pluginName, serverResources, origin = "cli", clientId = null) {
+  const storage = getStorage()
+  const results = { mcp: [], specs: [], errors: [] }
+  
+  try {
+    // Register MCP resources
+    if (serverResources.mcp && Array.isArray(serverResources.mcp)) {
+      for (const mcpResource of serverResources.mcp) {
+        try {
+          if (!mcpResource.name || (!mcpResource.url && !mcpResource.command)) {
+            results.errors.push(`Invalid MCP resource: missing name or url/command`)
+            continue
+          }
+          
+          // Build key with client_id if origin is cli
+          const key = origin === "cli" && clientId
+            ? `mcp:${origin}:${clientId}:${pluginName}:${mcpResource.name}`
+            : `mcp:${origin}:${pluginName}:${mcpResource.name}`
+          
+          const doc = {
+            _id: key,
+            name: key,
+            displayName: mcpResource.name,
+            pluginSource: pluginName,
+            origin: origin,
+            clientId: clientId || null,
+            createdAt: new Date()
+          }
+          
+          // Copy MCP properties
+          if (mcpResource.url) doc.url = mcpResource.url
+          if (mcpResource.command) doc.command = mcpResource.command
+          if (mcpResource.args) doc.args = mcpResource.args
+          if (mcpResource.headers) doc.headers = mcpResource.headers
+          if (mcpResource.env) doc.env = mcpResource.env
+          if (mcpResource.timeout_ms) doc.timeout_ms = mcpResource.timeout_ms
+          if (mcpResource.stateful) doc.stateful = true
+          
+          await storage.set(key, doc)
+          results.mcp.push(key)
+        } catch (err) {
+          results.errors.push(`Failed to register MCP ${mcpResource.name}: ${err.message}`)
+        }
+      }
+    }
+    
+    // Register OpenAPI spec resources
+    if (serverResources.specs && Array.isArray(serverResources.specs)) {
+      for (const specResource of serverResources.specs) {
+        try {
+          if (!specResource.name || !specResource.url) {
+            results.errors.push(`Invalid spec resource: missing name or url`)
+            continue
+          }
+          
+          // Build key with client_id if origin is cli
+          const key = origin === "cli" && clientId
+            ? `spec:${origin}:${clientId}:${pluginName}:${specResource.name}`
+            : `spec:${origin}:${pluginName}:${specResource.name}`
+          
+          const doc = {
+            _id: key,
+            name: key,
+            displayName: specResource.name,
+            url: specResource.url,
+            auth: specResource.auth || "none",
+            pluginSource: pluginName,
+            origin: origin,
+            clientId: clientId || null,
+            createdAt: new Date()
+          }
+          
+          await storage.set(key, doc)
+          results.specs.push(key)
+        } catch (err) {
+          results.errors.push(`Failed to register spec ${specResource.name}: ${err.message}`)
+        }
+      }
+    }
+  } catch (err) {
+    results.errors.push(`Resource registration failed: ${err.message}`)
+  }
+  
+  return results
+}
+
+async function unregisterPluginResources(pluginName, origin = "cli") {
+  const storage = getStorage()
+  const results = { mcp: [], specs: [], errors: [] }
+  
+  try {
+    // Remove MCP resources by origin prefix
+    const allMcpKeys = await storage.listKeys("mcp:")
+    const targetMcpKeys = allMcpKeys.filter(k => k.startsWith(`mcp:${origin}:${pluginName}:`))
+    for (const key of targetMcpKeys) {
+      try {
+        await storage.delete(key)
+        results.mcp.push(key)
+      } catch (err) {
+        results.errors.push(`Failed to remove MCP ${key}: ${err.message}`)
+      }
+    }
+    
+    // Remove spec resources by origin prefix
+    const allSpecKeys = await storage.listKeys("spec:")
+    const targetSpecKeys = allSpecKeys.filter(k => k.startsWith(`spec:${origin}:${pluginName}:`))
+    for (const key of targetSpecKeys) {
+      try {
+        await storage.delete(key)
+        results.specs.push(key)
+      } catch (err) {
+        results.errors.push(`Failed to remove spec ${key}: ${err.message}`)
+      }
+    }
+  } catch (err) {
+    results.errors.push(`Resource cleanup failed: ${err.message}`)
+  }
+  
+  return results
+}
+
+async function registerAllPluginResources() {
+  const storage = getStorage()
+  const results = { plugins: {}, totalErrors: 0, registeredMcp: 0, registeredSpecs: 0 }
+  
+  // Register resources from client plugins (plugin_client:{client-id}:*)
+  const clientPluginKeys = await storage.listKeys("plugin_client:")
+  for (const key of clientPluginKeys) {
+    try {
+      const plugin = await storage.get(key)
+      if (plugin && plugin.server_resources && plugin.client_id) {
+        const pluginResults = await registerPluginResources(plugin.name, plugin.server_resources, "cli", plugin.client_id)
+        results.plugins[plugin.name] = pluginResults
+        results.totalErrors += pluginResults.errors.length
+        results.registeredMcp += pluginResults.mcp.length
+        results.registeredSpecs += pluginResults.specs.length
+      }
+    } catch (err) {
+      results.totalErrors++
+    }
+  }
+  
+  // Register resources from server plugins (plugin_server:*)
+  const serverPluginKeys = await storage.listKeys("plugin_server:")
+  for (const key of serverPluginKeys) {
+    try {
+      const plugin = await storage.get(key)
+      if (plugin && plugin.manifest && plugin.manifest.server_resources) {
+        const pluginResults = await registerPluginResources(plugin.name, plugin.manifest.server_resources, "server")
+        results.plugins[plugin.name] = pluginResults
+        results.totalErrors += pluginResults.errors.length
+        results.registeredMcp += pluginResults.mcp.length
+        results.registeredSpecs += pluginResults.specs.length
+      }
+    } catch (err) {
+      results.totalErrors++
+    }
+  }
+  
+  return results
+}
+
+async function syncPluginResources() {
+  const storage = getStorage()
+  
+  // Get all currently registered plugin resources
+  const allMcpKeys = await storage.listKeys("mcp:")
+  const allSpecKeys = await storage.listKeys("spec:")
+  
+  // Filter for plugin resources (contain origin prefix)
+  const pluginMcpKeys = allMcpKeys.filter(k => k.split(':').length > 2)
+  const pluginSpecKeys = allSpecKeys.filter(k => k.split(':').length > 2)
+  
+  // Build set of expected resources from server storage (plugin_client:* and plugin_server:*)
+  const expectedMcpKeys = new Set()
+  const expectedSpecKeys = new Set()
+  
+  const clientPluginKeys = await storage.listKeys("plugin_client:")
+  const serverPluginKeys = await storage.listKeys("plugin_server:")
+  
+  // Read client plugins
+  for (const key of clientPluginKeys) {
+    try {
+      const plugin = await storage.get(key)
+      if (plugin && plugin.server_resources && plugin.client_id) {
+        if (plugin.server_resources.mcp) {
+          for (const mcp of plugin.server_resources.mcp) {
+            expectedMcpKeys.add(`mcp:cli:${plugin.client_id}:${plugin.name}:${mcp.name}`)
+          }
+        }
+        if (plugin.server_resources.specs) {
+          for (const spec of plugin.server_resources.specs) {
+            expectedSpecKeys.add(`spec:cli:${plugin.client_id}:${plugin.name}:${spec.name}`)
+          }
+        }
+      }
+    } catch (err) {
+      // Skip if plugin read fails
+    }
+  }
+  
+  // Read server plugins
+  for (const key of serverPluginKeys) {
+    try {
+      const plugin = await storage.get(key)
+      if (plugin && plugin.manifest && plugin.manifest.server_resources) {
+        if (plugin.manifest.server_resources.mcp) {
+          for (const mcp of plugin.manifest.server_resources.mcp) {
+            expectedMcpKeys.add(`mcp:server:${plugin.name}:${mcp.name}`)
+          }
+        }
+        if (plugin.manifest.server_resources.specs) {
+          for (const spec of plugin.manifest.server_resources.specs) {
+            expectedSpecKeys.add(`spec:server:${plugin.name}:${spec.name}`)
+          }
+        }
+      }
+    } catch (err) {
+      // Skip if plugin read fails
+    }
+  }
+  
+  // Remove orphaned resources (no longer in any installed plugin)
+  const cleanupResults = { removedMcp: [], removedSpecs: [], errors: [] }
+  
+  for (const key of pluginMcpKeys) {
+    if (!expectedMcpKeys.has(key)) {
+      try {
+        await storage.delete(key)
+        cleanupResults.removedMcp.push(key)
+      } catch (err) {
+        cleanupResults.errors.push(`Failed to remove orphaned MCP ${key}: ${err.message}`)
+      }
+    }
+  }
+  
+  for (const key of pluginSpecKeys) {
+    if (!expectedSpecKeys.has(key)) {
+      try {
+        await storage.delete(key)
+        cleanupResults.removedSpecs.push(key)
+      } catch (err) {
+        cleanupResults.errors.push(`Failed to remove orphaned spec ${key}: ${err.message}`)
+      }
+    }
+  }
+  
+  return cleanupResults
+}
+
+module.exports = {
+  registerPluginResources,
+  unregisterPluginResources,
+  registerAllPluginResources,
+  syncPluginResources
+}

package/server/services/pluginsService.js

@@ -1,6 +1,7 @@
 const crypto = require("crypto")
 const { getStorage } = require("../storage/adapter")
 const { bumpVersion } = require("./configService")
+const { registerPluginResources, unregisterPluginResources } = require("./pluginResourceService")
 
 const PLUGIN_PREFIX = "plugin_server:"
 const SETTINGS_KEY = "settings:plugins"
@@ -18,6 +19,8 @@ function defaultSettings() {
     max_zip_mb: 10,
     default_hooks_policy: "deny",
     admin_mode_enabled: false,
+    public_access: true,
+    api_keys: [],
   }
 }
 
@@ -119,6 +122,15 @@ async function updateSettings(patch = {}) {
   if (patch.admin_mode_enabled !== undefined) {
     next.admin_mode_enabled = patch.admin_mode_enabled === true || patch.admin_mode_enabled === "true"
   }
+  if (patch.public_access !== undefined) {
+    next.public_access = patch.public_access === true || patch.public_access === "true"
+  }
+  if (patch.api_keys !== undefined) {
+    if (!Array.isArray(patch.api_keys)) {
+      throw invalid("api_keys must be an array")
+    }
+    next.api_keys = patch.api_keys
+  }
   const storage = getStorage()
   await storage.set(SETTINGS_KEY, next)
   return next
@@ -194,6 +206,12 @@ async function upsertJsonPlugin(payload) {
   }
   const storage = getStorage()
   await storage.set(pluginKey(common.name), next)
+  
+  // Register server resources if present
+  if (manifest.server_resources) {
+    await registerPluginResources(common.name, manifest.server_resources, "server")
+  }
+  
   await bumpVersion()
   return toPublicPlugin(next)
 }
@@ -233,6 +251,12 @@ async function upsertZipPlugin(payload) {
   }
   const storage = getStorage()
   await storage.set(pluginKey(common.name), next)
+  
+  // Register server resources if present
+  if (manifest.server_resources) {
+    await registerPluginResources(common.name, manifest.server_resources, "server")
+  }
+  
   await bumpVersion()
   return toPublicPlugin(next)
 }

package/server/uploads/superbackend-openapi.json

@@ -0,0 +1,47 @@
+{
+  "openapi": "3.0.0",
+  "info": {
+    "title": "Superbackend API",
+    "version": "1.0.0"
+  },
+  "servers": [
+    {
+      "url": "https://superbackend.coolify.intrane.fr"
+    }
+  ],
+  "paths": {
+    "/health": {
+      "get": {
+        "operationId": "getHealth",
+        "summary": "Health check endpoint",
+        "description": "Returns the health status of the backend service",
+        "responses": {
+          "200": {
+            "description": "Health status",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "status": {
+                      "type": "string",
+                      "example": "ok"
+                    },
+                    "mode": {
+                      "type": "string",
+                      "example": "middleware"
+                    },
+                    "database": {
+                      "type": "string",
+                      "example": "connected"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}