Repository navigation
fix(plugins): /widgets/ serves only installed plugins (mrramam/HomeGlow#60) - #326
Merged
Merged
Conversation
The disk fallback in /widgets/:filename and the @fastify/static registration on server/widgets/ served files that aren't in the plugins table. The fallback skipped the manifest, and the static route skipped the token and frame scripts as well. Migration 18 already imported every pre-table file, so both were dead code for real installs, and reachable only by a file placed on disk. Delete no longer unlinks a file on disk either, since nothing serves one. Co-Authored-By: Claude Opus 5.5 <[email protected]>
adamecker
pushed a commit
to adamecker/HomeGlow
that referenced
this pull request
Oct 25, 2026
…rth#327, plugin /widgets/ installed-only jherforth#326
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last open part of mrramam#60. #319 already fixed the increment cap.
Problem
Two paths served files from
server/widgets/that aren't installed plugins:/widgets/:filename: a file with no row in thepluginstable was read from disk. It skipped the manifest, so it got no plugin identity.@fastify/staticonserver/widgets/under/widgets/: this answered anything the route above doesn't match, such as/widgets/sub/page.html. It skipped the token and the frame scripts as well.Migration 18 imported every pre-table file into the
pluginstable, so neither path serves anything on a real install. Both were reachable only by a file someone placed on disk.Changes
/widgets/:filenameserves only rows in thepluginstable. Anything else answers404, so every served page gets its token and frame scripts.server/widgets/is removed.server/widgets/stays. Migration 18 still reads it, and the Dockerfile creates it.docs/architecture/plugin-platform.md.Testing
pluginStore.test.js: a file inserver/widgets/that isn't installed, a file in a subfolder, and the folder'sREADME.mdall answer404, with none of their content. It fails onmainwith200.npm test: 627 pass.🤖 Generated with Claude Code