pastilhasandClaude Opus 5
d5f2d8f370
defaults to `<owner home>/fofos`, and stores the FULL path — never the tilde. a tilde means "whoever is asking", and the people asking will not all be the same person: this plugin is grantable, and the site is in one place regardless of who is looking at it. stored as `~/fofos` it would give every user a different answer to a question that has one. THE DEFAULT IS COMPUTED, NOT WRITTEN. no row means the default is worked out on every read, so it follows the machine. writing it in at install freezes whichever home existed on install day, and a restore onto a different machine then points at a directory that is not there while looking deliberately chosen. a saved path is a decision and is stored exactly as given; only its absence is derived. the form says which of the two it is showing, because "not set" reading identically to "set to the default" is how somebody comes to believe they configured something they did not. THE PICKER USES THE PLATFORM'S FILE API — /file-browser/ls and /mkdir — not routes of this plugin's own. they already refuse to leave home, and they already tell a missing directory from a forbidden one, which is a distinction that cost somebody an afternoon and would have been re-guessed here. shipping a second listing and mkdir would be a second filesystem surface to audit for the sake of one form. that API is an execution capability and never grantable, so for anybody but the owner it 403s — said in a sentence rather than shown as an empty tree, because an empty listing is data and must never be how a refusal looks. it also browses the owner's home and nothing above it; a path outside home is still reachable by typing, since the picker fills the field and the FIELD is what saves. one value on screen, one Save, and picking a folder commits nothing by itself. "Use this folder" takes the one that is OPEN rather than one highlighted in the list. that makes looking inside and choosing one gesture, and it is the only way to choose a folder with nothing in it — which a freshly made one always is. a SECOND table, not a column on fofos_admin_connection, whose url and token are both notNull: a root path could not be saved there without also having an HTTP connection, and that connection is being replaced rather than extended. when it goes, its table is a clean drop instead of surgery on columns that outlived it. the rule against tables in this plugin is unbent — what it forbids is the CLIENT'S work, and this row holds a path somebody can retype. needs `bun db:push`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Fofos Admin
An Officer plugin. It puts the fofos website's admin inside Officer, as panels.
Status: nothing is built yet. This repository is a name and a README. What it will be is below, and the API it consumes already exists — see The other half.
What this is
fofos is a website with three surfaces in one process: a public site generated to static files, a JSON API, and an admin that has until now been its own server-rendered application on its own subdomain, behind its own password.
That third one is moving here. Editing the site becomes something you do inside Officer, with Officer's accounts, Officer's permissions and Officer's workspace — rather than a second login on a second domain that has to be told separately who is allowed in.
Why a plugin, rather than leaving it where it was
One place to sign in. The admin had its own argon2 passwords, its own session cookie and its own
/admin/setup bootstrap. All of it duplicated something Officer already does properly, and none of
it could be shared: a person given access to the machine still had to be given access to the admin,
separately, by hand.
Officer's permissions instead of a second answer. One grantable permission, per role, at read or write — the same page as every other plugin, with no special case to learn.
The site keeps its own data. This plugin stores nothing of the client's. Content, uploads and every photograph stay in fofos's own database and media store; the only thing in Officer's database is the connection to reach them. So deleting this plugin — with or without the "delete its data" checkbox — cannot lose a single line of copy or a single image. That is a deliberate property, not a happy accident.
What it will look like
A nav down the left and a detail panel beside it, following plugins/proxy-manager rather than
plugins/gitea — a list of sections over a remote service whose credential the plugin holds, which
is this problem exactly.
Nine sections, in the order they will be built:
| Messages | contact form submissions. Read only, and there is no delete |
| Site settings | partners, social links, contact details |
| About | one page of copy and a header photograph |
| Home | the hero, the intro, and an ordered gallery |
| Gallery · Drops · Collabs | pieces, each with ordered media |
| Collections | the nested one — collections hold items, items hold media |
| Services | a fixed tree. Content only: no adding, no removing, no reordering |
Messages is first on purpose. It is one read-only route, so it proves the whole path — Officer panel, through this plugin, to fofos and back — before anything harder is attempted.
The other half
The API this consumes is already built and running, in the fofos repository at /api/admin. It
covers all nine sections, authenticates with a bearer token, and its full route reference is in
docs/SURFACES.md.
It lives there rather than here for one reason worth stating: the query layer is the only thing the site and the admin share, and a plugin carrying its own copy of fofos's database schema would be a second definition of the same tables in a different repository, drifting from the day it was written. So this plugin holds a URL and a token and knows nothing about Postgres.
Configuration
One connection: where fofos is, and a token to reach it. Stored in a plugin-owned table, encrypted under this plugin's own purpose key, and never returned across the API boundary — to anybody, including the owner. A settings form asking "is one set" gets a boolean.
/_config is ownerOnly. The token is write authority over the whole public site, so while reading
what is on the site is reasonable to delegate, handing over the credential is not.
Not in the marketplace
This is a plugin for one website, and it is useless without that website. It installs from its git URL and has no catalogue entry.
Files
Nothing yet. What Officer requires, once there is something:
manifest.ts identity, the permission, ownerOnly on /_config
db/schema.ts ONE table: the fofos connection
api/router.ts mounted at /api/fofos-admin — forwards to fofos
web/panels.ts the panels. REQUIRED alongside web/
web/layout.ts how they are arranged. REQUIRED alongside web/
Presence is the declaration — Officer discovers a plugin by what is on disk, and manifest.ts holds
only what a directory listing cannot say. A web/ missing either of its two files is refused at
discovery, by name.
Conventions
master, not main.
Every colour is a semantic token — bg-muted, text-muted-foreground, border-border — and
never a Tailwind palette class. Palette classes do not follow the theme, so a plugin using them looks
correct under exactly one theme and wrong under the rest.