pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-06 07:12:12 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(plugins): plugins framework + per-API-key disable-non-public-models (#3041)

Browse Source 
Integrates two community contributions into release/v3.8.8 with security hardening and conflict resolution.

- **Plugins framework** (#2913 — thanks @oyi77): hooks + registry unification, plugin SDK (`definePlugin`), worker-thread sandbox, per-plugin hook rate limiting, SHA-256 integrity verification, semver-gated upgrade, and execution analytics. Plugin routes are loopback-only (`isLocalOnlyPath`); `child_process` exec is opt-in via `OMNIROUTE_PLUGINS_ALLOW_EXEC` (default off).
- **API key option: disable non-published models** (#3017 — thanks @androw): a per-key flag restricting the key to discovered public models (combos / `auto/*` / `qtSd/*` routing still allowed).

Hardening applied during integration: migration renumber (089/090/091), `/api/plugins` LOCAL_ONLY route-guard classification (closes the plugin-RCE vector), atomic install/upgrade with path containment, `O_EXCL` tmp-file creation (TOCTOU), rate-limit-map eviction, `validatePluginConfig` on configure, `buildErrorBody` on all plugin error paths. 246/246 tests; typecheck / cycles / docs-sync clean.

Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Nicolas Lorin <androw95220@gmail.com>
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-06-01 15:43:55 -03:00
committed by GitHub
parent 89c52d4f04
commit 20c31493af
63 changed files with 6227 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/app/api/plugins/[name]/activate/route.ts
View File

@@ -1,5 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
import { buildErrorBody } from "@omniroute/open-sse/utils/error";
import { pluginManager } from "@/lib/plugins/manager";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
@@ -24,7 +25,11 @@ export async function POST(
{ success: true, message: `Plugin '${name}' activated` },
{ headers: CORS_HEADERS }
);
} catch (err: any) {
return NextResponse.json({ error: err.message }, { status: 400, headers: CORS_HEADERS });
} catch (err: unknown) {
console.error("[plugins] Failed to activate plugin:", err);
return NextResponse.json(buildErrorBody(400, "Failed to activate plugin"), {
status: 400,
headers: CORS_HEADERS,
});
}
}

43
src/app/api/plugins/[name]/config/route.ts
View File

@@ -1,5 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
import { buildErrorBody } from "@omniroute/open-sse/utils/error";
import { getPluginByName, updatePluginConfig } from "@/lib/db/plugins";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
import { z } from "zod";
@@ -18,10 +19,10 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
const plugin = getPluginByName(name);
if (!plugin) {
return NextResponse.json(
{ error: `Plugin '${name}' not found` },
{ status: 404, headers: CORS_HEADERS }
);
return NextResponse.json(buildErrorBody(404, `Plugin '${name}' not found`), {
status: 404,
headers: CORS_HEADERS,
});
}
return NextResponse.json(
@@ -48,18 +49,18 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
const parsed = schema.safeParse(body);
if (!parsed.success) {
return NextResponse.json(
{ error: "Invalid request", details: parsed.error.issues },
{ status: 400, headers: CORS_HEADERS }
);
return NextResponse.json(buildErrorBody(400, "Invalid request"), {
status: 400,
headers: CORS_HEADERS,
});
}
const plugin = getPluginByName(name);
if (!plugin) {
return NextResponse.json(
{ error: `Plugin '${name}' not found` },
{ status: 404, headers: CORS_HEADERS }
);
return NextResponse.json(buildErrorBody(404, `Plugin '${name}' not found`), {
status: 404,
headers: CORS_HEADERS,
});
}
// Validate config values against configSchema if defined
@@ -70,21 +71,21 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
if (!field) continue; // Allow extra keys
if (field.type === "number" && typeof value === "number") {
if (field.min !== undefined && value < field.min) {
return NextResponse.json(
{ error: `Config '${key}' must be >= ${field.min}` },
{ status: 400, headers: CORS_HEADERS }
);
return NextResponse.json(buildErrorBody(400, `Config '${key}' must be >= ${field.min}`), {
status: 400,
headers: CORS_HEADERS,
});
}
if (field.max !== undefined && value > field.max) {
return NextResponse.json(
{ error: `Config '${key}' must be <= ${field.max}` },
{ status: 400, headers: CORS_HEADERS }
);
return NextResponse.json(buildErrorBody(400, `Config '${key}' must be <= ${field.max}`), {
status: 400,
headers: CORS_HEADERS,
});
}
}
if (field.type === "select" && field.enum && !field.enum.includes(String(value))) {
return NextResponse.json(
{ error: `Config '${key}' must be one of: ${field.enum.join(", ")}` },
buildErrorBody(400, `Config '${key}' must be one of: ${field.enum.join(", ")}`),
{ status: 400, headers: CORS_HEADERS }
);
}

9
src/app/api/plugins/[name]/deactivate/route.ts
View File

@@ -1,5 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
import { buildErrorBody } from "@omniroute/open-sse/utils/error";
import { pluginManager } from "@/lib/plugins/manager";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
@@ -24,7 +25,11 @@ export async function POST(
{ success: true, message: `Plugin '${name}' deactivated` },
{ headers: CORS_HEADERS }
);
} catch (err: any) {
return NextResponse.json({ error: err.message }, { status: 400, headers: CORS_HEADERS });
} catch (err: unknown) {
console.error("[plugins] Failed to deactivate plugin:", err);
return NextResponse.json(buildErrorBody(400, "Failed to deactivate plugin"), {
status: 400,
headers: CORS_HEADERS,
});
}
}

9
src/app/api/plugins/[name]/route.ts
View File

@@ -1,5 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
import { buildErrorBody } from "@omniroute/open-sse/utils/error";
import { getPluginByName } from "@/lib/db/plugins";
import { pluginManager } from "@/lib/plugins/manager";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
@@ -70,7 +71,11 @@ export async function DELETE(
{ success: true, message: `Plugin '${name}' uninstalled` },
{ headers: CORS_HEADERS }
);
} catch (err: any) {
return NextResponse.json({ error: err.message }, { status: 400, headers: CORS_HEADERS });
} catch (err: unknown) {
console.error("[plugins] Failed to uninstall plugin:", err);
return NextResponse.json(buildErrorBody(400, "Failed to uninstall plugin"), {
status: 400,
headers: CORS_HEADERS,
});
}
}

34
src/app/api/plugins/route.ts
View File

@@ -1,5 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
import { buildErrorBody } from "@omniroute/open-sse/utils/error";
import { listPlugins } from "@/lib/db/plugins";
import { pluginManager } from "@/lib/plugins/manager";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
@@ -12,17 +13,29 @@ export async function OPTIONS() {
/**
* GET /api/plugins — List all installed plugins
*/
const StatusSchema = z.enum(["installed", "active", "inactive", "error"]).optional();
export async function GET(request: NextRequest) {
const authError = await requireManagementAuth(request);
if (authError) return authError;
const url = new URL(request.url);
const status = url.searchParams.get("status") as any;
const statusResult = StatusSchema.safeParse(url.searchParams.get("status"));
if (!statusResult.success) {
return NextResponse.json(
{ error: "Invalid status value", details: statusResult.error.issues },
{ status: 400, headers: CORS_HEADERS }
);
}
try {
const plugins = listPlugins(status || undefined);
const plugins = listPlugins(statusResult.data || undefined);
return NextResponse.json({ plugins: plugins.map(formatPlugin) }, { headers: CORS_HEADERS });
} catch (err: any) {
return NextResponse.json({ error: err.message }, { status: 500, headers: CORS_HEADERS });
} catch (err: unknown) {
console.error("[plugins] Failed to list plugins:", err);
return NextResponse.json(buildErrorBody(500, "Failed to list plugins"), {
status: 500,
headers: CORS_HEADERS,
});
}
}
@@ -34,7 +47,10 @@ export async function POST(request: NextRequest) {
if (authError) return authError;
const body = await request.json();
const schema = z.object({
path: z.string().min(1),
path: z.string().min(1).regex(/^\/[^]*$/, "Path must be absolute").refine(
(p) => !p.includes("\0") && !p.includes(".."),
"Path must not contain traversal patterns or null bytes"
),
});
const parsed = schema.safeParse(body);
@@ -51,8 +67,12 @@ export async function POST(request: NextRequest) {
{ plugin: formatPlugin(plugin) },
{ status: 201, headers: CORS_HEADERS }
);
} catch (err: any) {
return NextResponse.json({ error: err.message }, { status: 400, headers: CORS_HEADERS });
} catch (err: unknown) {
console.error("[plugins] Failed to install plugin:", err);
return NextResponse.json(buildErrorBody(400, "Failed to install plugin"), {
status: 400,
headers: CORS_HEADERS,
});
}
}

9
src/app/api/plugins/scan/route.ts
View File

@@ -1,5 +1,6 @@
import { NextRequest, NextResponse } from "next/server";
import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
import { buildErrorBody } from "@omniroute/open-sse/utils/error";
import { pluginManager } from "@/lib/plugins/manager";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
@@ -19,7 +20,11 @@ export async function POST(request: NextRequest) {
{ discovered: result.discovered, errors: result.errors },
{ headers: CORS_HEADERS }
);
} catch (err: any) {
return NextResponse.json({ error: err.message }, { status: 500, headers: CORS_HEADERS });
} catch (err: unknown) {
console.error("[plugins] Failed to scan plugin directory:", err);
return NextResponse.json(buildErrorBody(500, "Failed to scan plugin directory"), {
status: 500,
headers: CORS_HEADERS,
});
}
}