Add plugin store settings for DeepSec

Author: ralyodio

.env.example

@@ -17,3 +17,4 @@ COINPAY_API_URL=https://coinpayportal.com
 
 # App
 NEXT_PUBLIC_APP_URL=http://localhost:3000
+SETTINGS_ENCRYPTION_KEY=base64-encoded-32-byte-key

apps/cli/src/commands/modules.ts

@@ -207,7 +207,16 @@ export async function modulesInstallCommand(source: string): Promise<void> {
     return;
   }
 
-  if (install.git_url) {
+  if (install.npm_package) {
+    const npmSpinner = ora({ text: `Installing ${install.npm_package}...`, color: 'green' }).start();
+    try {
+      execSync(`npm install -g ${install.npm_package}`, { stdio: 'pipe' });
+      npmSpinner.succeed(`Package ${install.npm_package} installed globally`);
+    } catch (err) {
+      npmSpinner.fail(`npm install failed: ${(err as Error).message}`);
+      return;
+    }
+  } else if (install.git_url) {
     const cloneSpinner = ora({ text: 'Cloning module repository...', color: 'green' }).start();
     try {
       execSync(`git clone --depth 1 ${install.git_url} ${dest}`, { stdio: 'pipe' });
@@ -222,15 +231,6 @@ export async function modulesInstallCommand(source: string): Promise<void> {
       return;
     }
     cloneSpinner.succeed(`Installed ${mod.name} v${mod.version} → ${dest}`);
-  } else if (install.npm_package) {
-    const npmSpinner = ora({ text: `Installing ${install.npm_package}...`, color: 'green' }).start();
-    try {
-      execSync(`npm install -g ${install.npm_package}`, { stdio: 'pipe' });
-      npmSpinner.succeed(`Package ${install.npm_package} installed globally`);
-    } catch (err) {
-      npmSpinner.fail(`npm install failed: ${(err as Error).message}`);
-      return;
-    }
   } else if (install.tarball_url) {
     const dlSpinner = ora({ text: 'Downloading module tarball...', color: 'green' }).start();
     try {

apps/web/package.json

@@ -10,6 +10,7 @@
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",
+    "@profullstack/pluginstore": "workspace:*",
     "@profullstack/autoblog": "github:profullstack/autoblog#f76b7d3",
     "@supabase/supabase-js": "^2.101.1",
     "isomorphic-dompurify": "^3.12.0",

apps/web/src/__tests__/pluginstore-contract.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, it } from "vitest";
+import {
+  normalizeConfigSchema,
+  splitConfigSchema,
+  type PluginInstallPayload,
+} from "@profullstack/pluginstore";
+
+describe("pluginstore contracts", () => {
+  it("normalizes public config schema without accepting malformed fields", () => {
+    const schema = normalizeConfigSchema([
+      {
+        key: "AI_GATEWAY_API_KEY",
+        label: "Vercel AI Gateway API key",
+        type: "secret",
+        scope: "global",
+        required: true,
+        placeholder: "vck_...",
+      },
+      {
+        key: "DEEPSEC_SANDBOX_ENABLED",
+        label: "Use Vercel Sandbox",
+        type: "boolean",
+        default: false,
+      },
+      { key: "", label: "Bad", type: "secret" },
+      { key: "BAD_TYPE", label: "Bad", type: "password" },
+      null,
+    ]);
+
+    expect(schema).toEqual([
+      expect.objectContaining({
+        key: "AI_GATEWAY_API_KEY",
+        label: "Vercel AI Gateway API key",
+        type: "secret",
+        scope: "global",
+        required: true,
+        placeholder: "vck_...",
+      }),
+      expect.objectContaining({
+        key: "DEEPSEC_SANDBOX_ENABLED",
+        type: "boolean",
+        scope: "module",
+        default: false,
+      }),
+    ]);
+  });
+
+  it("splits secret/plain and global/module fields for settings UIs", () => {
+    const fields = normalizeConfigSchema([
+      { key: "AI_GATEWAY_API_KEY", label: "Gateway key", type: "secret", scope: "global" },
+      { key: "DEEPSEC_AGENT", label: "Agent", type: "string", scope: "module" },
+    ]);
+
+    const split = splitConfigSchema(fields);
+
+    expect(split.secrets.map((field) => field.key)).toEqual(["AI_GATEWAY_API_KEY"]);
+    expect(split.plain.map((field) => field.key)).toEqual(["DEEPSEC_AGENT"]);
+    expect(split.global.map((field) => field.key)).toEqual(["AI_GATEWAY_API_KEY"]);
+    expect(split.module.map((field) => field.key)).toEqual(["DEEPSEC_AGENT"]);
+  });
+
+  it("documents the DeepSec install payload shape", () => {
+    const payload: PluginInstallPayload = {
+      name: "deepsec",
+      slug: "deepsec",
+      version: "2.0.10",
+      downloads: 0,
+      license: "Apache-2.0",
+      min_version: ">=0.2.0",
+      os_support: ["linux", "darwin"],
+      config_notes: "AI_GATEWAY_API_KEY is a per-user/global secret.",
+      config_schema: normalizeConfigSchema([
+        {
+          key: "AI_GATEWAY_API_KEY",
+          label: "Vercel AI Gateway API key",
+          type: "secret",
+          scope: "global",
+          required: true,
+        },
+      ]),
+      install: {
+        npm_package: "deepsec",
+        git_url: "https://github.com/vercel-labs/deepsec",
+        tarball_url: null,
+      },
+    };
+
+    expect(payload.install.npm_package).toBe("deepsec");
+    expect(payload.config_schema[0]).toEqual(
+      expect.objectContaining({
+        key: "AI_GATEWAY_API_KEY",
+        type: "secret",
+        scope: "global",
+      }),
+    );
+  });
+});

apps/web/src/app/account/account-content.tsx

@@ -35,6 +35,11 @@ export default function AccountContent() {
   const [referralWallets, setReferralWallets] = useState<ReferralWallet[]>([]);
   const [loadingWallets, setLoadingWallets] = useState(false);
   const [showAllWallets, setShowAllWallets] = useState(false);
+  const [aiGatewayKeyDraft, setAiGatewayKeyDraft] = useState("");
+  const [aiGatewayKeySet, setAiGatewayKeySet] = useState(false);
+  const [settingsSaving, setSettingsSaving] = useState(false);
+  const [settingsStatus, setSettingsStatus] = useState<string | null>(null);
+  const [settingsError, setSettingsError] = useState<string | null>(null);
 
   const fetchReferralWallets = useCallback(async () => {
     const token = localStorage.getItem("tc_access_token");
@@ -59,6 +64,21 @@ export default function AccountContent() {
     fetchReferralWallets();
   }, [fetchReferralWallets]);
 
+  useEffect(() => {
+    if (!signedIn) return;
+    async function loadSettings() {
+      try {
+        const res = await fetch("/api/settings", { headers: authHeaders(), cache: "no-store" });
+        if (!res.ok) return;
+        const data = await res.json();
+        setAiGatewayKeySet(!!data.secrets?.AI_GATEWAY_API_KEY?.isSet);
+      } catch {
+        // ignore
+      }
+    }
+    loadSettings();
+  }, [signedIn]);
+
   useEffect(() => {
     if (profile) {
       setDisplayName(profile.display_name || "");
@@ -174,6 +194,28 @@ export default function AccountContent() {
     }
   };
 
+  const saveAiGatewayKey = async (value: string | null) => {
+    setSettingsSaving(true);
+    setSettingsStatus(null);
+    setSettingsError(null);
+    try {
+      const res = await fetch("/api/settings", {
+        method: "PUT",
+        headers: authHeaders({ "Content-Type": "application/json" }),
+        body: JSON.stringify({ secrets: { AI_GATEWAY_API_KEY: value } }),
+      });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error || "Failed to save settings");
+      setAiGatewayKeySet(!!data.secrets?.AI_GATEWAY_API_KEY?.isSet);
+      setAiGatewayKeyDraft("");
+      setSettingsStatus(value === null ? "Cleared" : "Saved");
+    } catch (error) {
+      setSettingsError((error as Error).message);
+    } finally {
+      setSettingsSaving(false);
+    }
+  };
+
   return (
     <div className="min-h-screen bg-tc-darker">
       {/* Nav */}
@@ -276,6 +318,47 @@ export default function AccountContent() {
             )}
           </div>
 
+          {/* Global Module Settings */}
+          <div className="bg-tc-card border border-tc-border rounded-xl p-6">
+            <h2 className="text-lg font-semibold text-white mb-4">Global Module Settings</h2>
+            <div>
+              <label className="block text-sm text-tc-text-dim mb-1">
+                Vercel AI Gateway API key
+                <span className="ml-2 font-mono text-[10px] text-tc-text-dim">AI_GATEWAY_API_KEY</span>
+              </label>
+              <div className="flex flex-col sm:flex-row gap-2">
+                <input
+                  type="password"
+                  value={aiGatewayKeyDraft}
+                  placeholder={aiGatewayKeySet ? "Saved secret set" : "vck_..."}
+                  onChange={(e) => setAiGatewayKeyDraft(e.target.value)}
+                  className="flex-1 bg-tc-darker border border-tc-border rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-tc-green/50"
+                />
+                <button
+                  onClick={() => saveAiGatewayKey(aiGatewayKeyDraft)}
+                  disabled={settingsSaving || !aiGatewayKeyDraft.trim()}
+                  className="bg-tc-green text-black px-4 py-2 rounded-lg text-sm font-semibold hover:bg-tc-green-dim disabled:opacity-50"
+                >
+                  {settingsSaving ? "Saving..." : "Save"}
+                </button>
+                {aiGatewayKeySet && (
+                  <button
+                    onClick={() => saveAiGatewayKey(null)}
+                    disabled={settingsSaving}
+                    className="border border-tc-border text-tc-text-dim px-4 py-2 rounded-lg text-sm hover:border-red-400/40 hover:text-red-400 disabled:opacity-50"
+                  >
+                    Clear
+                  </button>
+                )}
+              </div>
+              <p className="text-xs text-tc-text-dim mt-2">
+                Used by AI-powered modules such as DeepSec. The key is stored in your account settings, not in the public plugin store.
+              </p>
+              {settingsStatus && <p className="text-xs text-tc-green mt-2">{settingsStatus}</p>}
+              {settingsError && <p className="text-xs text-red-400 mt-2">{settingsError}</p>}
+            </div>
+          </div>
+
           {/* Referral Section — hidden for now */}
           <div className="hidden bg-tc-card border border-tc-border rounded-xl p-6">
             <h2 className="text-lg font-semibold text-white mb-4">Referrals</h2>

apps/web/src/app/api/modules/[slug]/install/route.ts

@@ -1,20 +1,27 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getSupabaseAdmin } from "@/lib/supabase";
+import { getAuthenticatedRequestUser } from "@/lib/api-auth";
+import { normalizeConfigSchema } from "@profullstack/pluginstore";
 
 type RouteContext = { params: Promise<{ slug: string }> };
 
 const MODULE_INSTALL_COLUMNS =
-  "id, name, slug, version, downloads, git_url, min_threatcrush_version, os_support, license";
+  "id, name, slug, version, downloads, git_url, npm_package, tarball_url, min_threatcrush_version, os_support, license, config_schema, config_notes";
 
 function installPayload(mod: {
+  id?: string;
   name: string;
   slug: string;
   version: string;
   downloads?: number | null;
   git_url?: string | null;
+  npm_package?: string | null;
+  tarball_url?: string | null;
   min_threatcrush_version?: string | null;
   os_support?: string[] | null;
   license?: string | null;
+  config_schema?: unknown;
+  config_notes?: string | null;
 }) {
   return {
     name: mod.name,
@@ -23,11 +30,14 @@ function installPayload(mod: {
     downloads: mod.downloads || 0,
     license: mod.license,
     min_threatcrush_version: mod.min_threatcrush_version,
+    min_version: mod.min_threatcrush_version,
     os_support: mod.os_support,
+    config_schema: normalizeConfigSchema(mod.config_schema),
+    config_notes: mod.config_notes || null,
     install: {
-      npm_package: null,
+      npm_package: mod.npm_package || null,
       git_url: mod.git_url || null,
-      tarball_url: null,
+      tarball_url: mod.tarball_url || null,
     },
   };
 }
@@ -88,6 +98,8 @@ export async function POST(
     return NextResponse.json({ error: "Module not found" }, { status: 404 });
   }
 
+  const user = await getAuthenticatedRequestUser(request);
+
   // Increment download count
   const newCount = (mod.downloads || 0) + 1;
   await sb
@@ -103,9 +115,24 @@ export async function POST(
     platform: body.platform || "unknown",
   });
 
+  if (user) {
+    await sb.from("user_installed_modules").upsert(
+      {
+        user_id: user.userId,
+        module_id: mod.id,
+        module_slug: mod.slug,
+        version: body.version || mod.version,
+        status: "active",
+        updated_at: new Date().toISOString(),
+      },
+      { onConflict: "user_id,module_id" },
+    );
+  }
+
   return NextResponse.json({
     success: true,
     downloads: newCount,
+    installed: !!user,
     module: installPayload({ ...mod, downloads: newCount }),
   });
 }

apps/web/src/app/api/modules/installed/route.ts

@@ -0,0 +1,60 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getAuthenticatedRequestUser, getAdminClient, unauthorized } from "@/lib/api-auth";
+
+type InstalledRow = {
+  module_id: string;
+  module_slug: string;
+  version: string;
+  status: string;
+  installed_at: string;
+  updated_at: string;
+};
+
+export async function GET(request: NextRequest) {
+  const user = await getAuthenticatedRequestUser(request);
+  if (!user) return unauthorized();
+
+  const sb = getAdminClient();
+  const { data, error } = await sb
+    .from("user_installed_modules")
+    .select("module_id, module_slug, version, status, installed_at, updated_at")
+    .eq("user_id", user.userId)
+    .order("installed_at", { ascending: false });
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json({ installed: (data || []) as InstalledRow[] });
+}
+
+export async function PATCH(request: NextRequest) {
+  const user = await getAuthenticatedRequestUser(request);
+  if (!user) return unauthorized();
+
+  const body = await request.json().catch(() => null) as { slug?: unknown; status?: unknown } | null;
+  const slug = typeof body?.slug === "string" ? body.slug : "";
+  const status = typeof body?.status === "string" ? body.status : "";
+
+  if (!slug) {
+    return NextResponse.json({ error: "slug is required" }, { status: 400 });
+  }
+  if (!["active", "disabled", "removed"].includes(status)) {
+    return NextResponse.json({ error: "status must be active, disabled, or removed" }, { status: 400 });
+  }
+
+  const sb = getAdminClient();
+  const { data, error } = await sb
+    .from("user_installed_modules")
+    .update({ status, updated_at: new Date().toISOString() })
+    .eq("user_id", user.userId)
+    .eq("module_slug", slug)
+    .select("module_id, module_slug, version, status, installed_at, updated_at")
+    .single();
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json({ installed: data });
+}