mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-20 05:42:19 +03:00
Integrates two community contributions into release/v3.8.8 with security hardening and conflict resolution. - **Plugins framework** (#2913 — thanks @oyi77): hooks + registry unification, plugin SDK (`definePlugin`), worker-thread sandbox, per-plugin hook rate limiting, SHA-256 integrity verification, semver-gated upgrade, and execution analytics. Plugin routes are loopback-only (`isLocalOnlyPath`); `child_process` exec is opt-in via `OMNIROUTE_PLUGINS_ALLOW_EXEC` (default off). - **API key option: disable non-published models** (#3017 — thanks @androw): a per-key flag restricting the key to discovered public models (combos / `auto/*` / `qtSd/*` routing still allowed). Hardening applied during integration: migration renumber (089/090/091), `/api/plugins` LOCAL_ONLY route-guard classification (closes the plugin-RCE vector), atomic install/upgrade with path containment, `O_EXCL` tmp-file creation (TOCTOU), rate-limit-map eviction, `validatePluginConfig` on configure, `buildErrorBody` on all plugin error paths. 246/246 tests; typecheck / cycles / docs-sync clean. Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com> Co-authored-by: Nicolas Lorin <androw95220@gmail.com>
31 lines
1.0 KiB
TypeScript
31 lines
1.0 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
|
|
import { buildErrorBody } from "@omniroute/open-sse/utils/error";
|
|
import { pluginManager } from "@/lib/plugins/manager";
|
|
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
|
|
|
|
export async function OPTIONS() {
|
|
return handleCorsOptions();
|
|
}
|
|
|
|
/**
|
|
* POST /api/plugins/scan — Scan plugin directory for new plugins
|
|
*/
|
|
export async function POST(request: NextRequest) {
|
|
const authError = await requireManagementAuth(request);
|
|
if (authError) return authError;
|
|
try {
|
|
const result = await pluginManager.scan();
|
|
return NextResponse.json(
|
|
{ discovered: result.discovered, errors: result.errors },
|
|
{ headers: CORS_HEADERS }
|
|
);
|
|
} catch (err: unknown) {
|
|
console.error("[plugins] Failed to scan plugin directory:", err);
|
|
return NextResponse.json(buildErrorBody(500, "Failed to scan plugin directory"), {
|
|
status: 500,
|
|
headers: CORS_HEADERS,
|
|
});
|
|
}
|
|
}
|