mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-13 15:32:53 +09:00
Juan DenisandClaude Opus 4.8
bd6b8eff33
Add POST /api/v1/plugins/preview: resolve a GitHub/zip source, download, read plugin.json, and return slug/version/permissions/panel-gate + the resolved URL, sha256, and warnings — without installing. The manual-install URL flow becomes two-step (Resolve -> consent card -> Install), pinning the install to the previewed sha256 so installed bytes match previewed bytes. - owner/repo and owner/repo@tag shorthand normalization (install accepts it too). - Actionable resolve errors: rate limit (with reset ETA), 404/private, no plugin.json at archive root. - Optional SERVERKIT_GITHUB_TOKEN: Bearer auth on GitHub hosts only (never leaked to third-party mirrors, never logged); lifts the anon rate limit and enables private-repo installs. - ManualInstallModal: PreviewConsent card with permission chips + warnings + 'GitHub · unverified' badge; SCSS added. Tests (test_plugin_preview.py, 15): shorthand, happy/warning preview paths, token header injection + host scoping, preview->install checksum continuity + tamper rejection. Full plugin suites green; frontend lint 0 errors, build clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>