chore: plugin auth

src/app.module.ts

@@ -56,7 +56,7 @@ import { NewsModule } from "./news/news.module";
 import { EventsModule } from "./events/events.module";
 import { ScrimsModule } from "./scrims/scrims.module";
 import { LeaguesModule } from "./leagues/leagues.module";
-import { CustomPagesModule } from "./custom-pages/custom-pages.module";
+import { PluginsModule } from "./plugins/plugins.module";
 
 @Module({
   imports: [
@@ -153,7 +153,7 @@ import { CustomPagesModule } from "./custom-pages/custom-pages.module";
     EventsModule,
     ScrimsModule,
     LeaguesModule,
-    CustomPagesModule,
+    PluginsModule,
   ],
   providers: [loggerFactory()],
   controllers: [AppController, QuickConnectController],

src/custom-pages/custom-pages.controller.ts → src/plugins/plugins.controller.ts

@@ -5,11 +5,13 @@
 import { e_player_roles_enum } from "generated";
 import { SystemService } from "src/system/system.service";
 
-@Controller("custom-pages")
-export class CustomPagesController {
+// "custom-pages" is the pre-rename path. Deployed plugin ingresses hardcode it
+// in their auth-url annotation, so dropping it would break them on upgrade.
+@Controller(["plugins", "custom-pages"])
+export class PluginsController {
   @Get("authorize")
   public authorize(@Req() request: Request, @Res() response: Response) {
-    // nginx forward-auth runs this for every request to a custom-page backend,
+    // nginx forward-auth runs this for every request to a plugin backend,
     // including the CORS preflight. Preflight (OPTIONS) requests never carry
     // cookies, so gating them would 401 the preflight and surface as a CORS
     // error before the real credentialed request is sent. Let them through.
@@ -36,7 +38,15 @@
     response.setHeader("X-5stack-Steam-Id", user.steam_id);
     response.setHeader("X-5stack-Role", user.role);
     response.setHeader("X-5stack-Name", encodeURIComponent(user.name ?? ""));
-    return response.status(200).end();
+
+    // nginx discards the body on an auth subrequest, so serving JSON here costs
+    // the forward-auth path nothing while letting a plugin backend validate a
+    // cookie server-side against this same endpoint.
+    return response.status(200).json({
+      steam_id: user.steam_id,
+      role: user.role,
+      name: user.name ?? "",
+    });
   }
 
   @Options("authorize")
@@ -60,7 +70,7 @@
       return response.status(400).json({ error: "invalid url" });
     }
 
     if (CustomPagesController.isPrivateHost(raw)) {
       return response.status(400).json({ error: "invalid url" });
     }
 
@@ -106,7 +116,7 @@
         scope: manifest.scope ?? null,
         module: manifest.module ?? manifest.exposedModule ?? null,
         requiredRole: manifest.requiredRole ?? null,
         deployments: CustomPagesController.resolveDeployments(
           manifest.deployments,
         ),
       });

src/plugins/plugins.module.ts

@@ -0,0 +1,7 @@
+import { Module } from "@nestjs/common";
+import { PluginsController } from "./plugins.controller";
+
+@Module({
+  controllers: [PluginsController],
+})
+export class PluginsModule {}

src/system/system.service.ts

@@ -33,7 +33,7 @@ export class SystemService {
     "hasura",
   ];
 
-  // Deployment names a custom page is never allowed to claim. A plugin manifest
+  // Deployment names a plugin is never allowed to claim. A plugin manifest
   // is third-party input, so without this a plugin declaring `deployments:
   // ["api"]` would render an Update button that restarts the panel itself.
   private static RESERVED_DEPLOYMENTS = [
@@ -452,7 +452,7 @@ export class SystemService {
     return services;
   }
 
-  // Deployments declared by registered custom pages. The image is read off the
+  // Deployments declared by registered plugins. The image is read off the
   // live deployment rather than the plugin manifest, so it can never drift from
   // what is actually running -- the manifest only supplies the name.
   private async getPluginServices() {
@@ -481,7 +481,7 @@ export class SystemService {
         },
       }));
     } catch (error) {
-      this.logger.warn("unable to fetch custom pages", error);
+      this.logger.warn("unable to fetch plugins", error);
       return services;
     }