M3 plugin platform: SDK + loader, RLS-isolated tables, migrations, jobs

Backend foundation for the plugin platform (SPEC §11), Phases 1-3. Phase 1 — SDK + loader: - app/plugins/types.py: frozen Plugin/UiManifest/Slot/Page/JobSpec contract. - app/plugins/sdk.py: sdk(name) facade — the only app.* import allowed for plugins (scoped session, plugin.{name}.* publish, blob, outbox, settings, SSRF http_get, KV, enqueue). - app/plugins/loader.py: entry-point discovery (webmail.plugins), hook forwarding (API + worker), router mounting at /api/plugins/{name}, ui-manifest aggregation. - plugin_kv core table (migration 0013) + GET /api/plugins/ui-manifest. Phase 2 — non-removable core plugins + DB-enforced privacy: - builtin flag (calendar/contacts will be builtin=True; uninstall refuses them). - RLS per-user isolation on plg_* tables: least-privilege webmail_plugin role (migration 0014), plugin_session(user_id) sets LOCAL ROLE + app.current_user_id, rls.enable_rls() (ENABLE+FORCE RLS + USING/WITH CHECK policy). Mail untouched. - Per-plugin Alembic runner (shared env, dedicated version table) + install/uninstall --drop-data CLI; skeleton fixture proves install -> run -> uninstall --drop-data leaves zero residue (§12 M3 acceptance). Phase 3 — plugin jobs (§11.2): - JobSpec registered as arq function plg.{plugin}.{func} + cron (5-field parser); singleton=True guarded by a per-(plugin,user) Redis lock; wired onto the shared interactive worker. Gates: ruff, mypy --strict (94 files + tests), full suite 326 passed. RLS isolation, migration round-trip, and singleton lock covered by tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Rcj3TpydMTzTSmU7kunzf8
2026-07-26 21:42:35 +02:00
parent 4d5a30cffb
commit 4e077f1a37
31 changed files with 1766 additions and 2 deletions
@@ -0,0 +1,73 @@
+"""GET /api/plugins/ui-manifest returns the aggregated manifest (SPEC §11.3)."""
+
+from __future__ import annotations
+
+import uuid
+
+import httpx
+from httpx import ASGITransport
+from sqlalchemy import delete
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import get_settings
+from app.identity.passwords import hash_password
+from app.identity.sessions import create_session
+from app.main import create_app
+from app.models import User
+from app.plugins import loader
+from app.plugins.sdk import Plugin, Slot, UiManifest
+
+
+async def test_ui_manifest_endpoint() -> None:
+    engine = create_async_engine(get_settings().database_url, poolclass=NullPool)
+    sm = async_sessionmaker(engine, expire_on_commit=False)
+    session = sm()
+    user = User(handle=f"ui{uuid.uuid4().hex[:8]}@test.local", password_hash=hash_password("pw"))
+    session.add(user)
+    await session.commit()
+
+    loader.set_plugins_for_test(
+        [
+            Plugin(
+                name="labels",
+                version="1.0",
+                ui_manifest=UiManifest(slots=[Slot(name="message.actions", bundle="/labels.js")]),
+            )
+        ]
+    )
+
+    token = await create_session(user.id, "pytest")
+    transport = ASGITransport(app=create_app())
+    client = httpx.AsyncClient(
+        transport=transport, base_url="http://testserver", cookies={"session": token}
+    )
+    try:
+        # Unauthenticated request is rejected.
+        async with httpx.AsyncClient(
+            transport=transport, base_url="http://testserver"
+        ) as anon:
+            assert (await anon.get("/api/plugins/ui-manifest")).status_code == 401
+
+        resp = await client.get("/api/plugins/ui-manifest")
+        assert resp.status_code == 200
+        body = resp.json()
+        assert body == {
+            "plugins": [
+                {
+                    "name": "labels",
+                    "version": "1.0",
+                    "builtin": False,
+                    "slots": [{"name": "message.actions", "bundle": "/labels.js"}],
+                    "pages": [],
+                    "capabilities": {},
+                }
+            ]
+        }
+    finally:
+        await client.aclose()
+        async with sm() as cleanup:
+            await cleanup.execute(delete(User).where(User.id == user.id))
+            await cleanup.commit()
+        await session.close()
+        await engine.dispose()