https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35837 --- Comment #26 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 206485 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206485&action=edit Bug 35837: Add a REST API for installing plugin-store plugins Adds Koha::REST::V1::Plugins, exposing plugin discovery and install over /api/v1/plugins: * GET /plugins -- list installed plugins, with the fields the Plugin store's own "already installed"/"update available" checks need * POST /plugins -- install a plugin from a kpz_url * POST /plugins/upload -- install a plugin from a locally uploaded .kpz file * GET /plugins/config -- the current user's plugin permissions add() and upload() both delegate to Koha::Plugins::Install for the actual verification/extraction; this controller's job is fetching the file, mapping Koha::Plugins::Install's error codes to HTTP responses (a fixed priority order picks one code to report when several checks fail at once, since Perl hash order can't be relied on), and permission enforcement (plugins: manage for both install routes). add()'s download deliberately goes through Mojo::UserAgent with redirects enabled rather than a simpler fetch -- GitHub and GitLab release-asset URLs, the common case for a real kpz_url, always 302 to a signed, time-limited storage URL. The repo-origin restriction check runs before that fetch, not after: checking it only once the file is already downloaded would mean the restriction could never actually prevent the request, only the install. Test plan: 1. prove t/db_dependent/api/v1/plugins.t 2. As a user with only the plugins "manage" sub-permission (not the full plugins block flag), confirm both POST /plugins and POST /plugins/upload succeed. 3. With plugins_restricted enabled and a kpz_url whose origin isn't on the plugin_repos allowlist, confirm the request is rejected with RESTRICTED and that the server never actually fetches the URL. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> -- You are receiving this mail because: You are watching all bug changes.