[wip] Add global extensions

abe51682c8010443ea9e92b31b25c29c8cee52cb

Cohee <18619528+Cohee1207@users.noreply.github.com>

Parents: bea991b665963db5235d5978024bf8eee3cede95

public/css/extensions-panel.css+1 -1 Viewed

 .extensions_info .extension_block {
     display: flex;
     flex-wrap: wrap;
-    padding: 10px;
+    padding: 5px 10px;
     margin-bottom: 5px;
     border: 1px solid var(--SmartThemeBorderColor);
     border-radius: 10px;

public/scripts/extensions.js+73 -10 Viewed

 import { renderTemplate, renderTemplateAsync } from './templates.js';
 import { isSubsetOf, setValueByPath } from './utils.js';
 import { getContext } from './st-context.js';
+import { isAdmin } from './user.js';
+import { t } from './i18n.js';
 export {
     getContext,
     getApiUrl,

 /** @type {string[]} */
 export let extensionNames = [];
+/** @type {Record<string, string>} */
+export let extensionTypes = {};
 let manifests = {};
 const defaultUrl = 'http://localhost:5100';

     return response;
+}
+/**
+ * Discovers extensions from the API.
+ * @returns {Promise<{name: string, type: string}[]>}
+ */
 async function discoverExtensions() {
     try {
         const response = await fetch('/api/extensions/discover');

  * If the extension is not up to date, it updates the extension and displays a success message with the new commit hash.
  */
 async function onUpdateClick() {
+    const isCurrentUserAdmin = isAdmin();
     const extensionName = $(this).data('name');
+    const isGlobal = extensionTypes[extensionName] === 'global';
+    if (isGlobal && !isCurrentUserAdmin) {
+        toastr.error(t`You don't have permission to update global extensions.`);
+        return;
+    }
     $(this).find('i').addClass('fa-spin');
     await updateExtension(extensionName, false);
+}

         const response = await fetch('/api/extensions/update', {
             method: 'POST',
             headers: getRequestHeaders(),
-            body: JSON.stringify({ extensionName }),
+            body: JSON.stringify({
+                extensionName,
+                global: extensionTypes[extensionName] === 'global',
+            }),
         });
         const data = await response.json();

  */
 async function onDeleteClick() {
     const extensionName = $(this).data('name');
+    const isCurrentUserAdmin = isAdmin();
+    const isGlobal = extensionTypes[extensionName] === 'global';
+    if (isGlobal && !isCurrentUserAdmin) {
+        toastr.error(t`You don't have permission to delete global extensions.`);
+        return;
+    }
     // use callPopup to create a popup for the user to confirm before delete
     const confirmation = await callGenericPopup(`Are you sure you want to delete ${extensionName}?`, POPUP_TYPE.CONFIRM, '', {});
     if (confirmation === POPUP_RESULT.AFFIRMATIVE) {

+    }
+}
+/**
+ * Deletes an extension via the API.
+ * @param {string} extensionName Extension name to delete
+ */
 export async function deleteExtension(extensionName) {
     try {
         await fetch('/api/extensions/delete', {
             method: 'POST',
             headers: getRequestHeaders(),
-            body: JSON.stringify({ extensionName }),
+            body: JSON.stringify({
+                extensionName,
+                global: extensionTypes[extensionName] === 'global',
+            }),
         });
     } catch (error) {
         console.error('Error:', error);

 /**
  * Installs a third-party extension via the API.
  * @param {string} url Extension repository URL
+ * @param {boolean} global Is the extension global?
  * @returns {Promise<void>}
  */
-export async function installExtension(url) {
+export async function installExtension(url, global) {
     console.debug('Extension installation started', url);
     toastr.info('Please wait...', 'Installing extension');

     const request = await fetch('/api/extensions/install', {
         method: 'POST',
         headers: getRequestHeaders(),
-        body: JSON.stringify({ url }),
+        body: JSON.stringify({
+            url,
+            global,
+        }),
     });
     if (!request.ok) {

     // Activate offline extensions
     await eventSource.emit(event_types.EXTENSIONS_FIRST_LOAD);
-    extensionNames = await discoverExtensions();
+    const extensions = await discoverExtensions();
+    extensionNames = extensions.map(x => x.name);
+    extensionTypes = Object.fromEntries(extensions.map(x => [x.name, x.type]));
     manifests = await getManifests(extensionNames);
     if (versionChanged && enableAutoUpdate) {

         localStorage.setItem(STORAGE_NAG_KEY, currentDate);
+    }
+    const isCurrentUserAdmin = isAdmin();
     const updatesAvailable = [];
     const promises = [];
     for (const [id, manifest] of Object.entries(manifests)) {
+        const isGlobal = extensionTypes[id] === 'global';
+        if (isGlobal && !isCurrentUserAdmin) {
+            console.debug(`Skipping global extension: ${manifest.display_name} (${id}) for non-admin user`);
+            continue;
+        }
         if (manifest.auto_update && id.startsWith('third-party')) {
             const promise = new Promise(async (resolve, reject) => {
                 try {

+    }
     const banner = toastr.info('Auto-updating extensions. This may take several minutes.', 'Please wait...', { timeOut: 10000, extendedTimeOut: 10000 });
+    const isCurrentUserAdmin = isAdmin();
     const promises = [];
     for (const [id, manifest] of Object.entries(manifests)) {
+        const isGlobal = extensionTypes[id] === 'global';
+        if (isGlobal && !isCurrentUserAdmin) {
+            console.debug(`Skipping global extension: ${manifest.display_name} (${id}) for non-admin user`);
+            continue;
+        }
         if ((forceAll || manifest.auto_update) && id.startsWith('third-party')) {
             console.debug(`Auto-updating 3rd-party extension: ${manifest.display_name} (${id})`);
             promises.push(updateExtension(id.replace('third-party', ''), true));

  * @returns {Promise<void>}
  */
 export async function openThirdPartyExtensionMenu(suggestUrl = '') {
-    const html = await renderTemplateAsync('installExtension');
+    const isCurrentUserAdmin = isAdmin();
-    const input = await callGenericPopup(html, POPUP_TYPE.INPUT, suggestUrl ?? '');
+    const html = await renderTemplateAsync('installExtension', { isCurrentUserAdmin });
+    const okButton = isCurrentUserAdmin ? t`Install just for me` : t`Install`;
+    let global = false;
+    const installForAllButton = {
+        text: t`Install for all`,
+        appendAtEnd: false,
+        action: async () => {
+            global = true;
+            await popup.complete(POPUP_RESULT.AFFIRMATIVE);
+        },
+    };
+    const customButtons = isCurrentUserAdmin ? [installForAllButton] : [];
+    const popup = new Popup(html, POPUP_TYPE.INPUT, suggestUrl ?? '', { okButton, customButtons });
+    const input = await popup.show();
     if (!input) {
         console.debug('Extension install cancelled');

@@ -1077,11 +1142,9 @@ export async function openThirdPartyExtensionMenu(suggestUrl = '') {
1077	}	1142	}
1078		1143
1079	const url = String(input).trim();	1144	const url = String(input).trim();
1080	await installExtension(url);	1145	await installExtension(url, global);
1081	}	1146	}
1082		1147
1083
1084
1085	export async function initExtensions() {	1148	export async function initExtensions() {
1086	await addExtensionsButtonAndMenu();	1149	await addExtensionsButtonAndMenu();
1087	$('#extensionsMenuButton').css('display', 'flex');	1150	$('#extensionsMenuButton').css('display', 'flex');

public/scripts/extensions/third-party/.gitkeep+0 -0 Viewed

public/scripts/user.js+1 -1 Viewed

  * Check if the current user is an admin.
  * @returns {boolean} True if the current user is an admin
  */
-function isAdmin() {
+export function isAdmin() {
     if (!currentUser) {
         return false;
+    }

src/constants.js+1 -0 Viewed

     backups: 'backups/',
     sounds: 'public/sounds',
     extensions: 'public/scripts/extensions',
+    globalExtensions: 'public/scripts/extensions/third-party',
 };
 export const SETTINGS_FILE = 'settings.json';

src/endpoints/extensions.js+56 -28 Viewed

             fs.mkdirSync(path.join(request.user.directories.extensions));
+        }
-        const url = request.body.url;
+        if (!fs.existsSync(PUBLIC_DIRECTORIES.globalExtensions)) {
-        const extensionPath = path.join(request.user.directories.extensions, path.basename(url, '.git'));
+            fs.mkdirSync(PUBLIC_DIRECTORIES.globalExtensions);
+        }
+        const { url, global } = request.body;
+        if (global && !request.user.profile.admin) {
+            return response.status(403).send('Forbidden: No permission to install global extensions.');
+        }
+        const basePath = global ? PUBLIC_DIRECTORIES.globalExtensions : request.user.directories.extensions;
+        const extensionPath = path.join(basePath, sanitize(path.basename(url, '.git')));
         if (fs.existsSync(extensionPath)) {
             return response.status(409).send(`Directory already exists at ${extensionPath}`);

         await git.clone(url, extensionPath, { '--depth': 1 });
         console.log(`Extension has been cloned at ${extensionPath}`);
         const { version, author, display_name } = await getManifest(extensionPath);
         return response.send({ version, author, display_name, extensionPath });
     } catch (error) {
         console.log('Importing custom content failed', error);

+    }
     try {
-        const extensionName = request.body.extensionName;
+        const { extensionName, global } = request.body;
-        const extensionPath = path.join(request.user.directories.extensions, extensionName);
+        if (global && !request.user.profile.admin) {
+            return response.status(403).send('Forbidden: No permission to update global extensions.');
+        }
+        const basePath = global ? PUBLIC_DIRECTORIES.globalExtensions : request.user.directories.extensions;
+        const extensionPath = path.join(basePath, extensionName);
         if (!fs.existsSync(extensionPath)) {
             return response.status(404).send(`Directory does not exist at ${extensionPath}`);

         const { isUpToDate, remoteUrl } = await checkIfRepoIsUpToDate(extensionPath);
         const currentBranch = await git.cwd(extensionPath).branch();
         if (!isUpToDate) {
             await git.cwd(extensionPath).pull('origin', currentBranch.current);
             console.log(`Extension has been updated at ${extensionPath}`);
         } else {

+    }
     try {
-        const extensionName = request.body.extensionName;
+        const { extensionName, global } = request.body;
-        const extensionPath = path.join(request.user.directories.extensions, extensionName);
+        const basePath = global ? PUBLIC_DIRECTORIES.globalExtensions : request.user.directories.extensions;
+        const extensionPath = path.join(basePath, sanitize(extensionName));
         if (!fs.existsSync(extensionPath)) {
             return response.status(404).send(`Directory does not exist at ${extensionPath}`);

         return response.status(400).send('Bad Request: extensionName is required in the request body.');
+    }
-    // Sanitize the extension name to prevent directory traversal
-    const extensionName = sanitize(request.body.extensionName);
     try {
-        const extensionPath = path.join(request.user.directories.extensions, extensionName);
+        const { extensionName, global } = request.body;
+        if (global && !request.user.profile.admin) {
+            return response.status(403).send('Forbidden: No permission to delete global extensions.');
+        }
+        const basePath = global ? PUBLIC_DIRECTORIES.globalExtensions : request.user.directories.extensions;
+        const extensionPath = path.join(basePath, sanitize(extensionName));
         if (!fs.existsSync(extensionPath)) {
             return response.status(404).send(`Directory does not exist at ${extensionPath}`);

  * If the folder is called third-party, search for subfolders instead
  */
 router.get('/discover', jsonParser, function (request, response) {
-    // get all folders in the extensions folder, except third-party
+    if (!fs.existsSync(path.join(request.user.directories.extensions))) {
-    const extensions = fs
+        fs.mkdirSync(path.join(request.user.directories.extensions));
+    }
+    if (!fs.existsSync(PUBLIC_DIRECTORIES.globalExtensions)) {
+        fs.mkdirSync(PUBLIC_DIRECTORIES.globalExtensions);
+    }
+    // Get all folders in system extensions folder, excluding third-party
+    const buildInExtensions = fs
         .readdirSync(PUBLIC_DIRECTORIES.extensions)
         .filter(f => fs.statSync(path.join(PUBLIC_DIRECTORIES.extensions, f)).isDirectory())
-        .filter(f => f !== 'third-party');
+        .filter(f => f !== 'third-party')
+        .map(f => ({ type: 'system', name: f }));
-    // get all folders in the third-party folder, if it exists
-    if (!fs.existsSync(path.join(request.user.directories.extensions))) {
+    // Get all folders in global extensions folder
-        return response.send(extensions);
+    const globalExtensions = fs
-    }
+        .readdirSync(PUBLIC_DIRECTORIES.globalExtensions)
+        .filter(f => fs.statSync(path.join(PUBLIC_DIRECTORIES.globalExtensions, f)).isDirectory())
+        .map(f => ({ type: 'global', name: `third-party/${f}` }));
-    const thirdPartyExtensions = fs
+    // Get all folders in local extensions folder
+    const userExtensions = fs
         .readdirSync(path.join(request.user.directories.extensions))
-        .filter(f => fs.statSync(path.join(request.user.directories.extensions, f)).isDirectory());
+        .filter(f => fs.statSync(path.join(request.user.directories.extensions, f)).isDirectory())
+        .map(f => ({ type: 'local', name: `third-party/${f}` }));
-    // add the third-party extensions to the extensions array
-    extensions.push(...thirdPartyExtensions.map(f => `third-party/${f}`));
-    console.log(extensions);
+    // Combine all extensions
+    const allExtensions = Array.from(new Set([...buildInExtensions, ...globalExtensions, ...userExtensions]));
+    console.log(allExtensions);
-    return response.send(extensions);
+    return response.send(allExtensions);
 });

src/users.js+29 -1 Viewed

+}
 /**
+ * Creates a route handler for serving extensions.
+ * @param {(req: import('express').Request) => string} directoryFn A function that returns the directory path to serve files from
+ * @returns {import('express').RequestHandler}
+ */
+function createExtensionsRouteHandler(directoryFn) {
+    return async (req, res) => {
+        try {
+            const directory = directoryFn(req);
+            const filePath = decodeURIComponent(req.params[0]);
+            const existsLocal = fs.existsSync(path.join(directory, filePath));
+            if (existsLocal) {
+                return res.sendFile(filePath, { root: directory });
+            }
+            const existsGlobal = fs.existsSync(path.join(PUBLIC_DIRECTORIES.globalExtensions, filePath));
+            if (existsGlobal) {
+                return res.sendFile(filePath, { root: PUBLIC_DIRECTORIES.globalExtensions });
+            }
+            return res.sendStatus(404);
+        } catch (error) {
+            return res.sendStatus(500);
+        }
+    };
+}
+/**
  * Verifies that the current user is an admin.
  * @param {import('express').Request} request Request object
  * @param {import('express').Response} response Response object

 router.use('/assets/*', createRouteHandler(req => req.user.directories.assets));
 router.use('/user/images/*', createRouteHandler(req => req.user.directories.userImages));
 router.use('/user/files/*', createRouteHandler(req => req.user.directories.files));
-router.use('/scripts/extensions/third-party/*', createRouteHandler(req => req.user.directories.extensions));
+router.use('/scripts/extensions/third-party/*', createExtensionsRouteHandler(req => req.user.directories.extensions));