From 147fac61d919cf239f257b75bb908dd21dc8b3c3 Mon Sep 17 00:00:00 2001
From: Luke Policinski <luke@lukepolo.com>
Date: Sun, 19 Jul 2026 10:40:45 -0400
Subject: [PATCH] chore: plugin auth

---
 src/app.module.ts                              |  4 ++--
 src/custom-pages/custom-pages.module.ts        |  7 -------
 .../plugins.controller.ts}                     | 18 ++++++++++++++----
 src/plugins/plugins.module.ts                  |  7 +++++++
 src/system/system.service.ts                   |  6 +++---
 5 files changed, 26 insertions(+), 16 deletions(-)
 delete mode 100644 src/custom-pages/custom-pages.module.ts
 rename src/{custom-pages/custom-pages.controller.ts => plugins/plugins.controller.ts} (90%)
 create mode 100644 src/plugins/plugins.module.ts

diff --git a/src/app.module.ts b/src/app.module.ts
index a6ad00cb..4fcc3ca7 100644
--- a/src/app.module.ts
+++ b/src/app.module.ts
@@ -56,7 +56,7 @@ import { NewsModule } from "./news/news.module";
 import { EventsModule } from "./events/events.module";
 import { ScrimsModule } from "./scrims/scrims.module";
 import { LeaguesModule } from "./leagues/leagues.module";
-import { CustomPagesModule } from "./custom-pages/custom-pages.module";
+import { PluginsModule } from "./plugins/plugins.module";
 
 @Module({
   imports: [
@@ -153,7 +153,7 @@ import { CustomPagesModule } from "./custom-pages/custom-pages.module";
     EventsModule,
     ScrimsModule,
     LeaguesModule,
-    CustomPagesModule,
+    PluginsModule,
   ],
   providers: [loggerFactory()],
   controllers: [AppController, QuickConnectController],
diff --git a/src/custom-pages/custom-pages.module.ts b/src/custom-pages/custom-pages.module.ts
deleted file mode 100644
index 2d5caf58..00000000
--- a/src/custom-pages/custom-pages.module.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-import { Module } from "@nestjs/common";
-import { CustomPagesController } from "./custom-pages.controller";
-
-@Module({
-  controllers: [CustomPagesController],
-})
-export class CustomPagesModule {}
diff --git a/src/custom-pages/custom-pages.controller.ts b/src/plugins/plugins.controller.ts
similarity index 90%
rename from src/custom-pages/custom-pages.controller.ts
rename to src/plugins/plugins.controller.ts
index 7dbb6d7a..054172b0 100644
--- a/src/custom-pages/custom-pages.controller.ts
+++ b/src/plugins/plugins.controller.ts
@@ -5,11 +5,13 @@ import { isRoleAbove } from "src/utilities/isRoleAbove";
 import { e_player_roles_enum } from "generated";
 import { SystemService } from "src/system/system.service";
 
-@Controller("custom-pages")
-export class CustomPagesController {
+// "custom-pages" is the pre-rename path. Deployed plugin ingresses hardcode it
+// in their auth-url annotation, so dropping it would break them on upgrade.
+@Controller(["plugins", "custom-pages"])
+export class PluginsController {
   @Get("authorize")
   public authorize(@Req() request: Request, @Res() response: Response) {
-    // nginx forward-auth runs this for every request to a custom-page backend,
+    // nginx forward-auth runs this for every request to a plugin backend,
     // including the CORS preflight. Preflight (OPTIONS) requests never carry
     // cookies, so gating them would 401 the preflight and surface as a CORS
     // error before the real credentialed request is sent. Let them through.
@@ -36,7 +38,15 @@ export class CustomPagesController {
     response.setHeader("X-5stack-Steam-Id", user.steam_id);
     response.setHeader("X-5stack-Role", user.role);
     response.setHeader("X-5stack-Name", encodeURIComponent(user.name ?? ""));
-    return response.status(200).end();
+
+    // nginx discards the body on an auth subrequest, so serving JSON here costs
+    // the forward-auth path nothing while letting a plugin backend validate a
+    // cookie server-side against this same endpoint.
+    return response.status(200).json({
+      steam_id: user.steam_id,
+      role: user.role,
+      name: user.name ?? "",
+    });
   }
 
   @Options("authorize")
diff --git a/src/plugins/plugins.module.ts b/src/plugins/plugins.module.ts
new file mode 100644
index 00000000..c0f0135f
--- /dev/null
+++ b/src/plugins/plugins.module.ts
@@ -0,0 +1,7 @@
+import { Module } from "@nestjs/common";
+import { PluginsController } from "./plugins.controller";
+
+@Module({
+  controllers: [PluginsController],
+})
+export class PluginsModule {}
diff --git a/src/system/system.service.ts b/src/system/system.service.ts
index 5ce56896..eb9c810d 100644
--- a/src/system/system.service.ts
+++ b/src/system/system.service.ts
@@ -33,7 +33,7 @@ export class SystemService {
     "hasura",
   ];
 
-  // Deployment names a custom page is never allowed to claim. A plugin manifest
+  // Deployment names a plugin is never allowed to claim. A plugin manifest
   // is third-party input, so without this a plugin declaring `deployments:
   // ["api"]` would render an Update button that restarts the panel itself.
   private static RESERVED_DEPLOYMENTS = [
@@ -452,7 +452,7 @@ export class SystemService {
     return services;
   }
 
-  // Deployments declared by registered custom pages. The image is read off the
+  // Deployments declared by registered plugins. The image is read off the
   // live deployment rather than the plugin manifest, so it can never drift from
   // what is actually running -- the manifest only supplies the name.
   private async getPluginServices() {
@@ -481,7 +481,7 @@ export class SystemService {
         },
       }));
     } catch (error) {
-      this.logger.warn("unable to fetch custom pages", error);
+      this.logger.warn("unable to fetch plugins", error);
       return services;
     }