Files
kandev/apps/web/lib/plugins/config-schema.ts
T
João Salavisa fae2303db3 feat(plugins): per-plugin settings pages driven by manifest config_schema (#1761)
* feat(plugins): per-plugin settings pages driven by manifest config_schema

Settings > Plugins rows now open /settings/plugins/:id — a detail page
showing the manifest plus a settings form generated from the plugin
author's config_schema. Secret fields (secret: true / format: password)
are masked on the operator API and kept on masked re-submits; a running
plugin restarts on save and reads its config (cleartext secrets included)
through the new Host GetConfig gRPC RPC.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): write plugin config file owner-only (0600)

Operator config can now carry cleartext secret values (config_schema
fields marked secret), so <id>.config.yml must not be world-readable —
match the 0600 mode the record file already uses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(plugins): vault-backed plugin secrets — Get/Set/DeleteSecret RPCs and encrypted config secrets

Plugins get vault-backed secret primitives on the Host API
(GetSecret/SetSecret/DeleteSecret, capability-gated, namespaced to
plugin:<id>㊙️<key> so a plugin can only touch its own entries;
purged on uninstall). Secret config_schema fields now live in kandev's
AES-256-GCM vault too — <id>.config.yml persists only a vault reference,
and the Host GetConfig RPC resolves it back to cleartext for the plugin.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(plugins): serve PR screenshots from the media/pr-1761-screenshots ref instead of the repo

The PR body now points at raw URLs pinned to an unmerged media ref, so
the binaries never land in main (PRs are squash-merged; only the branch
tip tree merges).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): address review feedback on settings validation and save flow

- integer form fields reject non-integral input instead of parseInt-truncating
- enum selections keep their schema-declared types (numeric enums round-trip)
- backend enum validation normalizes int-vs-float64 before comparison
- maskSecrets masks any non-zero secret value regardless of runtime type
- save flow splits PATCH from refetch: a refetch failure no longer reports a
  successful save as an error, and typed secrets are masked on screen
- optional enum fields gain a 'Not set' option so they can be cleared
- resolveConfigSecrets copies before mutating; restart-failure SetStatus
  errors are logged; SDK test fake returns a non-nil empty config map
- add missing tests: usePluginConfigForm hook, getPluginConfig client,
  integer/enum regression cases

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): harden secret config invariants from review

- reject non-string values on declared secret fields at validation time,
  closing the path where a numeric/boolean secret bypassed the vault and
  persisted cleartext in the config file
- delete removed secret fields' vault entries only AFTER the config commit
  succeeds, so a failed SetConfig never leaves the still-current config
  referencing a deleted vault entry
- uninstall fails closed: the plugin's vault namespace is purged before any
  destructive step, and a cleanup failure aborts the uninstall (retryable)
  instead of letting a reinstall inherit stale secrets

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): failure-atomic config secrets, quiesced uninstall purge, ctx propagation

- UpdateConfig is now failure-atomic for secret overwrites: storeConfigSecrets
  snapshots each vault entry before writing and returns a rollback that
  restores prior values (or deletes newly-created ones). A vault.Set failure
  mid-loop or a failed SetConfig commit rolls back, so a request reported as
  failed never changes the value a still-current config ref resolves to.
- Uninstall stops the plugin process BEFORE purging its vault namespace, so
  the plugin can no longer race the cleanup with a SetSecret between ListIDs
  and the deletes; the purge stays fail-closed and retryable.
- Thread the request context through Uninstall -> deletePluginSecrets instead
  of context.Background(), per the pass-context-through-chains convention.
- Consolidate the 'secret not found:' prefix check into isSecretNotFound
  (host.go + service rollback share one definition).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): detach rollback context, fail closed without a vault, reconcile uninstall status

- vault rollback closures now run on context.WithoutCancel(ctx): a request
  cancelled mid-save (browser closed) can no longer abort the rollback and
  leave the vault holding new values while the unchanged config still points
  at them (Greptile P1).
- storeConfigSecrets fails closed (errSecretVaultRequired) when a plugin
  declares secret config fields but no vault is wired, instead of silently
  persisting the secret in cleartext.
- vaultRestoreFunc distinguishes not-found from a genuine Reveal error: a
  backend read failure aborts the update before writing rather than risk a
  rollback that deletes a real secret; rollback now returns errors, joined
  into UpdateConfig's failure so an inconsistent vault is surfaced, not just
  logged.
- Uninstall reconciles lifecycle status when a secret-purge failure aborts
  after the process was stopped: a previously-running plugin transitions to
  error and notifies observers instead of being reported active with no
  process running.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): detach removed-secret cleanup ctx and clear stale save dirty flag

- cleanupRemovedConfigSecrets now runs on context.WithoutCancel(ctx), matching
  the rollback path, so a client disconnect right after the config commit can
  no longer cancel the delete and orphan now-unreferenced vault entries.
- tests: assert GetConfig succeeds before treating an empty map as proof that
  nothing persisted (a swallowed read error would be a false pass).
- web: on a post-save refetch failure, rebase initialValues onto the masked
  snapshot so the saved form no longer reads as dirty.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): fail tests on discarded GetConfig errors, drop setState-in-updater

- config_test: capture and fatal on GetConfig errors at the four remaining
  positive-assertion sites (a nil from a failed read would panic on the next
  map access instead of giving a clear failure), matching the earlier fix.
- web hook: compute the masked post-save snapshot from the current values and
  apply it to setValues + setInitialValues directly, instead of calling
  setInitialValues inside a setValues functional updater (a React anti-pattern
  that runs twice under StrictMode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(plugins): skip validation of a secret field's own vault ref

- validateConfigSchema takes the plugin id and skips a secret field whose
  value is that field's config vault ref (an internal storage marker,
  already validated when first set). Without this, a field declaring both
  secret: true and enum: [...] 400s on every save that keeps the mask,
  because the enum check saw the vault ref instead of a user value. Freshly
  entered secret values are still validated; a foreign plugin's ref is not
  skipped. Covered by unit + service-level regression tests.
- surface mid-loop vault rollback failures in storeConfigSecrets via a
  warning instead of discarding them (double-fault observability).
- web: integer inputs get step=1 so browsers flag non-integral input in
  place (serializeConfigValues remains the backstop).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(plugins): split config secret tests into config_secrets_test.go

config_test.go had grown past the 800-line backend file-length limit
(revive), failing CI lint. Move the vault-backed config and plugin-scoped
secret tests (plus their fake-vault/store helpers) into a sibling file;
no test logic changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-17 22:13:58 +01:00

186 lines
6.7 KiB
TypeScript

/**
* Turns a plugin manifest's `config_schema` (a JSON-Schema-like object the
* plugin author declares — see apps/backend/internal/plugins/config.go) into
* renderable form fields for the plugin settings page, and converts form
* values back into the config payload for PATCH /api/plugins/:id.
*
* Secret fields (`secret: true` or `format: "password"`, e.g. a GitHub PAT)
* come back from GET /api/plugins/:id/config as SECRET_MASK; submitting the
* mask unchanged tells the backend to keep the stored value.
*/
/** Mirror of the backend's configSecretMask (internal/plugins/config.go). */
export const SECRET_MASK = "********";
export type PluginConfigFieldType = "string" | "boolean" | "number" | "integer" | "enum";
export interface PluginConfigField {
name: string;
type: PluginConfigFieldType;
label: string;
description?: string;
required: boolean;
secret: boolean;
/** Display strings for the select control, parallel to enumRawValues. */
enumValues?: string[];
/** The schema's original typed enum values (numbers/booleans survive the
* round trip — the backend validates against these, not their string
* forms). */
enumRawValues?: unknown[];
defaultValue?: unknown;
}
type SchemaObject = Record<string, unknown>;
function asObject(value: unknown): SchemaObject | null {
return value && typeof value === "object" && !Array.isArray(value)
? (value as SchemaObject)
: null;
}
function fieldType(prop: SchemaObject): PluginConfigFieldType {
const enumValues = prop.enum;
if (Array.isArray(enumValues) && enumValues.length > 0) return "enum";
const type = prop.type;
if (type === "boolean" || type === "number" || type === "integer") return type;
return "string";
}
function isSecretProp(prop: SchemaObject): boolean {
return prop.secret === true || prop.format === "password";
}
function requiredNames(schema: SchemaObject): Set<string> {
const required = schema.required;
if (!Array.isArray(required)) return new Set();
return new Set(required.filter((name): name is string => typeof name === "string"));
}
/**
* Parses a config_schema into ordered form fields. Only declared
* `properties` become fields; richer schema constructs are ignored (the
* schema is authoring metadata, not a full JSON-Schema contract). Returns []
* for a missing or unusable schema — the settings page then shows the
* "no settings" state.
*/
export function parseConfigSchema(
schema: Record<string, unknown> | undefined,
): PluginConfigField[] {
const schemaObj = asObject(schema);
if (!schemaObj) return [];
const properties = asObject(schemaObj.properties);
if (!properties) return [];
const required = requiredNames(schemaObj);
const fields: PluginConfigField[] = [];
for (const [name, raw] of Object.entries(properties)) {
const prop = asObject(raw);
if (!prop) continue;
fields.push({
name,
type: fieldType(prop),
label: typeof prop.title === "string" && prop.title !== "" ? prop.title : name,
description: typeof prop.description === "string" ? prop.description : undefined,
required: required.has(name),
secret: isSecretProp(prop),
enumValues: Array.isArray(prop.enum) ? prop.enum.map((v) => String(v)) : undefined,
enumRawValues: Array.isArray(prop.enum) ? prop.enum : undefined,
defaultValue: prop.default,
});
}
return fields;
}
/**
* Builds the form's initial values from the (masked) stored config: stored
* value wins, then the schema default, then a type-appropriate empty value.
* Everything non-boolean is kept as a string for the input elements.
*/
export function buildInitialValues(
fields: PluginConfigField[],
config: Record<string, unknown>,
): Record<string, string | boolean> {
const values: Record<string, string | boolean> = {};
for (const field of fields) {
const stored = config[field.name] ?? field.defaultValue;
if (field.type === "boolean") {
values[field.name] = typeof stored === "boolean" ? stored : false;
} else {
values[field.name] = stored === undefined || stored === null ? "" : String(stored);
}
}
return values;
}
function coerceNumeric(field: PluginConfigField, raw: string): number | undefined {
// Never Number.parseInt here: it silently truncates "1.5" to 1, persisting
// a value the operator did not type. Reject non-integral input instead so
// the field is omitted and the required-field/backend validation surfaces
// the problem.
const parsed = Number(raw);
if (!Number.isFinite(parsed)) return undefined;
if (field.type === "integer" && !Number.isInteger(parsed)) return undefined;
return parsed;
}
/** Maps a select control's string back to the schema's original typed enum
* value, so numeric/boolean enums are submitted with their real types. */
function coerceEnum(field: PluginConfigField, raw: string): unknown {
const index = (field.enumValues ?? []).indexOf(raw);
if (index >= 0 && field.enumRawValues && index < field.enumRawValues.length) {
return field.enumRawValues[index];
}
return raw;
}
/**
* Converts form values back into the config object to PATCH. Empty string
* inputs are omitted (an unset optional field stays unset rather than
* persisting ""), booleans are always included, and numeric fields are
* parsed — an unparseable numeric input is omitted so the backend's schema
* validation reports the missing required field instead of a bogus value.
*/
export function serializeConfigValues(
fields: PluginConfigField[],
values: Record<string, string | boolean>,
): Record<string, unknown> {
const config: Record<string, unknown> = {};
for (const field of fields) {
const value = values[field.name];
if (field.type === "boolean") {
config[field.name] = value === true;
continue;
}
if (typeof value !== "string" || value === "") continue;
if (field.type === "number" || field.type === "integer") {
const parsed = coerceNumeric(field, value);
if (parsed !== undefined) config[field.name] = parsed;
continue;
}
if (field.type === "enum") {
config[field.name] = coerceEnum(field, value);
continue;
}
config[field.name] = value;
}
return config;
}
/**
* Client-side pre-validation matching the backend's required-field check, so
* the form can flag missing values before a round-trip. A secret field
* showing the mask counts as set (the backend keeps the stored value).
*/
export function missingRequiredFields(
fields: PluginConfigField[],
values: Record<string, string | boolean>,
): string[] {
return fields
.filter((field) => field.required && field.type !== "boolean")
.filter((field) => {
const value = values[field.name];
return typeof value !== "string" || value.trim() === "";
})
.map((field) => field.label);
}