Files
karakeep/web/ListsPanel.tsx
T
pastilhas 58688365f0 the plugin, written against karakeep instead of linkwarden
Same model as Vault: one instance per install, a sidecar that is the only thing
knowing where it is, two doors - one authenticated for our own UI that injects
the caller's credential, one unauthenticated for a client that carries its own -
and an account per Officer user.

── Why this upstream ──

Linkwarden authenticates its extension through NextAuth: host-scoped cookies,
CSRF checked against the host, absolute URLs baked from NEXTAUTH_URL. Proxying
that means telling the upstream the address the CLIENT uses, which is not the
address the SIDECAR dials, and getting it wrong bounces the extension out of the
proxy mid-login. It cost a NEXTAUTH_URL change, a container recreate, a lost csrf
cookie, and it retired the upstream's own web login as the price of going through
Officer.

Karakeep's extension holds an API key and sends it as a header. Nothing is
host-pinned, so none of that exists. And provisioning needs nothing pasted:
users.create and apiKeys.exchange are both public procedures, so Officer creates
the account, chooses the password, and mints the key itself - where Linkwarden
could only take a key a person made by hand.

── Carried over deliberately ──

Two fixes from the Linkwarden build, both upstream-agnostic and both found by
running it rather than reading it. `content-encoding` stripped from proxied
responses, because fetch decompresses the body while the headers still claim
gzip - which hides until the first response big enough to compress. And
Set-Cookie copied with append rather than set, because it is the one header that
legitimately repeats. Karakeep should never need the second one; it is here
because a proxy correct only for the traffic its author tested is a trap for
whoever changes the upstream later.

Also carried: the unauthenticated door is hand-written rather than the shared
createSidecarProxy router, which does ctx.get("user").id and 500s where there is
no session.

Written against source, not yet run. The response shapes in the panels come from
packages/api/routes/ and are the first thing to check against a live instance.
No provisioning yet.
2026-09-05 21:36:19 +01:00

112 lines
3.9 KiB
TypeScript

import { useCallback, useEffect, useRef, useState } from 'react';
import { useSearchParams } from 'react-router';
import { useClient } from 'hooks/useClient';
import { Folder, Settings2, Layers } from 'lucide-react';
import { SettingsForm } from './SettingsForm';
/**
* The lists, and a way back to the settings.
*
* Selection is `?list=<id>` in the URL rather than a channel, so which list you are looking
* at survives a reload and can be linked to — `docs/navigation-audit.md`. The links panel reads the same
* parameter rather than being handed the id.
*
* The settings live behind the gear rather than on a screen of their own. They were a screen of their
* own for an afternoon and it was the wrong shape: nothing else was built, so opening the plugin put you
* on a configuration form with no way forward, which reads as broken rather than unfinished.
*/
/** Karakeep list ids are strings, and lists nest through `parentId`. */
type List = { id: string; name: string; icon?: string | null; parentId?: string | null };
/** `?list=` for "everything", which is a real choice and not the absence of one. */
export const ALL = 'all';
export const ListsPanel = () => {
const client = useClient();
const clientRef = useRef(client);
clientRef.current = client;
const [rows, setRows] = useState<List[] | null>(null);
const [error, setError] = useState<string | null>(null);
const [showSettings, setShowSettings] = useState(false);
const [params, setParams] = useSearchParams();
const selected = params.get('list') ?? ALL;
const load = useCallback(async () => {
try {
const body = await clientRef.current.get<{ lists: List[] }>('/karakeep/api/v1/lists');
setRows(body.lists ?? []);
setError(null);
} catch (failure) {
// The message matters here. "No account is mapped to you" is something the owner can fix and is
// the state every user starts in, so it must not read as an outage.
setError(failure instanceof Error ? failure.message : 'Could not read your lists.');
setRows(null);
setShowSettings(true);
}
}, []);
useEffect(() => {
void load();
}, [load]);
const select = (id: string) =>
setParams(
(p) => {
p.set('list', id);
return p;
},
{ replace: true },
);
return (
<div className="flex size-full flex-col">
<header className="flex items-center justify-between border-b px-2 py-1.5">
<span className="text-xs font-medium">Lists</span>
<button
type="button"
onClick={() => setShowSettings((was) => !was)}
className="p-1 text-muted-foreground hover:text-foreground"
aria-label="Settings"
>
<Settings2 className="size-3.5" />
</button>
</header>
{error && <p className="px-3 py-2 text-[11px] text-destructive">{error}</p>}
<ul className="flex-1 overflow-auto">
<li>
<button
type="button"
onClick={() => select(ALL)}
className={`flex w-full items-center gap-2 px-3 py-1.5 text-left text-xs hover:bg-muted/50 ${
selected === ALL ? 'bg-muted' : ''
}`}
>
<Layers className="size-3.5 shrink-0 text-muted-foreground" />
Everything
</button>
</li>
{rows?.map((row) => (
<li key={row.id}>
<button
type="button"
onClick={() => select(row.id)}
className={`flex w-full items-center gap-2 px-3 py-1.5 text-left text-xs hover:bg-muted/50 ${
selected === row.id ? 'bg-muted' : ''
}`}
>
<Folder className="size-3.5 shrink-0 text-muted-foreground" />
<span className="min-w-0 flex-1 truncate">{row.name}</span>
</button>
</li>
))}
</ul>
{showSettings && <SettingsForm />}
</div>
);
};