fae2303db3
* feat(plugins): per-plugin settings pages driven by manifest config_schema Settings > Plugins rows now open /settings/plugins/:id — a detail page showing the manifest plus a settings form generated from the plugin author's config_schema. Secret fields (secret: true / format: password) are masked on the operator API and kept on masked re-submits; a running plugin restarts on save and reads its config (cleartext secrets included) through the new Host GetConfig gRPC RPC. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): write plugin config file owner-only (0600) Operator config can now carry cleartext secret values (config_schema fields marked secret), so <id>.config.yml must not be world-readable — match the 0600 mode the record file already uses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(plugins): vault-backed plugin secrets — Get/Set/DeleteSecret RPCs and encrypted config secrets Plugins get vault-backed secret primitives on the Host API (GetSecret/SetSecret/DeleteSecret, capability-gated, namespaced to plugin:<id>㊙️<key> so a plugin can only touch its own entries; purged on uninstall). Secret config_schema fields now live in kandev's AES-256-GCM vault too — <id>.config.yml persists only a vault reference, and the Host GetConfig RPC resolves it back to cleartext for the plugin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(plugins): serve PR screenshots from the media/pr-1761-screenshots ref instead of the repo The PR body now points at raw URLs pinned to an unmerged media ref, so the binaries never land in main (PRs are squash-merged; only the branch tip tree merges). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): address review feedback on settings validation and save flow - integer form fields reject non-integral input instead of parseInt-truncating - enum selections keep their schema-declared types (numeric enums round-trip) - backend enum validation normalizes int-vs-float64 before comparison - maskSecrets masks any non-zero secret value regardless of runtime type - save flow splits PATCH from refetch: a refetch failure no longer reports a successful save as an error, and typed secrets are masked on screen - optional enum fields gain a 'Not set' option so they can be cleared - resolveConfigSecrets copies before mutating; restart-failure SetStatus errors are logged; SDK test fake returns a non-nil empty config map - add missing tests: usePluginConfigForm hook, getPluginConfig client, integer/enum regression cases Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): harden secret config invariants from review - reject non-string values on declared secret fields at validation time, closing the path where a numeric/boolean secret bypassed the vault and persisted cleartext in the config file - delete removed secret fields' vault entries only AFTER the config commit succeeds, so a failed SetConfig never leaves the still-current config referencing a deleted vault entry - uninstall fails closed: the plugin's vault namespace is purged before any destructive step, and a cleanup failure aborts the uninstall (retryable) instead of letting a reinstall inherit stale secrets Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): failure-atomic config secrets, quiesced uninstall purge, ctx propagation - UpdateConfig is now failure-atomic for secret overwrites: storeConfigSecrets snapshots each vault entry before writing and returns a rollback that restores prior values (or deletes newly-created ones). A vault.Set failure mid-loop or a failed SetConfig commit rolls back, so a request reported as failed never changes the value a still-current config ref resolves to. - Uninstall stops the plugin process BEFORE purging its vault namespace, so the plugin can no longer race the cleanup with a SetSecret between ListIDs and the deletes; the purge stays fail-closed and retryable. - Thread the request context through Uninstall -> deletePluginSecrets instead of context.Background(), per the pass-context-through-chains convention. - Consolidate the 'secret not found:' prefix check into isSecretNotFound (host.go + service rollback share one definition). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): detach rollback context, fail closed without a vault, reconcile uninstall status - vault rollback closures now run on context.WithoutCancel(ctx): a request cancelled mid-save (browser closed) can no longer abort the rollback and leave the vault holding new values while the unchanged config still points at them (Greptile P1). - storeConfigSecrets fails closed (errSecretVaultRequired) when a plugin declares secret config fields but no vault is wired, instead of silently persisting the secret in cleartext. - vaultRestoreFunc distinguishes not-found from a genuine Reveal error: a backend read failure aborts the update before writing rather than risk a rollback that deletes a real secret; rollback now returns errors, joined into UpdateConfig's failure so an inconsistent vault is surfaced, not just logged. - Uninstall reconciles lifecycle status when a secret-purge failure aborts after the process was stopped: a previously-running plugin transitions to error and notifies observers instead of being reported active with no process running. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): detach removed-secret cleanup ctx and clear stale save dirty flag - cleanupRemovedConfigSecrets now runs on context.WithoutCancel(ctx), matching the rollback path, so a client disconnect right after the config commit can no longer cancel the delete and orphan now-unreferenced vault entries. - tests: assert GetConfig succeeds before treating an empty map as proof that nothing persisted (a swallowed read error would be a false pass). - web: on a post-save refetch failure, rebase initialValues onto the masked snapshot so the saved form no longer reads as dirty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): fail tests on discarded GetConfig errors, drop setState-in-updater - config_test: capture and fatal on GetConfig errors at the four remaining positive-assertion sites (a nil from a failed read would panic on the next map access instead of giving a clear failure), matching the earlier fix. - web hook: compute the masked post-save snapshot from the current values and apply it to setValues + setInitialValues directly, instead of calling setInitialValues inside a setValues functional updater (a React anti-pattern that runs twice under StrictMode). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): skip validation of a secret field's own vault ref - validateConfigSchema takes the plugin id and skips a secret field whose value is that field's config vault ref (an internal storage marker, already validated when first set). Without this, a field declaring both secret: true and enum: [...] 400s on every save that keeps the mask, because the enum check saw the vault ref instead of a user value. Freshly entered secret values are still validated; a foreign plugin's ref is not skipped. Covered by unit + service-level regression tests. - surface mid-loop vault rollback failures in storeConfigSecrets via a warning instead of discarding them (double-fault observability). - web: integer inputs get step=1 so browsers flag non-integral input in place (serializeConfigValues remains the backstop). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(plugins): split config secret tests into config_secrets_test.go config_test.go had grown past the 800-line backend file-length limit (revive), failing CI lint. Move the vault-backed config and plugin-scoped secret tests (plus their fake-vault/store helpers) into a sibling file; no test logic changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
186 lines
6.7 KiB
TypeScript
186 lines
6.7 KiB
TypeScript
/**
|
|
* Turns a plugin manifest's `config_schema` (a JSON-Schema-like object the
|
|
* plugin author declares — see apps/backend/internal/plugins/config.go) into
|
|
* renderable form fields for the plugin settings page, and converts form
|
|
* values back into the config payload for PATCH /api/plugins/:id.
|
|
*
|
|
* Secret fields (`secret: true` or `format: "password"`, e.g. a GitHub PAT)
|
|
* come back from GET /api/plugins/:id/config as SECRET_MASK; submitting the
|
|
* mask unchanged tells the backend to keep the stored value.
|
|
*/
|
|
|
|
/** Mirror of the backend's configSecretMask (internal/plugins/config.go). */
|
|
export const SECRET_MASK = "********";
|
|
|
|
export type PluginConfigFieldType = "string" | "boolean" | "number" | "integer" | "enum";
|
|
|
|
export interface PluginConfigField {
|
|
name: string;
|
|
type: PluginConfigFieldType;
|
|
label: string;
|
|
description?: string;
|
|
required: boolean;
|
|
secret: boolean;
|
|
/** Display strings for the select control, parallel to enumRawValues. */
|
|
enumValues?: string[];
|
|
/** The schema's original typed enum values (numbers/booleans survive the
|
|
* round trip — the backend validates against these, not their string
|
|
* forms). */
|
|
enumRawValues?: unknown[];
|
|
defaultValue?: unknown;
|
|
}
|
|
|
|
type SchemaObject = Record<string, unknown>;
|
|
|
|
function asObject(value: unknown): SchemaObject | null {
|
|
return value && typeof value === "object" && !Array.isArray(value)
|
|
? (value as SchemaObject)
|
|
: null;
|
|
}
|
|
|
|
function fieldType(prop: SchemaObject): PluginConfigFieldType {
|
|
const enumValues = prop.enum;
|
|
if (Array.isArray(enumValues) && enumValues.length > 0) return "enum";
|
|
const type = prop.type;
|
|
if (type === "boolean" || type === "number" || type === "integer") return type;
|
|
return "string";
|
|
}
|
|
|
|
function isSecretProp(prop: SchemaObject): boolean {
|
|
return prop.secret === true || prop.format === "password";
|
|
}
|
|
|
|
function requiredNames(schema: SchemaObject): Set<string> {
|
|
const required = schema.required;
|
|
if (!Array.isArray(required)) return new Set();
|
|
return new Set(required.filter((name): name is string => typeof name === "string"));
|
|
}
|
|
|
|
/**
|
|
* Parses a config_schema into ordered form fields. Only declared
|
|
* `properties` become fields; richer schema constructs are ignored (the
|
|
* schema is authoring metadata, not a full JSON-Schema contract). Returns []
|
|
* for a missing or unusable schema — the settings page then shows the
|
|
* "no settings" state.
|
|
*/
|
|
export function parseConfigSchema(
|
|
schema: Record<string, unknown> | undefined,
|
|
): PluginConfigField[] {
|
|
const schemaObj = asObject(schema);
|
|
if (!schemaObj) return [];
|
|
const properties = asObject(schemaObj.properties);
|
|
if (!properties) return [];
|
|
const required = requiredNames(schemaObj);
|
|
|
|
const fields: PluginConfigField[] = [];
|
|
for (const [name, raw] of Object.entries(properties)) {
|
|
const prop = asObject(raw);
|
|
if (!prop) continue;
|
|
fields.push({
|
|
name,
|
|
type: fieldType(prop),
|
|
label: typeof prop.title === "string" && prop.title !== "" ? prop.title : name,
|
|
description: typeof prop.description === "string" ? prop.description : undefined,
|
|
required: required.has(name),
|
|
secret: isSecretProp(prop),
|
|
enumValues: Array.isArray(prop.enum) ? prop.enum.map((v) => String(v)) : undefined,
|
|
enumRawValues: Array.isArray(prop.enum) ? prop.enum : undefined,
|
|
defaultValue: prop.default,
|
|
});
|
|
}
|
|
return fields;
|
|
}
|
|
|
|
/**
|
|
* Builds the form's initial values from the (masked) stored config: stored
|
|
* value wins, then the schema default, then a type-appropriate empty value.
|
|
* Everything non-boolean is kept as a string for the input elements.
|
|
*/
|
|
export function buildInitialValues(
|
|
fields: PluginConfigField[],
|
|
config: Record<string, unknown>,
|
|
): Record<string, string | boolean> {
|
|
const values: Record<string, string | boolean> = {};
|
|
for (const field of fields) {
|
|
const stored = config[field.name] ?? field.defaultValue;
|
|
if (field.type === "boolean") {
|
|
values[field.name] = typeof stored === "boolean" ? stored : false;
|
|
} else {
|
|
values[field.name] = stored === undefined || stored === null ? "" : String(stored);
|
|
}
|
|
}
|
|
return values;
|
|
}
|
|
|
|
function coerceNumeric(field: PluginConfigField, raw: string): number | undefined {
|
|
// Never Number.parseInt here: it silently truncates "1.5" to 1, persisting
|
|
// a value the operator did not type. Reject non-integral input instead so
|
|
// the field is omitted and the required-field/backend validation surfaces
|
|
// the problem.
|
|
const parsed = Number(raw);
|
|
if (!Number.isFinite(parsed)) return undefined;
|
|
if (field.type === "integer" && !Number.isInteger(parsed)) return undefined;
|
|
return parsed;
|
|
}
|
|
|
|
/** Maps a select control's string back to the schema's original typed enum
|
|
* value, so numeric/boolean enums are submitted with their real types. */
|
|
function coerceEnum(field: PluginConfigField, raw: string): unknown {
|
|
const index = (field.enumValues ?? []).indexOf(raw);
|
|
if (index >= 0 && field.enumRawValues && index < field.enumRawValues.length) {
|
|
return field.enumRawValues[index];
|
|
}
|
|
return raw;
|
|
}
|
|
|
|
/**
|
|
* Converts form values back into the config object to PATCH. Empty string
|
|
* inputs are omitted (an unset optional field stays unset rather than
|
|
* persisting ""), booleans are always included, and numeric fields are
|
|
* parsed — an unparseable numeric input is omitted so the backend's schema
|
|
* validation reports the missing required field instead of a bogus value.
|
|
*/
|
|
export function serializeConfigValues(
|
|
fields: PluginConfigField[],
|
|
values: Record<string, string | boolean>,
|
|
): Record<string, unknown> {
|
|
const config: Record<string, unknown> = {};
|
|
for (const field of fields) {
|
|
const value = values[field.name];
|
|
if (field.type === "boolean") {
|
|
config[field.name] = value === true;
|
|
continue;
|
|
}
|
|
if (typeof value !== "string" || value === "") continue;
|
|
if (field.type === "number" || field.type === "integer") {
|
|
const parsed = coerceNumeric(field, value);
|
|
if (parsed !== undefined) config[field.name] = parsed;
|
|
continue;
|
|
}
|
|
if (field.type === "enum") {
|
|
config[field.name] = coerceEnum(field, value);
|
|
continue;
|
|
}
|
|
config[field.name] = value;
|
|
}
|
|
return config;
|
|
}
|
|
|
|
/**
|
|
* Client-side pre-validation matching the backend's required-field check, so
|
|
* the form can flag missing values before a round-trip. A secret field
|
|
* showing the mask counts as set (the backend keeps the stored value).
|
|
*/
|
|
export function missingRequiredFields(
|
|
fields: PluginConfigField[],
|
|
values: Record<string, string | boolean>,
|
|
): string[] {
|
|
return fields
|
|
.filter((field) => field.required && field.type !== "boolean")
|
|
.filter((field) => {
|
|
const value = values[field.name];
|
|
return typeof value !== "string" || value.trim() === "";
|
|
})
|
|
.map((field) => field.label);
|
|
}
|