Files
kandev/apps/web/lib/plugins/config-schema.test.ts
T
João Salavisa fae2303db3 feat(plugins): per-plugin settings pages driven by manifest config_schema (#1761)
* feat(plugins): per-plugin settings pages driven by manifest config_schema

Settings > Plugins rows now open /settings/plugins/:id — a detail page
showing the manifest plus a settings form generated from the plugin
author's config_schema. Secret fields (secret: true / format: password)
are masked on the operator API and kept on masked re-submits; a running
plugin restarts on save and reads its config (cleartext secrets included)
through the new Host GetConfig gRPC RPC.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): write plugin config file owner-only (0600)

Operator config can now carry cleartext secret values (config_schema
fields marked secret), so <id>.config.yml must not be world-readable —
match the 0600 mode the record file already uses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(plugins): vault-backed plugin secrets — Get/Set/DeleteSecret RPCs and encrypted config secrets

Plugins get vault-backed secret primitives on the Host API
(GetSecret/SetSecret/DeleteSecret, capability-gated, namespaced to
plugin:<id>㊙️<key> so a plugin can only touch its own entries;
purged on uninstall). Secret config_schema fields now live in kandev's
AES-256-GCM vault too — <id>.config.yml persists only a vault reference,
and the Host GetConfig RPC resolves it back to cleartext for the plugin.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(plugins): serve PR screenshots from the media/pr-1761-screenshots ref instead of the repo

The PR body now points at raw URLs pinned to an unmerged media ref, so
the binaries never land in main (PRs are squash-merged; only the branch
tip tree merges).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): address review feedback on settings validation and save flow

- integer form fields reject non-integral input instead of parseInt-truncating
- enum selections keep their schema-declared types (numeric enums round-trip)
- backend enum validation normalizes int-vs-float64 before comparison
- maskSecrets masks any non-zero secret value regardless of runtime type
- save flow splits PATCH from refetch: a refetch failure no longer reports a
  successful save as an error, and typed secrets are masked on screen
- optional enum fields gain a 'Not set' option so they can be cleared
- resolveConfigSecrets copies before mutating; restart-failure SetStatus
  errors are logged; SDK test fake returns a non-nil empty config map
- add missing tests: usePluginConfigForm hook, getPluginConfig client,
  integer/enum regression cases

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): harden secret config invariants from review

- reject non-string values on declared secret fields at validation time,
  closing the path where a numeric/boolean secret bypassed the vault and
  persisted cleartext in the config file
- delete removed secret fields' vault entries only AFTER the config commit
  succeeds, so a failed SetConfig never leaves the still-current config
  referencing a deleted vault entry
- uninstall fails closed: the plugin's vault namespace is purged before any
  destructive step, and a cleanup failure aborts the uninstall (retryable)
  instead of letting a reinstall inherit stale secrets

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): failure-atomic config secrets, quiesced uninstall purge, ctx propagation

- UpdateConfig is now failure-atomic for secret overwrites: storeConfigSecrets
  snapshots each vault entry before writing and returns a rollback that
  restores prior values (or deletes newly-created ones). A vault.Set failure
  mid-loop or a failed SetConfig commit rolls back, so a request reported as
  failed never changes the value a still-current config ref resolves to.
- Uninstall stops the plugin process BEFORE purging its vault namespace, so
  the plugin can no longer race the cleanup with a SetSecret between ListIDs
  and the deletes; the purge stays fail-closed and retryable.
- Thread the request context through Uninstall -> deletePluginSecrets instead
  of context.Background(), per the pass-context-through-chains convention.
- Consolidate the 'secret not found:' prefix check into isSecretNotFound
  (host.go + service rollback share one definition).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): detach rollback context, fail closed without a vault, reconcile uninstall status

- vault rollback closures now run on context.WithoutCancel(ctx): a request
  cancelled mid-save (browser closed) can no longer abort the rollback and
  leave the vault holding new values while the unchanged config still points
  at them (Greptile P1).
- storeConfigSecrets fails closed (errSecretVaultRequired) when a plugin
  declares secret config fields but no vault is wired, instead of silently
  persisting the secret in cleartext.
- vaultRestoreFunc distinguishes not-found from a genuine Reveal error: a
  backend read failure aborts the update before writing rather than risk a
  rollback that deletes a real secret; rollback now returns errors, joined
  into UpdateConfig's failure so an inconsistent vault is surfaced, not just
  logged.
- Uninstall reconciles lifecycle status when a secret-purge failure aborts
  after the process was stopped: a previously-running plugin transitions to
  error and notifies observers instead of being reported active with no
  process running.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): detach removed-secret cleanup ctx and clear stale save dirty flag

- cleanupRemovedConfigSecrets now runs on context.WithoutCancel(ctx), matching
  the rollback path, so a client disconnect right after the config commit can
  no longer cancel the delete and orphan now-unreferenced vault entries.
- tests: assert GetConfig succeeds before treating an empty map as proof that
  nothing persisted (a swallowed read error would be a false pass).
- web: on a post-save refetch failure, rebase initialValues onto the masked
  snapshot so the saved form no longer reads as dirty.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): fail tests on discarded GetConfig errors, drop setState-in-updater

- config_test: capture and fatal on GetConfig errors at the four remaining
  positive-assertion sites (a nil from a failed read would panic on the next
  map access instead of giving a clear failure), matching the earlier fix.
- web hook: compute the masked post-save snapshot from the current values and
  apply it to setValues + setInitialValues directly, instead of calling
  setInitialValues inside a setValues functional updater (a React anti-pattern
  that runs twice under StrictMode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): skip validation of a secret field's own vault ref

- validateConfigSchema takes the plugin id and skips a secret field whose
  value is that field's config vault ref (an internal storage marker,
  already validated when first set). Without this, a field declaring both
  secret: true and enum: [...] 400s on every save that keeps the mask,
  because the enum check saw the vault ref instead of a user value. Freshly
  entered secret values are still validated; a foreign plugin's ref is not
  skipped. Covered by unit + service-level regression tests.
- surface mid-loop vault rollback failures in storeConfigSecrets via a
  warning instead of discarding them (double-fault observability).
- web: integer inputs get step=1 so browsers flag non-integral input in
  place (serializeConfigValues remains the backstop).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(plugins): split config secret tests into config_secrets_test.go

config_test.go had grown past the 800-line backend file-length limit
(revive), failing CI lint. Move the vault-backed config and plugin-scoped
secret tests (plus their fake-vault/store helpers) into a sibling file;
no test logic changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-17 22:13:58 +01:00

123 lines
4.3 KiB
TypeScript

import { describe, expect, it } from "vitest";
import {
SECRET_MASK,
buildInitialValues,
missingRequiredFields,
parseConfigSchema,
serializeConfigValues,
} from "./config-schema";
const githubSchema = {
type: "object",
required: ["github_token"],
properties: {
github_token: {
type: "string",
title: "Personal access token",
description: "Fine-grained PAT with repo scope.",
secret: true,
},
webhook_key: { type: "string", format: "password" },
org: { type: "string" },
max_items: { type: "integer", default: 25 },
channel: { type: "string", enum: ["dev", "ops"] },
verbose: { type: "boolean", default: true },
},
} satisfies Record<string, unknown>;
describe("parseConfigSchema", () => {
it("maps properties to fields with titles, requiredness, and secrecy", () => {
const fields = parseConfigSchema(githubSchema);
const byName = Object.fromEntries(fields.map((f) => [f.name, f]));
expect(fields).toHaveLength(6);
expect(byName.github_token).toMatchObject({
type: "string",
label: "Personal access token",
description: "Fine-grained PAT with repo scope.",
required: true,
secret: true,
});
expect(byName.webhook_key.secret).toBe(true);
expect(byName.org).toMatchObject({ label: "org", required: false, secret: false });
expect(byName.max_items).toMatchObject({ type: "integer", defaultValue: 25 });
expect(byName.channel).toMatchObject({ type: "enum", enumValues: ["dev", "ops"] });
expect(byName.verbose.type).toBe("boolean");
});
it("returns [] for missing or unusable schemas", () => {
expect(parseConfigSchema(undefined)).toEqual([]);
expect(parseConfigSchema({})).toEqual([]);
expect(parseConfigSchema({ properties: "nope" })).toEqual([]);
});
});
describe("buildInitialValues", () => {
it("prefers stored config, then defaults, then empties", () => {
const fields = parseConfigSchema(githubSchema);
const values = buildInitialValues(fields, { github_token: SECRET_MASK, org: "kdlbs" });
expect(values.github_token).toBe(SECRET_MASK);
expect(values.org).toBe("kdlbs");
expect(values.max_items).toBe("25");
expect(values.verbose).toBe(true);
expect(values.channel).toBe("");
});
});
describe("serializeConfigValues", () => {
it("parses numerics, keeps booleans, and drops empty strings", () => {
const fields = parseConfigSchema(githubSchema);
const config = serializeConfigValues(fields, {
github_token: SECRET_MASK,
webhook_key: "",
org: "kdlbs",
max_items: "10",
channel: "",
verbose: false,
});
expect(config).toEqual({
github_token: SECRET_MASK,
org: "kdlbs",
max_items: 10,
verbose: false,
});
});
it("omits unparseable numeric input", () => {
const fields = parseConfigSchema(githubSchema);
const config = serializeConfigValues(fields, { max_items: "abc", verbose: true });
expect(config).not.toHaveProperty("max_items");
});
it("rejects (omits) non-integral input for integer fields instead of truncating", () => {
const fields = parseConfigSchema(githubSchema);
// parseInt would silently turn "1.5" into 1 — the field must be omitted
// so the operator is told rather than getting a corrupted value.
const config = serializeConfigValues(fields, { max_items: "1.5", verbose: true });
expect(config).not.toHaveProperty("max_items");
expect(
serializeConfigValues(fields, { max_items: "Infinity", verbose: true }),
).not.toHaveProperty("max_items");
});
it("submits numeric enum selections with their original type", () => {
const fields = parseConfigSchema({
properties: { level: { type: "integer", enum: [1, 2, 3] } },
});
const config = serializeConfigValues(fields, { level: "2" });
expect(config.level).toBe(2);
});
});
describe("missingRequiredFields", () => {
it("flags blank required fields and accepts the secret mask as set", () => {
const fields = parseConfigSchema(githubSchema);
expect(missingRequiredFields(fields, { github_token: "" })).toEqual(["Personal access token"]);
expect(missingRequiredFields(fields, { github_token: SECRET_MASK })).toEqual([]);
expect(missingRequiredFields(fields, { github_token: "ghp_x" })).toEqual([]);
});
});