066a19052b
Findings F2, F4, F5, F6, F7, F8, F9, F10, F11 and F13 from wj-architectural-review.md. F1/F1a (the non-sargable LOWER pattern) and F3 (the warranty sync holding a pooled connection) are being handled separately and are untouched here. - A collector check-in that raced another for the same PC lost everything: the unique index on the application fingerprint raised, nothing caught it, and the whole check-in rolled back, discarding state, events and hardware, answering the agent with form copy meant for a person. The insert now runs in a savepoint, reconciles what the other transaction already wrote, one row per savepoint so a second collision skips a row rather than the batch, and the check-in commits with a warning. This is the shape the delete side of the same function already had. - Enrollment is deliberately unauthenticated, so it now carries a per-address rate limit and a cap on pending requests, and the cap is a setting an admin can see and change. A flood can no longer bury the approval queue or grow the table without bound. - The fleet alert poll no longer formats debug strings on every request. - BusinessUnit is on the contract surface (0.34.0), so the endpoints plugin stops reaching into a core table with raw SQL. - A test walks every asset type descriptor and proves the endpoint it names really refuses a caller without the declared permission. - The plugin settings routes now need a permission; they were telling anyone which modules a site runs and where its components live. - The connection pool is sized explicitly with a short timeout, and the arithmetic against the server's connection ceiling is written next to the worker count instead of being left to defaults nobody chose. - Fleet alerts carry both the correct lowercase keys and the old camelCase pair. Trays older than 1.7.0 match keys case-sensitively and would have gone quiet on every PC not yet upgraded; the old pair goes when they are. - The dev server proxy points at localhost again, with environment variables for the remote-box workflow, and one developer's address is out of the server certificate page.
121 lines
4.6 KiB
Python
121 lines
4.6 KiB
Python
"""Plugin introspection + enable/disable API."""
|
|
|
|
from flask import Blueprint, current_app, request
|
|
from flask_jwt_extended import jwt_required
|
|
|
|
from shopdb.utils.responses import success_response, error_response, ErrorCodes
|
|
|
|
from shopdb.utils.authz import require_role
|
|
from shopdb.utils.authz import require_permission
|
|
|
|
plugins_bp = Blueprint('plugins', __name__)
|
|
|
|
|
|
@plugins_bp.route('', methods=['GET'])
|
|
@require_permission('settings.view')
|
|
def list_plugins():
|
|
"""List all discovered plugins (enabled or not) with their metadata and
|
|
the framework contract version."""
|
|
from shopdb import __contract_version__
|
|
pm = current_app.extensions.get('plugin_manager')
|
|
plugins = pm.discover_available() if pm else []
|
|
plugins.sort(key=lambda p: p['name'])
|
|
return success_response({
|
|
'contract_version': __contract_version__,
|
|
'count': len(plugins),
|
|
'plugins': plugins,
|
|
})
|
|
|
|
|
|
@plugins_bp.route('/enabled', methods=['GET'])
|
|
@jwt_required(optional=True)
|
|
def list_enabled_plugins():
|
|
"""Return just the names of enabled plugins as a flat array.
|
|
|
|
Cheap registry read (no DB). Exposed to anonymous callers on purpose:
|
|
the navigation endpoint already leaks the same enabled/disabled signal,
|
|
and the frontend needs it (including unauthenticated kiosk routes like
|
|
/tv) to gate plugin-owned routes. No metadata beyond the names.
|
|
"""
|
|
pm = current_app.extensions.get('plugin_manager')
|
|
names = pm.registry.get_enabled_plugins() if pm else []
|
|
return success_response(sorted(names))
|
|
|
|
|
|
@plugins_bp.route('/settings-routes', methods=['GET'])
|
|
@require_permission('settings.view')
|
|
def get_plugin_settings_routes():
|
|
"""Return settings routes contributed by all enabled plugins.
|
|
|
|
Plugins can register routes to add tabs/pages to settings hubs like
|
|
Model Catalog, Asset Config, etc. Frontend router merges these dynamically.
|
|
|
|
Gated on settings.view, the same permission list_plugins carries. It was
|
|
optional-auth and listed as a public read, on the stated reasoning that
|
|
unauthenticated pages (kiosks, TV displays) register plugin tabs before
|
|
login. Nothing does: the only caller in the frontend is
|
|
views/settings/ModelCatalogHub.vue, which sits behind requiresAuth and
|
|
requiresAdmin, and no kiosk route touches it. Open, it handed an anonymous
|
|
caller the enabled plugin list, the settings hub layout and the internal Vue
|
|
component paths - free reconnaissance about which modules a site runs. The
|
|
login page never calls this, so gating it costs nothing pre-login.
|
|
|
|
Returns: { routes: [{hub, path, name, tab, component}, ...] }
|
|
"""
|
|
pm = current_app.extensions.get('plugin_manager')
|
|
if not pm:
|
|
return success_response({'routes': []})
|
|
|
|
routes = []
|
|
for plugin_name, plugin in pm.get_all_plugins().items():
|
|
# Only include routes from enabled plugins
|
|
if not pm.registry.is_enabled(plugin_name):
|
|
continue
|
|
if not hasattr(plugin, 'get_settings_routes'):
|
|
continue
|
|
# One broken plugin must not take every settings hub down with it.
|
|
try:
|
|
plugin_routes = plugin.get_settings_routes()
|
|
except Exception:
|
|
current_app.logger.exception(
|
|
'get_settings_routes failed for plugin %s; skipping it',
|
|
plugin_name)
|
|
continue
|
|
if plugin_routes:
|
|
routes.extend(plugin_routes)
|
|
|
|
return success_response({'routes': routes})
|
|
|
|
|
|
@plugins_bp.route('/<name>', methods=['PUT'])
|
|
@jwt_required()
|
|
@require_role('admin')
|
|
def set_plugin_enabled(name: str):
|
|
"""Enable or disable a plugin. Takes effect on the next app restart for
|
|
route/navigation changes."""
|
|
data = request.get_json() or {}
|
|
if 'enabled' not in data:
|
|
return error_response(ErrorCodes.VALIDATION_ERROR, 'enabled is required')
|
|
|
|
pm = current_app.extensions.get('plugin_manager')
|
|
if not pm:
|
|
return error_response(ErrorCodes.INTERNAL_ERROR,
|
|
'Plugin manager unavailable', http_code=500)
|
|
|
|
want = bool(data['enabled'])
|
|
ok = pm.enable_plugin(name) if want else pm.disable_plugin(name)
|
|
if not ok:
|
|
# enable/disable refused (unknown plugin, or a dependency conflict)
|
|
return error_response(
|
|
ErrorCodes.CONFLICT,
|
|
f"Could not {'enable' if want else 'disable'} '{name}' "
|
|
f"(check it exists and dependencies allow it)",
|
|
http_code=409
|
|
)
|
|
|
|
return success_response(
|
|
{'name': name, 'enabled': want},
|
|
message=f"Plugin {'enabled' if want else 'disabled'} "
|
|
f"(restart to apply route changes)"
|
|
)
|