fae2303db3
* feat(plugins): per-plugin settings pages driven by manifest config_schema Settings > Plugins rows now open /settings/plugins/:id — a detail page showing the manifest plus a settings form generated from the plugin author's config_schema. Secret fields (secret: true / format: password) are masked on the operator API and kept on masked re-submits; a running plugin restarts on save and reads its config (cleartext secrets included) through the new Host GetConfig gRPC RPC. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): write plugin config file owner-only (0600) Operator config can now carry cleartext secret values (config_schema fields marked secret), so <id>.config.yml must not be world-readable — match the 0600 mode the record file already uses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(plugins): vault-backed plugin secrets — Get/Set/DeleteSecret RPCs and encrypted config secrets Plugins get vault-backed secret primitives on the Host API (GetSecret/SetSecret/DeleteSecret, capability-gated, namespaced to plugin:<id>㊙️<key> so a plugin can only touch its own entries; purged on uninstall). Secret config_schema fields now live in kandev's AES-256-GCM vault too — <id>.config.yml persists only a vault reference, and the Host GetConfig RPC resolves it back to cleartext for the plugin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(plugins): serve PR screenshots from the media/pr-1761-screenshots ref instead of the repo The PR body now points at raw URLs pinned to an unmerged media ref, so the binaries never land in main (PRs are squash-merged; only the branch tip tree merges). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): address review feedback on settings validation and save flow - integer form fields reject non-integral input instead of parseInt-truncating - enum selections keep their schema-declared types (numeric enums round-trip) - backend enum validation normalizes int-vs-float64 before comparison - maskSecrets masks any non-zero secret value regardless of runtime type - save flow splits PATCH from refetch: a refetch failure no longer reports a successful save as an error, and typed secrets are masked on screen - optional enum fields gain a 'Not set' option so they can be cleared - resolveConfigSecrets copies before mutating; restart-failure SetStatus errors are logged; SDK test fake returns a non-nil empty config map - add missing tests: usePluginConfigForm hook, getPluginConfig client, integer/enum regression cases Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): harden secret config invariants from review - reject non-string values on declared secret fields at validation time, closing the path where a numeric/boolean secret bypassed the vault and persisted cleartext in the config file - delete removed secret fields' vault entries only AFTER the config commit succeeds, so a failed SetConfig never leaves the still-current config referencing a deleted vault entry - uninstall fails closed: the plugin's vault namespace is purged before any destructive step, and a cleanup failure aborts the uninstall (retryable) instead of letting a reinstall inherit stale secrets Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): failure-atomic config secrets, quiesced uninstall purge, ctx propagation - UpdateConfig is now failure-atomic for secret overwrites: storeConfigSecrets snapshots each vault entry before writing and returns a rollback that restores prior values (or deletes newly-created ones). A vault.Set failure mid-loop or a failed SetConfig commit rolls back, so a request reported as failed never changes the value a still-current config ref resolves to. - Uninstall stops the plugin process BEFORE purging its vault namespace, so the plugin can no longer race the cleanup with a SetSecret between ListIDs and the deletes; the purge stays fail-closed and retryable. - Thread the request context through Uninstall -> deletePluginSecrets instead of context.Background(), per the pass-context-through-chains convention. - Consolidate the 'secret not found:' prefix check into isSecretNotFound (host.go + service rollback share one definition). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): detach rollback context, fail closed without a vault, reconcile uninstall status - vault rollback closures now run on context.WithoutCancel(ctx): a request cancelled mid-save (browser closed) can no longer abort the rollback and leave the vault holding new values while the unchanged config still points at them (Greptile P1). - storeConfigSecrets fails closed (errSecretVaultRequired) when a plugin declares secret config fields but no vault is wired, instead of silently persisting the secret in cleartext. - vaultRestoreFunc distinguishes not-found from a genuine Reveal error: a backend read failure aborts the update before writing rather than risk a rollback that deletes a real secret; rollback now returns errors, joined into UpdateConfig's failure so an inconsistent vault is surfaced, not just logged. - Uninstall reconciles lifecycle status when a secret-purge failure aborts after the process was stopped: a previously-running plugin transitions to error and notifies observers instead of being reported active with no process running. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): detach removed-secret cleanup ctx and clear stale save dirty flag - cleanupRemovedConfigSecrets now runs on context.WithoutCancel(ctx), matching the rollback path, so a client disconnect right after the config commit can no longer cancel the delete and orphan now-unreferenced vault entries. - tests: assert GetConfig succeeds before treating an empty map as proof that nothing persisted (a swallowed read error would be a false pass). - web: on a post-save refetch failure, rebase initialValues onto the masked snapshot so the saved form no longer reads as dirty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): fail tests on discarded GetConfig errors, drop setState-in-updater - config_test: capture and fatal on GetConfig errors at the four remaining positive-assertion sites (a nil from a failed read would panic on the next map access instead of giving a clear failure), matching the earlier fix. - web hook: compute the masked post-save snapshot from the current values and apply it to setValues + setInitialValues directly, instead of calling setInitialValues inside a setValues functional updater (a React anti-pattern that runs twice under StrictMode). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): skip validation of a secret field's own vault ref - validateConfigSchema takes the plugin id and skips a secret field whose value is that field's config vault ref (an internal storage marker, already validated when first set). Without this, a field declaring both secret: true and enum: [...] 400s on every save that keeps the mask, because the enum check saw the vault ref instead of a user value. Freshly entered secret values are still validated; a foreign plugin's ref is not skipped. Covered by unit + service-level regression tests. - surface mid-loop vault rollback failures in storeConfigSecrets via a warning instead of discarding them (double-fault observability). - web: integer inputs get step=1 so browsers flag non-integral input in place (serializeConfigValues remains the backstop). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(plugins): split config secret tests into config_secrets_test.go config_test.go had grown past the 800-line backend file-length limit (revive), failing CI lint. Move the vault-backed config and plugin-scoped secret tests (plus their fake-vault/store helpers) into a sibling file; no test logic changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
140 lines
4.8 KiB
TypeScript
140 lines
4.8 KiB
TypeScript
"use client";
|
|
|
|
import { useEffect, useMemo, useState } from "react";
|
|
import { toast } from "sonner";
|
|
import { getPluginConfig, updatePluginConfig } from "@/lib/api/domains/plugins-api";
|
|
import {
|
|
SECRET_MASK,
|
|
buildInitialValues,
|
|
missingRequiredFields,
|
|
parseConfigSchema,
|
|
serializeConfigValues,
|
|
} from "@/lib/plugins/config-schema";
|
|
import type { PluginRecord } from "@/lib/types/plugins";
|
|
|
|
type SaveStatus = "idle" | "loading" | "success" | "error";
|
|
type FormValues = Record<string, string | boolean>;
|
|
|
|
/**
|
|
* Load/edit/save state for one plugin's schema-driven settings form.
|
|
* Mirrors use-plugin-actions' local-hook pattern: fetch + toast wiring lives
|
|
* here, the components stay presentational. Saving PATCHes the full config
|
|
* (secret fields carrying the mask keep their stored value server-side) and
|
|
* then re-fetches the masked config so the form reflects what is stored.
|
|
*/
|
|
export function usePluginConfigForm(plugin: PluginRecord | null) {
|
|
const fields = useMemo(() => parseConfigSchema(plugin?.config_schema), [plugin?.config_schema]);
|
|
const [values, setValues] = useState<FormValues>({});
|
|
const [initialValues, setInitialValues] = useState<FormValues>({});
|
|
const [configLoading, setConfigLoading] = useState(false);
|
|
const [configError, setConfigError] = useState<string | null>(null);
|
|
const [saveStatus, setSaveStatus] = useState<SaveStatus>("idle");
|
|
|
|
const pluginId = plugin?.id ?? null;
|
|
const hasFields = fields.length > 0;
|
|
|
|
useEffect(() => {
|
|
if (!pluginId || !hasFields) return;
|
|
let cancelled = false;
|
|
setConfigLoading(true);
|
|
setConfigError(null);
|
|
getPluginConfig(pluginId, { cache: "no-store" })
|
|
.then((config) => {
|
|
if (cancelled) return;
|
|
const initial = buildInitialValues(fields, config);
|
|
setValues(initial);
|
|
setInitialValues(initial);
|
|
})
|
|
.catch((err) => {
|
|
if (!cancelled) {
|
|
setConfigError(err instanceof Error ? err.message : "Failed to load plugin settings");
|
|
}
|
|
})
|
|
.finally(() => {
|
|
if (!cancelled) setConfigLoading(false);
|
|
});
|
|
return () => {
|
|
cancelled = true;
|
|
};
|
|
// fields is derived solely from plugin.config_schema; pluginId is the
|
|
// real reload trigger.
|
|
// eslint-disable-next-line react-hooks/exhaustive-deps
|
|
}, [pluginId, hasFields]);
|
|
|
|
const isDirty = useMemo(
|
|
() => fields.some((field) => values[field.name] !== initialValues[field.name]),
|
|
[fields, values, initialValues],
|
|
);
|
|
|
|
const handleChange = (name: string, value: string | boolean) => {
|
|
setValues((prev) => ({ ...prev, [name]: value }));
|
|
setSaveStatus("idle");
|
|
};
|
|
|
|
const handleSave = async () => {
|
|
if (!pluginId) return;
|
|
const missing = missingRequiredFields(fields, values);
|
|
if (missing.length > 0) {
|
|
toast.error(`Required: ${missing.join(", ")}`);
|
|
return;
|
|
}
|
|
setSaveStatus("loading");
|
|
try {
|
|
await updatePluginConfig(pluginId, serializeConfigValues(fields, values));
|
|
} catch (err) {
|
|
setSaveStatus("error");
|
|
toast.error(err instanceof Error ? err.message : "Failed to save plugin settings");
|
|
return;
|
|
}
|
|
// The config IS persisted from here on — a refetch failure (e.g. a
|
|
// transient hiccup while the plugin restarts) must not be reported as a
|
|
// save failure, and the typed cleartext secret must not stay on screen.
|
|
try {
|
|
const refreshed = await getPluginConfig(pluginId, { cache: "no-store" });
|
|
const initial = buildInitialValues(fields, refreshed);
|
|
setValues(initial);
|
|
setInitialValues(initial);
|
|
toast.success("Plugin settings saved");
|
|
} catch {
|
|
maskSecretValues();
|
|
toast.warning("Settings saved, but reloading them failed — refresh to confirm.");
|
|
}
|
|
setSaveStatus("success");
|
|
};
|
|
|
|
// On a post-save refetch failure, replace any typed secret input with the
|
|
// mask (so cleartext never lingers) and rebase initialValues onto the
|
|
// masked snapshot — the config IS saved, so the masked form is the new
|
|
// baseline and must not read as dirty (e.g. a previously-unset secret the
|
|
// user just entered). Computed from the current `values` and applied to
|
|
// both state setters directly, rather than as a side effect inside a
|
|
// functional updater (which would run twice under StrictMode).
|
|
const maskSecretValues = () => {
|
|
const masked = maskSecretsIn(values);
|
|
setValues(masked);
|
|
setInitialValues(masked);
|
|
};
|
|
|
|
const maskSecretsIn = (source: FormValues): FormValues => {
|
|
const masked = { ...source };
|
|
for (const field of fields) {
|
|
const current = masked[field.name];
|
|
if (field.secret && typeof current === "string" && current !== "") {
|
|
masked[field.name] = SECRET_MASK;
|
|
}
|
|
}
|
|
return masked;
|
|
};
|
|
|
|
return {
|
|
fields,
|
|
values,
|
|
configLoading,
|
|
configError,
|
|
saveStatus,
|
|
isDirty,
|
|
handleChange,
|
|
handleSave,
|
|
};
|
|
}
|