* feat(store): flea-market entity edit feature with version history (schema v38)
Owner + admin can now edit a store entity from a real Edit page at
/marketplace/flea/{id}/edit, replacing the prior "coming soon"
placeholder. Editable: display name, description, category, video
URL, cover photo, and an optional new bundle. Type is locked (400
type_locked). Display-name change renames the on-disk slug for both
live plugin/ and version dirs (reuses rename-on-archive helper).
Schema v38 (originally drafted as v37; renumbered after rebase onto
main where v37 was taken by the curated marketplace enrichment).
Versioning model:
* Each bundle update bakes into ${DATA_DIR}/store/<id>/versions/v<N+1>/plugin/
and runs the standard guardrails pipeline.
* DEFERRED PROMOTION: live plugin/ + entity.version_no stay at the
prior approved version through the LLM review window so existing
installers keep receiving the previously approved bundle. Live swap
+ version_no/version/file_size bump happen only on LLM approval.
Blocked verdicts leave the prior version serving forever.
* store_entities gains version_no INTEGER + version_history JSON.
Each version_history entry carries hash, sha256, size, submission_id,
created_at, created_by.
* Existing entities backfill to v1 with a single-entry history seeded
from the row's current `version` hash. Initial create also seeds
versions/v1/plugin/ so future restore can copy v1 bytes forward.
Concurrency:
* Block-while-pending: an in-flight LLM review blocks any further edit
with 409 prior_version_pending. Owner waits 5-30s; Edit button on
detail page renders disabled in the same window via the new
edit_in_flight flag (decoupled from quarantine_sub since the
deferred-promotion flow keeps visibility='approved').
Rollback:
* New endpoint POST /api/store/entities/{id}/versions/{n}/restore
(owner + admin). Copies vN bundle forward as v<max+1> and re-runs
guardrails (rules tighten over time; pre-approved bundles re-validate).
Forward-only history. Same deferred-promotion semantics — live stays
at prior version until LLM approves the restored copy.
UI:
* New /marketplace/flea/{id}/edit page (owner + admin gated).
* Versions card on plugin + item detail templates (owner/admin only)
via shared _flea_versions.html partial.
* Admin queue gains v# column with current badge + separate Hash
column. Submission detail surfaces Version + Bundle hash rows.
* Activity timeline split into per-submission + entity-wide cards;
entity-wide rows render vN chips when audit row params reference
a specific version.
* Section headers (Manifest / Static / Quality / LLM review) tag
with vN chip via shared macro.
* Reviewed-by-model field surfaces explanatory text per status.
* Banner upload-failure now redirects to detail page on
submission_blocked instead of staying stuck.
Tests: 24 in tests/test_store_entity_versions.py covering metadata-
only edit, bundle-edit version bump, type lock, block-while-pending,
name change disk rename, restore flow + 404/400/403 paths, edit page
404 for non-owner, versions card visibility gating, admin queue v#
column, admin detail Version/Hash rows, deferred-promotion installer
contract (pending review doesn't break installer / blocked verdict
keeps prior / approved promotes), admin can edit/restore non-owned,
restore deferred promotion, audit log per-version params. 214 tests
green across guardrails + edit + admin + repo + schema suites.
* docs(store): refresh update_entity docstring to match deferred-promotion + submission-status gate
Bring the docstring in sync with the actual fixes from the prior
commit. The pre-fix wording said the gate read
visibility_status='pending' AND submission status — under deferred
promotion that would never fire for v2+ edits. Now describes:
- Block-while-pending gates on submission.status DIRECTLY,
independent of visibility (so v2+ deferred-promotion edits don't
slip through).
- Display-name + bundle change defers the live rename to promotion;
metadata-only renames stay immediate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
303 lines
12 KiB
HTML
303 lines
12 KiB
HTML
{% extends "base.html" %}
|
|
{% block title %}Edit {{ entity.name | store_display_name }} — {{ config.INSTANCE_NAME }}{% endblock %}
|
|
|
|
{% block content %}
|
|
<style>
|
|
.edit-back { font-size: 13px; color: var(--text-secondary, #6b7280); text-decoration: none; }
|
|
.edit-back:hover { color: var(--text, #111827); text-decoration: underline; }
|
|
|
|
h1.edit-title { margin: 8px 0 16px 0; font-size: 22px; font-weight: 600; }
|
|
.field { margin-bottom: 18px; }
|
|
.field-label {
|
|
display: block; font-size: 13px; font-weight: 500;
|
|
color: var(--text, #111827); margin-bottom: 6px;
|
|
}
|
|
.field-help {
|
|
font-size: 12px; color: var(--text-secondary, #6b7280); margin-top: 4px;
|
|
}
|
|
.field-help.warn { color: #92400e; }
|
|
|
|
input[type=text], textarea, select {
|
|
width: 100%; padding: 8px 10px;
|
|
border: 1px solid var(--border, #d1d5db); border-radius: 6px;
|
|
font-size: 14px; font-family: inherit;
|
|
background: var(--surface, #fff);
|
|
}
|
|
textarea { min-height: 80px; resize: vertical; }
|
|
|
|
.file-drop {
|
|
display: flex; align-items: center; gap: 12px;
|
|
padding: 16px; border-radius: 8px;
|
|
border: 2px dashed var(--border, #d1d5db); background: var(--surface-muted, #f9fafb);
|
|
cursor: pointer;
|
|
}
|
|
.file-drop input[type=file] { display: none; }
|
|
.file-drop:hover { border-color: var(--primary, #0073D1); background: #fff; }
|
|
.file-drop.is-dragover { border-color: var(--primary, #0073D1); background: #eff6ff; }
|
|
.file-drop .icon { font-size: 24px; }
|
|
.file-drop .file-info .label { font-size: 13px; font-weight: 500; }
|
|
.file-drop .file-info .meta { font-size: 12px; color: var(--text-secondary, #6b7280); }
|
|
.file-drop button {
|
|
margin-left: auto; padding: 6px 12px; border-radius: 6px;
|
|
border: 1px solid var(--border, #d1d5db); background: var(--surface, #fff);
|
|
font-size: 13px; cursor: pointer;
|
|
}
|
|
|
|
.actions { display: flex; gap: 8px; margin-top: 20px; align-items: center; }
|
|
.btn-primary {
|
|
padding: 8px 18px; border-radius: 6px; border: none;
|
|
background: var(--primary, #0073D1); color: white;
|
|
font-size: 14px; font-weight: 500; cursor: pointer;
|
|
}
|
|
.btn-primary:disabled { background: var(--border, #d1d5db); cursor: not-allowed; }
|
|
.btn-link {
|
|
padding: 8px 12px; color: var(--text-secondary, #6b7280); text-decoration: none;
|
|
font-size: 14px;
|
|
}
|
|
|
|
.pending-banner {
|
|
margin: 12px 0 16px 0; padding: 14px 18px; border-radius: 10px;
|
|
background: #fef3c7; color: #92400e; border: 1px solid #fde68a; font-size: 14px;
|
|
}
|
|
.pending-banner h3 { margin: 0 0 6px 0; font-size: 15px; }
|
|
|
|
.banner {
|
|
padding: 12px 16px; border-radius: 8px; margin-bottom: 16px;
|
|
font-size: 13px; line-height: 1.5; display: flex; align-items: flex-start; gap: 10px;
|
|
}
|
|
/* `display: flex` above overrides the user-agent default rule for
|
|
[hidden] (display:none); force it back so the empty banner stays
|
|
out of the layout until showError() unhides it. */
|
|
.banner[hidden] { display: none !important; }
|
|
.banner.error { background: #fef2f2; color: #b91c1c; border: 1px solid #fecaca; }
|
|
.banner > span { white-space: pre-wrap; }
|
|
</style>
|
|
|
|
<div class="page-shell">
|
|
<p style="margin: 8px 0;">
|
|
<a class="edit-back" href="/marketplace/flea/{{ entity.id }}">← Back to detail</a>
|
|
</p>
|
|
<h1 class="edit-title">Edit · {{ entity.type }} · {{ entity.name | store_display_name }}</h1>
|
|
|
|
{% if pending_sub %}
|
|
<div class="pending-banner">
|
|
<h3>⟳ A previous edit is still under review</h3>
|
|
<div>
|
|
Submission <code>{{ pending_sub.id[:8] }}</code> is being checked
|
|
({{ pending_sub.status }}). Edits are temporarily disabled until
|
|
the verdict lands. The detail page auto-refreshes when it does.
|
|
</div>
|
|
</div>
|
|
{% endif %}
|
|
|
|
<div id="banner" class="banner error" hidden>
|
|
<span class="ico">!</span><span id="banner-text"></span>
|
|
</div>
|
|
|
|
<form id="edit-form">
|
|
<div class="field">
|
|
<label class="field-label" for="f-name">Display name</label>
|
|
<input id="f-name" name="name" type="text" value="{{ entity.name | store_display_name }}"
|
|
pattern="^[a-z][a-z0-9-]{0,63}$"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<div class="field-help warn">
|
|
⚠ Changing the name renames the plugin slug for existing
|
|
installers. They'll see the plugin renamed on their next sync
|
|
and may need to re-add it to their stack.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label" for="f-description">Description</label>
|
|
<textarea id="f-description" name="description" maxlength="1000"
|
|
{% if pending_sub %}disabled{% endif %}>{{ entity.description or "" }}</textarea>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label" for="f-category">Category</label>
|
|
<select id="f-category" name="category"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<option value="">— none —</option>
|
|
{% for cat in categories %}
|
|
<option value="{{ cat }}" {% if cat == entity.category %}selected{% endif %}>{{ cat }}</option>
|
|
{% endfor %}
|
|
</select>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label" for="f-video">Video URL <span style="color:var(--text-secondary,#6b7280);font-weight:400;">(optional)</span></label>
|
|
<input id="f-video" name="video_url" type="text"
|
|
value="{{ entity.video_url or '' }}" placeholder="https://..."
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label">Cover photo</label>
|
|
<div class="file-drop" id="photo-drop">
|
|
<div class="icon">🖼</div>
|
|
<div class="file-info">
|
|
<div class="label" id="photo-label">
|
|
{% if entity.photo_path %}Replace existing photo{% else %}No photo{% endif %}
|
|
</div>
|
|
<div class="meta">JPG, PNG, WebP · Max 5 MB</div>
|
|
</div>
|
|
<input type="file" id="photo" accept="image/jpeg,image/png,image/webp"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<button type="button" id="photo-pick" {% if pending_sub %}disabled{% endif %}>Choose</button>
|
|
</div>
|
|
</div>
|
|
|
|
<hr style="border:none;border-top:1px solid var(--border-light, #e5e7eb); margin: 20px 0;">
|
|
|
|
<div class="field">
|
|
<label class="field-label">Upload new version <span style="color:var(--text-secondary,#6b7280);font-weight:400;">(optional)</span></label>
|
|
<div class="file-drop" id="zip-drop">
|
|
<div class="icon">📦</div>
|
|
<div class="file-info">
|
|
<div class="label" id="zip-label">No file selected</div>
|
|
<div class="meta" id="zip-meta">
|
|
Skip to update only the metadata above. Uploading creates
|
|
v{{ (entity.version_no or 1) + 1 }} and re-runs guardrails.
|
|
</div>
|
|
</div>
|
|
<input type="file" id="zip" accept=".zip"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<button type="button" id="zip-pick" {% if pending_sub %}disabled{% endif %}>Choose file</button>
|
|
</div>
|
|
<div class="field-help">
|
|
Current version: <strong>v{{ entity.version_no or 1 }}</strong>
|
|
({{ entity.version[:12] if entity.version else "—" }}).
|
|
Prior versions remain on disk and can be restored from the
|
|
detail page's <em>Versions</em> section.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="actions">
|
|
<button type="submit" class="btn-primary" id="save-btn"
|
|
{% if pending_sub %}disabled{% endif %}>Save</button>
|
|
<a href="/marketplace/flea/{{ entity.id }}" class="btn-link">Cancel</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
|
|
<script>
|
|
const ENTITY_ID = {{ entity.id|tojson }};
|
|
const banner = document.getElementById('banner');
|
|
const bannerText = document.getElementById('banner-text');
|
|
function showError(msg) {
|
|
banner.className = 'banner error';
|
|
bannerText.textContent = msg;
|
|
banner.hidden = false;
|
|
}
|
|
function clearBanner() { banner.hidden = true; }
|
|
|
|
function humanizeError(detail) {
|
|
if (!detail) return 'Save failed.';
|
|
if (typeof detail === 'object') {
|
|
const code = detail.code || '';
|
|
if (code === 'submission_blocked') {
|
|
const lines = ['New version blocked by automated checks.'];
|
|
const inline = (detail.checks?.static_security?.findings) || [];
|
|
for (const f of inline.slice(0, 5)) {
|
|
lines.push('• ' + (f.file || '?') + ':' + (f.line || '?') + ' — ' + (f.reason || f.category || ''));
|
|
}
|
|
lines.push('');
|
|
lines.push('Fix the issues and re-upload, or open the detail page to see the full report.');
|
|
return lines.join('\n');
|
|
}
|
|
if (code === 'prior_version_pending') {
|
|
return 'A previous edit is still under review. Wait for the verdict before saving.';
|
|
}
|
|
if (code === 'type_locked') {
|
|
return 'Cannot change the entity type. Upload a new entity if you need a different form factor.';
|
|
}
|
|
if (code === 'conflict_owner_name') return 'You already have a plugin with that name.';
|
|
if (code === 'conflict_global_suffix') return 'That name conflicts with another user\'s plugin slug.';
|
|
if (code === 'invalid_name_format') return 'Name must be lowercase letters / digits / hyphens, starting with a letter.';
|
|
if (code) return 'Save failed: ' + code;
|
|
try { return 'Save failed: ' + JSON.stringify(detail); } catch (_) { return 'Save failed.'; }
|
|
}
|
|
return 'Save failed: ' + String(detail);
|
|
}
|
|
|
|
// File picker wiring (no double-click bug — div, not label).
|
|
function wireDropZone(dropEl, fileInput, pickBtn, labelEl, validate) {
|
|
if (!dropEl) return;
|
|
pickBtn.addEventListener('click', (e) => {
|
|
e.stopPropagation();
|
|
fileInput.click();
|
|
});
|
|
dropEl.addEventListener('click', (e) => {
|
|
if (e.target.tagName !== 'BUTTON') fileInput.click();
|
|
});
|
|
fileInput.addEventListener('change', () => {
|
|
const f = fileInput.files[0];
|
|
if (!f) return;
|
|
const err = validate ? validate(f) : null;
|
|
if (err) { showError(err); fileInput.value = ''; return; }
|
|
if (labelEl) labelEl.textContent = f.name + ' (' + Math.round(f.size / 1024) + ' KB)';
|
|
dropEl.classList.add('is-dragover');
|
|
});
|
|
}
|
|
|
|
wireDropZone(
|
|
document.getElementById('zip-drop'),
|
|
document.getElementById('zip'),
|
|
document.getElementById('zip-pick'),
|
|
document.getElementById('zip-label'),
|
|
(f) => f.size > 50 * 1024 * 1024 ? 'ZIP too large (max 50 MB).' : null,
|
|
);
|
|
wireDropZone(
|
|
document.getElementById('photo-drop'),
|
|
document.getElementById('photo'),
|
|
document.getElementById('photo-pick'),
|
|
document.getElementById('photo-label'),
|
|
(f) => f.size > 5 * 1024 * 1024 ? 'Photo too large (max 5 MB).' : null,
|
|
);
|
|
|
|
document.getElementById('edit-form').addEventListener('submit', async (e) => {
|
|
e.preventDefault();
|
|
clearBanner();
|
|
const saveBtn = document.getElementById('save-btn');
|
|
saveBtn.disabled = true;
|
|
saveBtn.textContent = 'Saving…';
|
|
try {
|
|
const fd = new FormData();
|
|
const name = document.getElementById('f-name').value.trim();
|
|
if (name) fd.append('name', name);
|
|
fd.append('description', document.getElementById('f-description').value);
|
|
fd.append('category', document.getElementById('f-category').value);
|
|
fd.append('video_url', document.getElementById('f-video').value);
|
|
const zip = document.getElementById('zip').files[0];
|
|
if (zip) fd.append('file', zip);
|
|
const photo = document.getElementById('photo').files[0];
|
|
if (photo) fd.append('photo', photo);
|
|
|
|
const r = await fetch(`/api/store/entities/${ENTITY_ID}`, {
|
|
method: 'PUT', body: fd, credentials: 'same-origin',
|
|
});
|
|
if (r.ok) {
|
|
window.location = `/marketplace/flea/${ENTITY_ID}`;
|
|
return;
|
|
}
|
|
let msg = 'Save failed.';
|
|
try {
|
|
const j = await r.json();
|
|
const eid = j?.detail?.entity_id;
|
|
if (eid && j.detail.code === 'submission_blocked') {
|
|
// Land on detail to see the banner.
|
|
window.location = `/marketplace/flea/${eid}`;
|
|
return;
|
|
}
|
|
if (j.detail) msg = humanizeError(j.detail);
|
|
} catch (_) {}
|
|
showError(msg);
|
|
} catch (err) {
|
|
showError(String(err));
|
|
} finally {
|
|
saveBtn.disabled = false;
|
|
saveBtn.textContent = 'Save';
|
|
}
|
|
});
|
|
</script>
|
|
{% endblock %}
|