mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-10 11:27:11 +02:00
9a004fd043
Fix two issues from PR #5045 review. The Rust code generator was producing incorrect skip_serializing_if attributes: map types incorrectly used Option::is_none instead of HashMap::is_empty, and the bare int type for HTTPHandleResponse.Status fell through to the default Option::is_none case. The map fix is in skipSerializingFunc; the int issue is fixed at the source by changing Status from int to int32 (HTTP status codes always fit in int32, and this avoids platform-dependent int sizing on i386 vs amd64). Additionally, plugin HTTP responses now include forced security headers (X-Content-Type-Options: nosniff and a restrictive Content-Security-Policy with sandbox) to prevent XSS from compromised plugins serving HTML+JS on the same origin as Navidrome.
52 lines
2.2 KiB
Go
52 lines
2.2 KiB
Go
package capabilities
|
|
|
|
// HTTPEndpoint allows plugins to handle incoming HTTP requests.
|
|
// Plugins that declare the 'endpoints' permission must implement this capability.
|
|
// The host dispatches incoming HTTP requests to the plugin's HandleRequest function.
|
|
//
|
|
//nd:capability name=httpendpoint required=true
|
|
type HTTPEndpoint interface {
|
|
// HandleRequest processes an incoming HTTP request and returns a response.
|
|
//nd:export name=nd_http_handle_request
|
|
HandleRequest(HTTPHandleRequest) (HTTPHandleResponse, error)
|
|
}
|
|
|
|
// HTTPHandleRequest is the input provided when an HTTP request is dispatched to a plugin.
|
|
type HTTPHandleRequest struct {
|
|
// Method is the HTTP method (GET, POST, PUT, DELETE, PATCH, etc.).
|
|
Method string `json:"method"`
|
|
// Path is the request path relative to the plugin's base URL.
|
|
// For example, if the full URL is /ext/my-plugin/webhook, Path is "/webhook".
|
|
// Both /ext/my-plugin and /ext/my-plugin/ are normalized to Path = "".
|
|
Path string `json:"path"`
|
|
// Query is the raw query string without the leading '?'.
|
|
Query string `json:"query,omitempty"`
|
|
// Headers contains the HTTP request headers.
|
|
Headers map[string][]string `json:"headers,omitempty"`
|
|
// Body is the request body content.
|
|
Body string `json:"body,omitempty"`
|
|
// User contains the authenticated user information. Nil for auth:"none" endpoints.
|
|
User *HTTPUser `json:"user,omitempty"`
|
|
}
|
|
|
|
// HTTPUser contains authenticated user information passed to the plugin.
|
|
type HTTPUser struct {
|
|
// ID is the internal Navidrome user ID.
|
|
ID string `json:"id"`
|
|
// Username is the user's login name.
|
|
Username string `json:"username"`
|
|
// Name is the user's display name.
|
|
Name string `json:"name"`
|
|
// IsAdmin indicates whether the user has admin privileges.
|
|
IsAdmin bool `json:"isAdmin"`
|
|
}
|
|
|
|
// HTTPHandleResponse is the response returned by the plugin's HandleRequest function.
|
|
type HTTPHandleResponse struct {
|
|
// Status is the HTTP status code. Defaults to 200 if zero or not set.
|
|
Status int32 `json:"status,omitempty"`
|
|
// Headers contains the HTTP response headers to set.
|
|
Headers map[string][]string `json:"headers,omitempty"`
|
|
// Body is the response body content.
|
|
Body string `json:"body,omitempty"`
|
|
}
|