1 ? `ad-tab-${tab}` : undefined} aria-label={tabs.length > 1 ? undefined : t('tabs.apps')} className="ad-panel">
- {tab === 'apps' &&
}
+ {tab === 'apps' &&
}
{tab === 'browse' &&
}
{tab === 'libraries' &&
}
{tab === 'access' &&
}
diff --git a/core/http/react-ui/src/utils/addonFilesApi.js b/core/http/react-ui/src/utils/addonFilesApi.js
new file mode 100644
index 0000000000..95ad970fbe
--- /dev/null
+++ b/core/http/react-ui/src/utils/addonFilesApi.js
@@ -0,0 +1,37 @@
+// Client of the add-on file routes: an add-on zip is staged on the owner first,
+// then installed through the host access install. Staging runs nothing; the
+// owner keeps the file for an hour, for the person who uploaded it.
+import { classifyHostGrants } from './hostGrantsApi.js'
+
+// The id of a staged file: 32 lower-case hex characters.
+export const FILE_ID = /^[0-9a-f]{32}$/
+
+// The rules a file can break, and the answers about a staged file. Each is a
+// final answer with words of its own from the owner.
+const TYPES = new Set([
+ 'bad_zip', 'unsafe_path', 'unsupported_entry', 'too_large', 'too_many_files', 'compression_ratio',
+ 'bad_manifest', 'digest_mismatch', 'wrong_platform', 'bad_mode', 'not_found', 'busy', 'invalid_request',
+])
+
+export function classifyFiles(status, body) {
+ const err = body && typeof body === 'object' ? body.error : null
+ const type = err && typeof err === 'object' && typeof err.type === 'string' ? err.type : ''
+ if (TYPES.has(type)) {
+ return { kind: 'invalid', type, status, message: typeof err.message === 'string' ? err.message : '', details: err }
+ }
+ return classifyHostGrants(status, body)
+}
+
+export function createAddonFilesApi(addonsApi) {
+ const call = (path, opts = {}) => addonsApi.call(`/api/addons/files${path}`, { classify: classifyFiles, ...opts })
+ return {
+ // Sends the file and answers with what the owner found in it.
+ upload(file, signal) {
+ const form = new FormData()
+ form.append('file', file, file.name)
+ return call('', { method: 'POST', body: form, signal })
+ },
+ describe(id, signal) { return call(`/${encodeURIComponent(id)}`, { signal }) },
+ async remove(id, signal) { await call(`/${encodeURIComponent(id)}`, { method: 'DELETE', signal }) },
+ }
+}
diff --git a/core/http/react-ui/src/utils/addonsApi.js b/core/http/react-ui/src/utils/addonsApi.js
index 1b51b4cec9..311eeb51d7 100644
--- a/core/http/react-ui/src/utils/addonsApi.js
+++ b/core/http/react-ui/src/utils/addonsApi.js
@@ -59,11 +59,13 @@ export function createAddonsApi({ fetch: fetchImpl, base = p => p } = {}) {
async function call(path, { method = 'GET', body, signal, headers: extra, classify = classifyResponse } = {}) {
let response
try {
+ // A form goes as it is: the browser writes the multipart boundary.
+ const form = typeof FormData !== 'undefined' && body instanceof FormData
response = await doFetch(base(path), {
method,
signal,
- headers: { ...(body === undefined ? { Accept: 'application/json' } : { Accept: 'application/json', 'Content-Type': 'application/json' }), ...(extra || {}) },
- body: body === undefined ? undefined : JSON.stringify(body),
+ headers: { ...(body === undefined || form ? { Accept: 'application/json' } : { Accept: 'application/json', 'Content-Type': 'application/json' }), ...(extra || {}) },
+ body: body === undefined ? undefined : form ? body : JSON.stringify(body),
credentials: 'same-origin',
})
} catch (e) {
diff --git a/core/http/react-ui/src/utils/addonsClient.js b/core/http/react-ui/src/utils/addonsClient.js
index a2acb43cbe..b471619cd2 100644
--- a/core/http/react-ui/src/utils/addonsClient.js
+++ b/core/http/react-ui/src/utils/addonsClient.js
@@ -2,8 +2,10 @@
import { apiUrl } from './basePath'
import { createAddonsApi, createAddonsCatalogAdapter, normalizeOperation } from './addonsApi'
import { createHostGrantsApi } from './hostGrantsApi'
+import { createAddonFilesApi } from './addonFilesApi'
export const addonsApi = createAddonsApi({ base: apiUrl })
export const addonsCatalog = createAddonsCatalogAdapter(addonsApi)
+export const addonFilesApi = createAddonFilesApi(addonsApi)
export const hostGrantsApi = createHostGrantsApi(addonsApi)
export { normalizeOperation }
diff --git a/core/http/react-ui/tests/unit/addonfile.test.mjs b/core/http/react-ui/tests/unit/addonfile.test.mjs
new file mode 100644
index 0000000000..0ef33338d6
--- /dev/null
+++ b/core/http/react-ui/tests/unit/addonfile.test.mjs
@@ -0,0 +1,120 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { LOCAL_FILE, isLocalFile, normalizeFile, fileEntry, fileGate, fileAction, fileIdFromParams } from '../../src/components/addons/fileInstall.js'
+import { approvalBody } from '../../src/components/addons/hostGrantsState.js'
+import { createAddonFilesApi } from '../../src/utils/addonFilesApi.js'
+import { createAddonsApi, AddonsError } from '../../src/utils/addonsApi.js'
+import { runInstallAndTurnOn } from '../../src/components/addons/installAndTurnOn.js'
+
+const ID = 'a'.repeat(32)
+const RAW = {
+ fileId: ID, name: 'memory-0.2.0-linux-amd64.zip', size: 1234, sha256: 'AB'.repeat(32), addonId: 'memory', title: 'Short memory',
+ version: '0.2.0', platform: 'linux/amd64', api: { min: 2, max: 2 }, required: ['workspace.materialize'], optional: ['egress.check'],
+ installed: true, installedVersion: '0.1.0', relation: 'upgrade', origin: 'local file, unsigned',
+}
+
+test('addonfile: the answer of the upload is checked field by field', () => {
+ const f = normalizeFile(RAW)
+ assert.equal(f.sha256, 'ab'.repeat(32))
+ assert.deepEqual(f.api, { min: 2, max: 2 })
+ assert.equal(f.relation, 'upgrade')
+ assert.deepEqual(normalizeFile({ ...RAW, relation: 'weird', required: 'x', size: 'big' }).required, [])
+ assert.equal(normalizeFile({ ...RAW, relation: 'weird' }).relation, 'new')
+ assert.equal(normalizeFile(null).fileId, '')
+})
+
+test('addonfile: the dialog entry names the local file source and the staged file id as the version', () => {
+ const e = fileEntry(normalizeFile(RAW))
+ assert.equal(e.sourceId, LOCAL_FILE)
+ assert.equal(e.version, ID)
+ assert.equal(e.id, 'memory')
+ assert.equal(e.digest, 'sha256:' + 'ab'.repeat(32))
+ assert.equal(e.policy.requireSignature, false)
+ assert.equal(isLocalFile(e.sourceId), true)
+ assert.equal(isLocalFile('official'), false)
+})
+
+test('addonfile: the same version is never installed, an older one needs the tick', () => {
+ const f = (relation) => normalizeFile({ ...RAW, relation })
+ assert.deepEqual(fileGate(f('same'), { downgradeTicked: true }), { allowed: false, reason: 'same' })
+ assert.deepEqual(fileGate(f('downgrade')), { allowed: false, reason: 'downgrade' })
+ assert.equal(fileGate(f('downgrade'), { downgradeTicked: true }).allowed, true)
+ assert.equal(fileGate(f('upgrade')).allowed, true)
+ assert.equal(fileGate(f('new')).allowed, true)
+ assert.equal(fileGate(null).allowed, false)
+})
+
+test('addonfile: an installed add-on is upgraded and a new one installed', () => {
+ assert.equal(fileAction(normalizeFile(RAW)), 'upgrade')
+ assert.equal(fileAction(normalizeFile({ ...RAW, installed: false, relation: 'new' })), 'install')
+})
+
+test('addonfile: only a well formed file id in the link opens the dialog', () => {
+ assert.equal(fileIdFromParams(new URLSearchParams(`file=${ID}`)), ID)
+ assert.equal(fileIdFromParams(new URLSearchParams('file=../x')), '')
+ assert.equal(fileIdFromParams(new URLSearchParams('')), '')
+ assert.equal(fileIdFromParams(null), '')
+})
+
+test('addonfile: the approval carries the downgrade confirmation only when it was given', () => {
+ const preview = { digest: 'sha256:aa', ops: [], revision: 3, nonce: 'n', blockedRequired: [] }
+ const base = { action: 'upgrade', sourceId: LOCAL_FILE, addonId: 'memory', version: ID }
+ assert.equal('downgrade' in approvalBody(preview, [], base), false)
+ assert.equal(approvalBody(preview, [], { ...base, downgrade: true }).downgrade, true)
+ assert.equal(approvalBody(preview, [], base).version, ID)
+})
+
+test('addonfile: the upload is a multipart form with the file part, and the file routes are the documented ones', async () => {
+ const seen = []
+ const fetch = async (url, init) => {
+ seen.push({ url, init })
+ return { ok: true, status: 200, json: async () => RAW }
+ }
+ const api = createAddonFilesApi(createAddonsApi({ fetch }))
+ const file = new File([new Uint8Array([80, 75])], 'x.zip')
+ const out = await api.upload(file)
+ assert.equal(out.fileId, ID)
+ assert.equal(seen[0].url, '/api/addons/files')
+ assert.equal(seen[0].init.method, 'POST')
+ assert.ok(seen[0].init.body instanceof FormData)
+ assert.equal(seen[0].init.body.get('file').name, 'x.zip')
+ assert.equal(seen[0].init.headers['Content-Type'], undefined, 'the browser writes the boundary')
+ await api.describe(ID)
+ assert.equal(seen[1].url, `/api/addons/files/${ID}`)
+ await api.remove(ID)
+ assert.equal(seen[2].init.method, 'DELETE')
+})
+
+test('addonfile: a refusal of the file keeps the reason the owner gave', async () => {
+ const fetch = async () => ({ ok: false, status: 400, json: async () => ({ error: { type: 'wrong_platform', message: 'This file is for linux/arm64; this host is linux/amd64' } }) })
+ const api = createAddonFilesApi(createAddonsApi({ fetch }))
+ await assert.rejects(api.upload(new File([new Uint8Array([1])], 'x.zip')), (e) => {
+ assert.ok(e instanceof AddonsError)
+ assert.match(e.message, /linux\/arm64/)
+ return true
+ })
+})
+
+test('addonfile: an upgrade from a file does not turn the add-on on, a new install does', async () => {
+ const marks = []
+ const ran = []
+ const run = async (key, op) => { ran.push(key); await op.submit('op1', undefined); return { outcome: 'completed' } }
+ const hostGrants = { install: async (body) => ({ payload: { OperationID: body.operationId, AddonID: body.addonId, Phase: 'completed', Generation: 2 } }) }
+ const adapter = { submitLifecycle: async () => { throw new Error('plain install must not run') } }
+ const api = { installed: async () => [{ id: 'memory', enabled: true }] }
+ const entry = { key: 'k', id: 'memory', sourceId: LOCAL_FILE, version: ID }
+ const approval = { action: 'upgrade', sourceId: LOCAL_FILE, addonId: 'memory', version: ID, approve: { digest: 'sha256:aa', ops: [], revision: 0, nonce: 'n' } }
+ await runInstallAndTurnOn({ run, api, adapter, hostGrants, mark: v => marks.push(v.step) }, entry, { approval, turnOn: false })
+ assert.deepEqual(ran, ['install:k'])
+ assert.deepEqual(marks, ['install', 'done'])
+ ran.length = 0; marks.length = 0
+ adapter.submitLifecycle = async () => ({ payload: {} })
+ await runInstallAndTurnOn({ run, api, adapter, hostGrants, mark: v => marks.push(v.step) }, entry, { approval })
+ assert.deepEqual(ran, ['install:k', 'enable:memory:0'])
+})
+
+test('addonfile: a gone file is a typed answer, not an outage', async () => {
+ const fetch = async () => ({ ok: false, status: 404, json: async () => ({ error: { type: 'not_found', message: 'No such file' } }) })
+ const api = createAddonFilesApi(createAddonsApi({ fetch }))
+ await assert.rejects(api.describe(ID), (e) => e.kind === 'invalid' && e.type === 'not_found' && e.status === 404)
+})