fae2303db3
* feat(plugins): per-plugin settings pages driven by manifest config_schema Settings > Plugins rows now open /settings/plugins/:id — a detail page showing the manifest plus a settings form generated from the plugin author's config_schema. Secret fields (secret: true / format: password) are masked on the operator API and kept on masked re-submits; a running plugin restarts on save and reads its config (cleartext secrets included) through the new Host GetConfig gRPC RPC. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): write plugin config file owner-only (0600) Operator config can now carry cleartext secret values (config_schema fields marked secret), so <id>.config.yml must not be world-readable — match the 0600 mode the record file already uses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(plugins): vault-backed plugin secrets — Get/Set/DeleteSecret RPCs and encrypted config secrets Plugins get vault-backed secret primitives on the Host API (GetSecret/SetSecret/DeleteSecret, capability-gated, namespaced to plugin:<id>㊙️<key> so a plugin can only touch its own entries; purged on uninstall). Secret config_schema fields now live in kandev's AES-256-GCM vault too — <id>.config.yml persists only a vault reference, and the Host GetConfig RPC resolves it back to cleartext for the plugin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(plugins): serve PR screenshots from the media/pr-1761-screenshots ref instead of the repo The PR body now points at raw URLs pinned to an unmerged media ref, so the binaries never land in main (PRs are squash-merged; only the branch tip tree merges). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): address review feedback on settings validation and save flow - integer form fields reject non-integral input instead of parseInt-truncating - enum selections keep their schema-declared types (numeric enums round-trip) - backend enum validation normalizes int-vs-float64 before comparison - maskSecrets masks any non-zero secret value regardless of runtime type - save flow splits PATCH from refetch: a refetch failure no longer reports a successful save as an error, and typed secrets are masked on screen - optional enum fields gain a 'Not set' option so they can be cleared - resolveConfigSecrets copies before mutating; restart-failure SetStatus errors are logged; SDK test fake returns a non-nil empty config map - add missing tests: usePluginConfigForm hook, getPluginConfig client, integer/enum regression cases Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): harden secret config invariants from review - reject non-string values on declared secret fields at validation time, closing the path where a numeric/boolean secret bypassed the vault and persisted cleartext in the config file - delete removed secret fields' vault entries only AFTER the config commit succeeds, so a failed SetConfig never leaves the still-current config referencing a deleted vault entry - uninstall fails closed: the plugin's vault namespace is purged before any destructive step, and a cleanup failure aborts the uninstall (retryable) instead of letting a reinstall inherit stale secrets Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): failure-atomic config secrets, quiesced uninstall purge, ctx propagation - UpdateConfig is now failure-atomic for secret overwrites: storeConfigSecrets snapshots each vault entry before writing and returns a rollback that restores prior values (or deletes newly-created ones). A vault.Set failure mid-loop or a failed SetConfig commit rolls back, so a request reported as failed never changes the value a still-current config ref resolves to. - Uninstall stops the plugin process BEFORE purging its vault namespace, so the plugin can no longer race the cleanup with a SetSecret between ListIDs and the deletes; the purge stays fail-closed and retryable. - Thread the request context through Uninstall -> deletePluginSecrets instead of context.Background(), per the pass-context-through-chains convention. - Consolidate the 'secret not found:' prefix check into isSecretNotFound (host.go + service rollback share one definition). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): detach rollback context, fail closed without a vault, reconcile uninstall status - vault rollback closures now run on context.WithoutCancel(ctx): a request cancelled mid-save (browser closed) can no longer abort the rollback and leave the vault holding new values while the unchanged config still points at them (Greptile P1). - storeConfigSecrets fails closed (errSecretVaultRequired) when a plugin declares secret config fields but no vault is wired, instead of silently persisting the secret in cleartext. - vaultRestoreFunc distinguishes not-found from a genuine Reveal error: a backend read failure aborts the update before writing rather than risk a rollback that deletes a real secret; rollback now returns errors, joined into UpdateConfig's failure so an inconsistent vault is surfaced, not just logged. - Uninstall reconciles lifecycle status when a secret-purge failure aborts after the process was stopped: a previously-running plugin transitions to error and notifies observers instead of being reported active with no process running. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): detach removed-secret cleanup ctx and clear stale save dirty flag - cleanupRemovedConfigSecrets now runs on context.WithoutCancel(ctx), matching the rollback path, so a client disconnect right after the config commit can no longer cancel the delete and orphan now-unreferenced vault entries. - tests: assert GetConfig succeeds before treating an empty map as proof that nothing persisted (a swallowed read error would be a false pass). - web: on a post-save refetch failure, rebase initialValues onto the masked snapshot so the saved form no longer reads as dirty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): fail tests on discarded GetConfig errors, drop setState-in-updater - config_test: capture and fatal on GetConfig errors at the four remaining positive-assertion sites (a nil from a failed read would panic on the next map access instead of giving a clear failure), matching the earlier fix. - web hook: compute the masked post-save snapshot from the current values and apply it to setValues + setInitialValues directly, instead of calling setInitialValues inside a setValues functional updater (a React anti-pattern that runs twice under StrictMode). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): skip validation of a secret field's own vault ref - validateConfigSchema takes the plugin id and skips a secret field whose value is that field's config vault ref (an internal storage marker, already validated when first set). Without this, a field declaring both secret: true and enum: [...] 400s on every save that keeps the mask, because the enum check saw the vault ref instead of a user value. Freshly entered secret values are still validated; a foreign plugin's ref is not skipped. Covered by unit + service-level regression tests. - surface mid-loop vault rollback failures in storeConfigSecrets via a warning instead of discarding them (double-fault observability). - web: integer inputs get step=1 so browsers flag non-integral input in place (serializeConfigValues remains the backstop). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(plugins): split config secret tests into config_secrets_test.go config_test.go had grown past the 800-line backend file-length limit (revive), failing CI lint. Move the vault-backed config and plugin-scoped secret tests (plus their fake-vault/store helpers) into a sibling file; no test logic changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
144 lines
4.4 KiB
TypeScript
144 lines
4.4 KiB
TypeScript
"use client";
|
|
|
|
import { Input } from "@kandev/ui/input";
|
|
import { Label } from "@kandev/ui/label";
|
|
import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@kandev/ui/select";
|
|
import { Switch } from "@kandev/ui/switch";
|
|
import type { PluginConfigField } from "@/lib/plugins/config-schema";
|
|
|
|
/** Sentinel for the "Not set" select item — an actual enum option can never
|
|
* collide with it, and Radix rejects value="" items. */
|
|
const ENUM_UNSET_SENTINEL = "__kandev_enum_unset__";
|
|
|
|
type PluginConfigFormProps = {
|
|
fields: PluginConfigField[];
|
|
values: Record<string, string | boolean>;
|
|
disabled: boolean;
|
|
onChange: (name: string, value: string | boolean) => void;
|
|
};
|
|
|
|
/**
|
|
* Schema-driven settings form: one control per config_schema property.
|
|
* Secret fields render as password inputs pre-filled with the backend's
|
|
* mask; editing replaces the value, leaving it untouched keeps the stored
|
|
* secret. Purely controlled — load/save/dirty state lives in PluginDetail.
|
|
*/
|
|
export function PluginConfigForm({ fields, values, disabled, onChange }: PluginConfigFormProps) {
|
|
return (
|
|
<div className="space-y-5">
|
|
{fields.map((field) => (
|
|
<ConfigFieldRow
|
|
key={field.name}
|
|
field={field}
|
|
value={values[field.name] ?? ""}
|
|
disabled={disabled}
|
|
onChange={onChange}
|
|
/>
|
|
))}
|
|
</div>
|
|
);
|
|
}
|
|
|
|
type ConfigFieldRowProps = {
|
|
field: PluginConfigField;
|
|
value: string | boolean;
|
|
disabled: boolean;
|
|
onChange: (name: string, value: string | boolean) => void;
|
|
};
|
|
|
|
function ConfigFieldRow({ field, value, disabled, onChange }: ConfigFieldRowProps) {
|
|
const inputId = `plugin-config-${field.name}`;
|
|
return (
|
|
<div className="space-y-1.5" data-testid={`plugin-config-field-${field.name}`}>
|
|
<Label htmlFor={inputId} className="text-sm">
|
|
{field.label}
|
|
{field.required && <span className="text-destructive"> *</span>}
|
|
</Label>
|
|
<ConfigFieldControl
|
|
field={field}
|
|
inputId={inputId}
|
|
value={value}
|
|
disabled={disabled}
|
|
onChange={onChange}
|
|
/>
|
|
{field.description && <p className="text-xs text-muted-foreground">{field.description}</p>}
|
|
</div>
|
|
);
|
|
}
|
|
|
|
type ConfigFieldControlProps = ConfigFieldRowProps & { inputId: string };
|
|
|
|
function ConfigFieldControl({
|
|
field,
|
|
inputId,
|
|
value,
|
|
disabled,
|
|
onChange,
|
|
}: ConfigFieldControlProps) {
|
|
if (field.type === "boolean") {
|
|
return (
|
|
<div>
|
|
<Switch
|
|
id={inputId}
|
|
checked={value === true}
|
|
disabled={disabled}
|
|
onCheckedChange={(checked) => onChange(field.name, checked)}
|
|
/>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
if (field.type === "enum") {
|
|
// Radix Select forbids an item with value="", so an explicit "Not set"
|
|
// sentinel lets optional enums be cleared back to unset (serialization
|
|
// omits empty strings).
|
|
return (
|
|
<Select
|
|
value={typeof value === "string" ? value : ""}
|
|
disabled={disabled}
|
|
onValueChange={(next) => onChange(field.name, next === ENUM_UNSET_SENTINEL ? "" : next)}
|
|
>
|
|
<SelectTrigger id={inputId} className="max-w-md cursor-pointer">
|
|
<SelectValue placeholder="Select..." />
|
|
</SelectTrigger>
|
|
<SelectContent>
|
|
{!field.required && (
|
|
<SelectItem
|
|
value={ENUM_UNSET_SENTINEL}
|
|
className="cursor-pointer text-muted-foreground"
|
|
>
|
|
Not set
|
|
</SelectItem>
|
|
)}
|
|
{(field.enumValues ?? []).map((option) => (
|
|
<SelectItem key={option} value={option} className="cursor-pointer">
|
|
{option}
|
|
</SelectItem>
|
|
))}
|
|
</SelectContent>
|
|
</Select>
|
|
);
|
|
}
|
|
|
|
return (
|
|
<Input
|
|
id={inputId}
|
|
type={inputType(field)}
|
|
// step="1" on integer fields nudges the browser to flag non-integral
|
|
// input in-place; serializeConfigValues still rejects it as a backstop.
|
|
step={!field.secret && field.type === "integer" ? "1" : undefined}
|
|
value={typeof value === "string" ? value : ""}
|
|
disabled={disabled}
|
|
autoComplete={field.secret ? "off" : undefined}
|
|
className="max-w-md"
|
|
onChange={(event) => onChange(field.name, event.target.value)}
|
|
/>
|
|
);
|
|
}
|
|
|
|
function inputType(field: PluginConfigField): string {
|
|
if (field.secret) return "password";
|
|
if (field.type === "number" || field.type === "integer") return "number";
|
|
return "text";
|
|
}
|