feat: add plugin system (#1034)

* feat: add plugin system * fix db docker build * fix hammerhead readme, add strava subscription news to docs * fixes and sdk improvements * fix: reduce Meilisearch load, debounce federation sync (#1012) * optimize meili trail index * several fixes --------- Co-authored-by: Flomp <Flomp@users.noreply.github.com> * Bump svelte from 5.55.5 to 5.56.0 in /docs (#1032) Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.56.0. - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.0/packages/svelte) --- updated-dependencies: - dependency-name: svelte dependency-version: 5.56.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <Flomp@users.noreply.github.com> * Release v0.19.2 (#1035) * chore: release v0.19.2 * add changelog --------- Co-authored-by: Flomp <26000991+Flomp@users.noreply.github.com> Co-authored-by: Christian Beutel <> * speed up plugin sync and several small fixes * concepts for security improvements and process stability * improve concept * security concept implemented * remove insecure TLS * worker concept implemented * fixes and cleanup * fixes * docu * mermaid, namings * WASM plugin host improvements, plugin logging * fix db migration * Improve plugin config and category mapping UI * fixes * further fixes * remove manual test sync * fix db migration and strava mapping * type added, UI improvements * fix plugin card toggle clickable area * optimize synch status card layout * plugin type 'trails' instead of 'integration' * session auth validation in UI * fix komoot date and waypoints * improve category mapping * fix send to hammerhead: trail name * plugin setup error handling improved * fix review findings * re-mapping added * rename remote_category --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Flomp <Flomp@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Flomp <26000991+Flomp@users.noreply.github.com>
2026-06-22 15:00:44 +02:00
parent 2e3d8537b8
commit 485ec53f6d
196 changed files with 20947 additions and 5454 deletions
--- a/db/pluginsystem/oauth.go
+++ b/db/pluginsystem/oauth.go
@@ -0,0 +1,335 @@
+package pluginsystem
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+const (
+	AuthFieldOAuthContext = "oauthContext"
+	AuthFieldTokenType    = "tokenType"
+	AuthFieldExpiresAt    = "expiresAt"
+	AuthFieldScope        = "scope"
+)
+
+type OAuthTokenResponse struct {
+	AccessToken  string          `json:"access_token"`
+	RefreshToken string          `json:"refresh_token,omitempty"`
+	TokenType    string          `json:"token_type,omitempty"`
+	ExpiresIn    int             `json:"expires_in,omitempty"`
+	Scope        string          `json:"scope,omitempty"`
+	Raw          json.RawMessage `json:"-"`
+}
+
+// OAuthContext selects the OAuth auth context declared by a plugin. When the UI
+// does not request a specific context, the first context by name is used.
+func OAuthContext(plugin LocalPlugin, requested string) (string, AuthContext, error) {
+	names := make([]string, 0, len(plugin.Manifest.Auth.Contexts))
+	for name := range plugin.Manifest.Auth.Contexts {
+		names = append(names, name)
+	}
+	slices.Sort(names)
+	for _, name := range names {
+		context := plugin.Manifest.Auth.Contexts[name]
+		if requested != "" && requested != name {
+			continue
+		}
+		if context.Type == AuthTypeOAuth2 {
+			return name, context, nil
+		}
+	}
+	return "", AuthContext{}, fmt.Errorf("plugin has no oauth auth context")
+}
+
+// ValidateOAuthRedirectURI accepts only the frontend plugin OAuth callback and,
+// when ORIGIN is configured, requires the same external origin.
+func ValidateOAuthRedirectURI(raw string) error {
+	redirectURL, err := url.Parse(raw)
+	if err != nil {
+		return err
+	}
+	if redirectURL.Scheme != "http" && redirectURL.Scheme != "https" {
+		return fmt.Errorf("redirect uri scheme must be http or https")
+	}
+	if redirectURL.Host == "" {
+		return fmt.Errorf("redirect uri must be absolute")
+	}
+	if redirectURL.Path != "/settings/plugins/oauth/callback" {
+		return fmt.Errorf("redirect uri path is not allowed")
+	}
+	if origin := strings.TrimRight(os.Getenv("ORIGIN"), "/"); origin != "" {
+		originURL, err := url.Parse(origin)
+		if err != nil {
+			return err
+		}
+		if !strings.EqualFold(redirectURL.Scheme, originURL.Scheme) || !strings.EqualFold(redirectURL.Host, originURL.Host) {
+			return fmt.Errorf("redirect uri origin does not match ORIGIN")
+		}
+	}
+	return nil
+}
+
+func NewOAuthState(size int) string {
+	return randomURLToken(size)
+}
+
+func NewOAuthCodeVerifier(size int) string {
+	return randomURLToken(size)
+}
+
+func PKCEChallenge(verifier string) string {
+	hash := sha256.Sum256([]byte(verifier))
+	return base64.RawURLEncoding.EncodeToString(hash[:])
+}
+
+// ExchangeOAuthToken performs the host-owned OAuth token exchange or refresh.
+// The token endpoint must be allowed by the plugin manifest network policy.
+func ExchangeOAuthToken(ctx context.Context, manifest Manifest, authContext AuthContext, auth map[string]any, values map[string]string) (*OAuthTokenResponse, error) {
+	tokenURL, err := url.Parse(authContext.TokenURL)
+	if err != nil {
+		return nil, err
+	}
+	if tokenURL.Scheme != "http" && tokenURL.Scheme != "https" {
+		return nil, fmt.Errorf("oauth token url scheme must be http or https")
+	}
+	if !OAuthTokenURLAllowed(manifest, tokenURL) {
+		return nil, fmt.Errorf("oauth token host %q is not allowed by manifest permissions", tokenURL.Hostname())
+	}
+
+	clientID := StringFromAny(auth["clientId"])
+	clientSecret := StringFromAny(auth[AuthFieldClientSecret])
+	if clientID == "" {
+		return nil, fmt.Errorf("clientId is required")
+	}
+
+	bodyValues := url.Values{}
+	for key, value := range values {
+		if value != "" {
+			bodyValues.Set(key, value)
+		}
+	}
+	bodyValues.Set("client_id", clientID)
+	if authContext.TokenAuth == "" || authContext.TokenAuth == TokenAuthClientSecretPost {
+		if clientSecret != "" {
+			bodyValues.Set("client_secret", clientSecret)
+		}
+	}
+
+	var body []byte
+	contentType := "application/x-www-form-urlencoded"
+	if authContext.TokenRequestFormat == TokenRequestFormatJSON {
+		jsonBody := map[string]string{}
+		for key, value := range bodyValues {
+			if len(value) > 0 {
+				jsonBody[key] = value[0]
+			}
+		}
+		var err error
+		body, err = json.Marshal(jsonBody)
+		if err != nil {
+			return nil, err
+		}
+		contentType = "application/json"
+	} else {
+		body = []byte(bodyValues.Encode())
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, tokenURL.String(), bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", contentType)
+	req.Header.Set("Accept", "application/json")
+	if authContext.TokenAuth == TokenAuthClientSecretBasic && clientSecret != "" {
+		req.SetBasicAuth(clientID, clientSecret)
+	}
+
+	client := &http.Client{
+		Timeout: 30 * time.Second,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("%s: %s", resp.Status, strings.TrimSpace(string(respBody)))
+	}
+	var token OAuthTokenResponse
+	token.Raw = append([]byte{}, respBody...)
+	if err := json.Unmarshal(respBody, &token); err != nil {
+		return nil, err
+	}
+	if token.AccessToken == "" {
+		return nil, fmt.Errorf("oauth token response has no access_token")
+	}
+	return &token, nil
+}
+
+func OAuthTokenURLAllowed(manifest Manifest, tokenURL *url.URL) bool {
+	for _, connector := range manifest.Permissions.Network.Connectors {
+		if connector.Type != ConnectorTypePublicAPI {
+			continue
+		}
+		baseURL, basePath, err := NormalizeConnectorBase(connector.FixedBaseURL, "")
+		if err != nil {
+			continue
+		}
+		target := ResolvedConnectorTarget{
+			Name:                connector.Name,
+			Type:                connector.Type,
+			BaseURL:             baseURL,
+			BasePath:            basePath,
+			AllowedPathPrefixes: connector.AllowedPathPrefixes,
+		}
+		if err := ValidateConnectorURL(target, tokenURL); err == nil {
+			return true
+		}
+	}
+	return false
+}
+
+// RefreshOAuthToken uses the stored refresh token, persists the refreshed auth
+// map, and keeps the plugin instance configured when refresh succeeds.
+func RefreshOAuthToken(ctx context.Context, app core.App, plugin LocalPlugin, instance *core.Record, auth map[string]any, contextName string) (map[string]any, error) {
+	_, authContext, err := OAuthContext(plugin, contextName)
+	if err != nil {
+		return auth, err
+	}
+	grantType := "refresh_token"
+	if authContext.Refresh != nil && authContext.Refresh.GrantType != "" {
+		grantType = authContext.Refresh.GrantType
+	}
+	refreshToken := StringFromAny(auth[AuthFieldRefreshToken])
+	if refreshToken == "" {
+		return auth, fmt.Errorf("refreshToken is missing")
+	}
+	token, err := ExchangeOAuthToken(ctx, plugin.Manifest, authContext, auth, map[string]string{
+		"grant_type":    grantType,
+		"refresh_token": refreshToken,
+	})
+	if err != nil {
+		return auth, err
+	}
+	if token.RefreshToken == "" {
+		token.RefreshToken = refreshToken
+	}
+	StoreOAuthToken(auth, contextName, token)
+	instance.Set("auth", auth)
+	instance.Set("status", "configured")
+	if err := app.Save(instance); err != nil {
+		return auth, err
+	}
+	return auth, nil
+}
+
+// StoreOAuthToken normalizes provider token responses into the plugin instance
+// auth map used by host injection and future refreshes.
+func StoreOAuthToken(auth map[string]any, contextName string, token *OAuthTokenResponse) {
+	auth[AuthFieldOAuthContext] = contextName
+	auth[AuthFieldAccessToken] = token.AccessToken
+	if token.RefreshToken != "" {
+		auth[AuthFieldRefreshToken] = token.RefreshToken
+	}
+	if token.TokenType != "" {
+		auth[AuthFieldTokenType] = token.TokenType
+	}
+	if token.Scope != "" {
+		auth[AuthFieldScope] = token.Scope
+	}
+	if token.ExpiresIn > 0 {
+		auth[AuthFieldExpiresAt] = time.Now().Add(time.Duration(token.ExpiresIn) * time.Second).UTC().Format(time.RFC3339)
+	}
+}
+
+// ClearOAuthToken removes persisted OAuth token material and transient OAuth
+// flow fields from an auth map.
+func ClearOAuthToken(auth map[string]any) {
+	for _, key := range []string{
+		AuthFieldAccessToken,
+		AuthFieldRefreshToken,
+		AuthFieldTokenType,
+		AuthFieldExpiresAt,
+		AuthFieldScope,
+		AuthFieldOAuthState,
+		AuthFieldOAuthCodeVerifier,
+		AuthFieldOAuthRedirectURI,
+	} {
+		delete(auth, key)
+	}
+}
+
+// PluginInputAuth returns the auth payload visible to plugin exports. OAuth
+// token material is intentionally removed because provider requests should go
+// through host auth injection instead.
+func PluginInputAuth(plugin LocalPlugin, auth map[string]any) map[string]any {
+	out := map[string]any{}
+	for key, value := range auth {
+		out[key] = value
+	}
+	for _, context := range plugin.Manifest.Auth.Contexts {
+		if context.Type == AuthTypeOAuth2 {
+			for _, key := range PluginInputAuthBlockedFields() {
+				delete(out, key)
+			}
+		}
+	}
+	return out
+}
+
+// RefreshOAuthAuthIfNeeded refreshes host-managed OAuth before a sync run if no
+// access token exists or the current token is close to expiry.
+func RefreshOAuthAuthIfNeeded(ctx context.Context, app core.App, plugin LocalPlugin, instance *core.Record, auth map[string]any) (map[string]any, error) {
+	for name, authContext := range plugin.Manifest.Auth.Contexts {
+		if authContext.Type != AuthTypeOAuth2 {
+			continue
+		}
+		if StringFromAny(auth[AuthFieldAccessToken]) == "" || OAuthNeedsRefresh(auth) {
+			return RefreshOAuthToken(ctx, app, plugin, instance, auth, name)
+		}
+	}
+	return auth, nil
+}
+
+func OAuthNeedsRefresh(auth map[string]any) bool {
+	expiresAt := StringFromAny(auth[AuthFieldExpiresAt])
+	if expiresAt == "" {
+		return false
+	}
+	parsed, err := time.Parse(time.RFC3339, expiresAt)
+	if err != nil {
+		return false
+	}
+	return time.Until(parsed) < time.Minute
+}
+
+func StringFromAny(value any) string {
+	text, _ := value.(string)
+	return strings.TrimSpace(text)
+}
+
+func randomURLToken(size int) string {
+	data := make([]byte, size)
+	if _, err := rand.Read(data); err != nil {
+		panic(err)
+	}
+	return base64.RawURLEncoding.EncodeToString(data)
+}