manage/openspec/changes/service-registry/design.md

# Design: Runtime Service Registry

**Change:** `service-registry`
**Phase:** design
**Date:** 2026-06-19

## 1. Architecture overview

```
┌────────────────────────────────────────────────────────────────────┐
│                              Browser                                │
│   /services/:type/:id  ─►  ServicePage  ─►  frontend SERVICE_REGISTRY
│   Dashboard             ─►  WidgetInstance ─►  widget component     │
└────────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌────────────────────────────────────────────────────────────────────┐
│                  FastAPI /api/services + /api/widgets               │
│   CRUD service instances · registry metadata · widget data         │
└────────────────────────────────────────────────────────────────────┘
                                  │
       ┌──────────────────────────┼───────────────────────────┐
       ▼                          ▼                           ▼
  ServiceStore (SQLite)    integrations/ definitions     source adapters
  services table           (Pydantic, closed registry)   (resolve service
  dashboard_widgets table  grafana/prometheus/jellyfin/   → decrypt → call)
                          nextcloud/ssh_tasks
```

Two closed, compile-time registries cooperate:

- **`integrations.registry.SERVICE_DEFINITIONS`** maps `service_type → ServiceDefinition`.
  Each definition declares config schema, secret fields, and widget kinds.
- The widget types available to the dashboard are **derived** from
  `SERVICE_DEFINITIONS` at startup, not hand-maintained.

## 2. Backend data model

### 2.1 New `services` table

Extend `SettingsStore.init_schema()`:

```sql
CREATE TABLE IF NOT EXISTS services (
    id TEXT PRIMARY KEY,
    service_type TEXT NOT NULL,
    name TEXT NOT NULL,
    config_json TEXT NOT NULL DEFAULT '{}',
    secrets_json TEXT NOT NULL DEFAULT '{}',   -- encrypted blob (Fernet)
    enabled INTEGER NOT NULL DEFAULT 1,
    created_at INTEGER NOT NULL,
    updated_at INTEGER NOT NULL
);
CREATE INDEX IF NOT EXISTS idx_services_type ON services(service_type);
```

- `config_json` — non-secret config validated against the service definition's
  `config_schema`.
- `secrets_json` — a JSON object of `{field_name: ciphertext}` produced by the
  encryption helper. Never returned to the client in plaintext; only the boolean
  "is set" flags are surfaced.

### 2.2 `dashboard_widgets` schema change

The existing table gains two columns and loses the global meaning of `widget_type`:

```sql
ALTER TABLE dashboard_widgets ADD COLUMN service_id TEXT;
ALTER TABLE dashboard_widgets ADD COLUMN widget_kind TEXT;
```

- `widget_kind` is the kind declared by the service definition (e.g. `"link"`,
  `"metric"`, `"activity"`).
- `service_id` references `services.id`.
- `widget_type` is retained temporarily as `"{service_type}.{widget_kind}"` for
  backwards-compatible reads during the transition, then dropped in the final slice.
- The old `addon_id` column is dropped; addon identity is now `service_type`.

## 3. Service definitions (Pydantic, in repo)

New package: `backend/src/media_library_viewer_api/integrations/`
(chosen to avoid collision with the existing `services/` infra package).

### 3.1 Base classes — `integrations/base.py`

```python
from typing import Any, ClassVar
from pydantic import BaseModel, Field

class SecretField(BaseModel):
    key: str
    label: str
    required: bool = False
    helper: str | None = None

class WidgetKind(BaseModel):
    kind: str                       # e.g. "link", "metric", "activity"
    name: str
    description: str
    config_schema: dict[str, Any]   # JSON schema for widget config
    default_config: dict[str, Any] = {}
    refresh_interval_ms: int = 0

class ServiceConfigBase(BaseModel):
    """Subclass per service to define non-secret config fields."""

class ServiceDefinition(BaseModel):
    service_type: ClassVar[str]
    name: ClassVar[str]
    description: ClassVar[str]
    config_schema: ClassVar[dict[str, Any]]
    secret_fields: ClassVar[list[SecretField]]
    widget_kinds: ClassVar[list[WidgetKind]]

    # Adapters are referenced by dotted path or registered separately;
    # see §4. The definition itself stays a pure data/schema object.
```

### 3.2 Example — `integrations/grafana.py`

```python
class GrafanaConfig(ServiceConfigBase):
    base_url: str = Field(..., description="Grafana base URL, e.g. https://grafana.example.com")

GRAFANA_DEFINITION = ServiceDefinition(
    service_type="grafana",
    name="Grafana",
    description="Dashboards, metrics, and logs.",
    config_schema=GrafanaConfig.model_json_schema(),
    secret_fields=[SecretField(key="api_key", label="API key", helper="Service account token")],
    widget_kinds=[
        WidgetKind(
            kind="link",
            name="Dashboard link",
            description="Deep-link to a Grafana dashboard or panel.",
            config_schema={
                "type": "object",
                "properties": {
                    "dashboard_uid": {"type": "string"},
                    "panel_id": {"type": "integer"},
                },
                "required": ["dashboard_uid"],
            },
            default_config={"dashboard_uid": ""},
            refresh_interval_ms=0,
        ),
    ],
)
```

Other definition modules follow the same shape: `prometheus.py`, `jellyfin.py`,
`nextcloud.py`, `ssh_tasks.py`.

### 3.3 Registry — `integrations/registry.py`

```python
SERVICE_DEFINITIONS: dict[str, ServiceDefinition] = {
    "grafana": GRAFANA_DEFINITION,
    "prometheus": PROMETHEUS_DEFINITION,
    "jellyfin": JELLYFIN_DEFINITION,
    "nextcloud": NEXTCLOUD_DEFINITION,
    "ssh_tasks": SSH_TASKS_DEFINITION,
}

def list_service_types() -> list[str]: ...
def get_service_definition(service_type: str) -> ServiceDefinition | None: ...
def get_widget_kind(service_type: str, widget_kind: str) -> WidgetKind | None: ...
```

The closed `widgets/registry.py` from Phase 1 is **retired**; its metadata is now derived
from `SERVICE_DEFINITIONS`.

## 4. Source adapters

`widgets/sources.py` is refactored so each adapter resolves a **service instance** rather
than reading `get_settings()`:

```python
class WidgetSource(Protocol):
    async def fetch(
        self,
        service: ServiceRecord,         # config + decrypted secrets
        widget_kind: str,
        config: dict[str, Any],
    ) -> dict[str, Any]: ...
```

- `ServiceRecord` is a runtime object built by `ServiceStore` carrying the decrypted
  secret dict in memory for the duration of the fetch.
- `SOURCE_ADAPTERS` is keyed by `service_type`.
- The data endpoint loads the widget's `service_id`, builds the `ServiceRecord`, then
  calls `adapter.fetch(service, widget_kind, widget_config)`.

## 5. Encryption — `services/secrets.py`

```python
from cryptography.fernet import Fernet, InvalidToken

def get_encryption_key() -> bytes:
    raw = os.environ.get("MANAGE_ENCRYPTION_KEY")
    if not raw:
        raise RuntimeError("MANAGE_ENCRYPTION_KEY is required")
    return raw.encode()

def encrypt_secrets(values: dict[str, str]) -> dict[str, str]: ...
def decrypt_secrets(blob: dict[str, str]) -> dict[str, str]: ...
```

- `cryptography.fernet.Fernet` (already a transitive dependency to verify).
- Startup validation: `validate_auth_settings` is extended to require
  `MANAGE_ENCRYPTION_KEY` and to reject an obviously invalid key.
- Secrets are encrypted field-by-field so the "which secrets are set" metadata is cheap
  to compute without decrypting.

## 6. REST API

### Services

| Method | Path | Handler |
|--------|------|---------|
| GET | `/api/services/types` | List service definitions (metadata + config schema + widget kinds). |
| GET | `/api/services` | List service instances (no plaintext secrets; only "set" flags). |
| POST | `/api/services` | Create instance (validates type, config, secret schema). |
| PUT | `/api/services/{id}` | Update instance. |
| DELETE | `/api/services/{id}` | Delete instance (and refuse while widgets reference it, or cascade). |

### Widgets (unchanged paths, new semantics)

| Method | Path | Handler |
|--------|------|---------|
| GET | `/api/widgets/instances` | List widgets; each carries `service_id`, `widget_kind`. |
| POST/PUT/DELETE | `/api/widgets/instances/{id}` | CRUD; validation uses service definition's widget schema. |
| GET | `/api/widgets/instances/{id}/data` | Resolve service → adapter → fetch. |

`GET /api/widgets/types` and `/api/widgets/sources` are removed; widget metadata is
served via `/api/services/types` (widget kinds under each service).

## 7. Frontend

### 7.1 New `frontend/src/integrations/registry.ts`

Closed frontend registry mirroring the backend: `serviceType → ServiceDefinition`
(config fields, secret fields with `secret: true`, widget kinds, default refresh
intervals, and a `component` for the service page).

### 7.2 Service pages

- Route: `/services/:serviceType/:serviceId` (replaces `/addons/:addonId`).
- `ServicePage` looks up the definition and renders the service-specific component,
  a config editor, and the list of widget kinds that can be added to the dashboard.
- `App.tsx` removes the `/addons/:addonId` route; old addon URLs redirect to the
  default service of that type (or a not-found alert).

### 7.3 Dashboard config dialog

- "Add widget" flow becomes: **pick service → pick widget kind → configure**.
- The widget card shows the parent service name.

### 7.4 Types / API / hooks

- `frontend/src/api/services.ts` + `hooks/useServices.ts` for the services API.
- `frontend/src/types/index.ts` gains `ServiceInstance`, `ServiceInstanceInput`,
  `ServiceTypeInfo`, `ServiceWidgetKind`.

## 8. Migration and breaking changes

- **DB migration on startup:** add `services` table; add `service_id` / `widget_kind`
  columns to `dashboard_widgets`; drop `addon_id`.
- **Machine app fields removed:** `jellyfin_url`, `jellyfin_user_id`, `jellyfin_api_key`,
  `jellyseerr_url`, `jellyseerr_api_key` are dropped from machine records and the
  `MonitoringMachine` model. Machines keep SSH + node_exporter transport fields only.
- **Env vars removed from `config.py`:** `grafana_url`, `prometheus_url`. (Grafana/Prometheus
  URLs now live on service records.) `MANAGE_ENCRYPTION_KEY` is added as required.
- **Default widget seeding** is removed; a fresh install starts with no widgets. The user
  adds Jellyfin/Backups widgets after configuring the corresponding services.
- **`docs/REQUIREMENTS.md` and `README.md`** updated to describe services, the
  `MANAGE_ENCRYPTION_KEY` requirement, and the breaking upgrade note.

## 9. File-level plan

### Create (backend)

| File | Purpose |
|------|---------|
| `integrations/__init__.py` | Package marker. |
| `integrations/base.py` | `ServiceDefinition`, `WidgetKind`, `SecretField`, `ServiceConfigBase`. |
| `integrations/registry.py` | Closed `SERVICE_DEFINITIONS` + helpers. |
| `integrations/grafana.py`, `prometheus.py`, `jellyfin.py`, `nextcloud.py`, `ssh_tasks.py` | One module per service. |
| `services/secrets.py` | Fernet encrypt/decrypt + key validation. |
| `services/service_store.py` | CRUD for `services` table; decrypt-on-read for adapters. |
| `routers/services.py` | `/api/services*` endpoints. |
| `models/services.py` | Pydantic request/response models. |

### Modify (backend)

| File | Change |
|-------|--------|
| `services/settings_store.py` | `services` table; widget columns; drop machine app fields. |
| `widgets/sources.py` | Adapters take a `ServiceRecord`. |
| `widgets/registry.py` | Retired (metadata served by `integrations/registry.py`). |
| `routers/widgets.py` | Validate against service widget schema; resolve service on data fetch. |
| `config.py` | Remove `grafana_url`/`prometheus_url`; document `MANAGE_ENCRYPTION_KEY` (read in `secrets.py`). |
| `main.py` | Register `services_router`; validate encryption key on startup. |
| `dependencies.py` | Jellyfin/SSH resolution now goes via services, not machine app fields. |

### Create (frontend)

| File | Purpose |
|------|---------|
| `integrations/registry.ts` | Closed frontend service registry. |
| `api/services.ts`, `hooks/useServices.ts` | Services API + hooks. |
| `pages/ServicePage.tsx` | Generic `/services/:type/:id` page. |
| `integrations/components/*` | Per-service page components. |

### Modify (frontend)

| File | Change |
|-------|--------|
| `App.tsx` | Replace `/addons/:addonId` with `/services/:serviceType/:serviceId`. |
| `components/WidgetConfigDialog.tsx` | Service → widget-kind picker. |
| `widgets/registry.ts` | Retired; widgets derived from service registry. |
| `types/index.ts` | Service types; widget gains `service_id` + `widget_kind`. |
| `pages/Settings.tsx` | Remove machine Jellyfin/Jellyseerr fields. |

## 10. Slice boundaries (chained PRs)

Each slice keeps `pytest`, `ruff`, `npm run lint`, and `npm run build` green.

1. **Backend foundation** — encryption helper, `integrations/` base + 5 definitions +
   registry, `services` table + store, `/api/services*` endpoints, tests. No widget
   changes yet.
2. **Backend widget rebind** — add `service_id`/`widget_kind` to widgets, refactor
   adapters to take a `ServiceRecord`, retire old `widgets/registry.py`, update data
   endpoint.
3. **Frontend services runtime** — types, API, hooks, `integrations/registry.ts`,
   service pages, route swap, remove addon pages.
4. **Frontend dashboard + settings rework** — service-based widget picker, drop machine
   app fields from Settings, remove `grafana_url`/`prometheus_url` from config,
   re-seed behavior, docs (`README.md`, `REQUIREMENTS.md`), changelog breaking-change
   note.

Estimated total: ~2,000–2,400 changed lines across four PRs.

## 11. Open questions to resolve before apply

1. Should deleting a service that still has widgets block (return 409) or cascade-delete
   the widgets? Recommend **block with 409** and require the user to remove widgets first.
2. Should `MANAGE_ENCRYPTION_KEY` have a development default (e.g. derived from a fixed
   dev key when `AUTH_ENABLED=false`)? Recommend **no** — require it always to avoid
   accidental plaintext in dev.
3. Does the SSH task runner service hold the SSH key reference, or does it reference a
   machine? Recommend the service record holds `machine_id` (transport) + optional
   task-scoped overrides; the saved-task registry stays unchanged.