pastilhasandClaude Fable 5
5914e96cf3
reads hosts and certificates against a live NPM 2.15.1. one grantable permission, with /_config owner-only — reading which hosts are healthy is worth sharing, an NPM admin login is not, and NPM has no read-only role. the quirk that shapes the whole plugin: NPM answers an unauthenticated read with 404, not 401, because its router only registers a resource once a token is present. so 'not signed in' and 'no such endpoint' are the same response, and a naive client tells you a feature is missing when your password is wrong. the client mints a fresh token and retries once, then reports a persistent 404 as likelyAuth. certificates sort by expiry rather than name, which is the only ordering that answers a question. no create/edit/delete and no cert issuance: NPM's own UI does those and a wrong proxy host takes a domain off the internet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
46 lines
1.9 KiB
TypeScript
46 lines
1.9 KiB
TypeScript
import type { PluginManifest } from '@@/plugins/manifest';
|
|
|
|
// Nginx Proxy Manager, inside Officer.
|
|
//
|
|
// ── The name ──
|
|
//
|
|
// The container is called `npm` and the owner calls it NPM. This plugin is `proxy-manager` anyway: in a
|
|
// repository where every other sentence is about bun, lockfiles and `npm install`, a plugin directory
|
|
// called `npm` would collide with the package manager in every grep and every conversation. The label
|
|
// says the real name; the id says what it does. Same reasoning that renamed `officer-claude` to
|
|
// `officer-anthropic-proxy`.
|
|
//
|
|
// ── The permission, and why settings are carved out ──
|
|
//
|
|
// Reading which hosts exist, whether their certificates are healthy and whether one is offline is
|
|
// genuinely useful to somebody who is not the owner. The CREDENTIAL is not: it is an NPM admin login,
|
|
// and NPM has no read-only role, so anyone holding it can redirect any hostname on this machine.
|
|
//
|
|
// So the permission is grantable and `/_config` is owner-only — the split `ownerOnly` exists for, and
|
|
// the same shape Jellyfin uses for its admin token.
|
|
export const manifest: PluginManifest = {
|
|
publisher: 'officerdev',
|
|
version: '0.1.0',
|
|
platform: '>=1.0.0',
|
|
|
|
label: 'Proxy Manager',
|
|
summary: 'Nginx Proxy Manager — hosts, certificates and access lists',
|
|
icon: 'Route',
|
|
color: '#f97316',
|
|
|
|
permissions: [
|
|
{
|
|
key: 'proxy-manager',
|
|
label: 'Proxy Manager',
|
|
description: 'Nginx Proxy Manager — proxy hosts, redirections, streams and certificates',
|
|
|
|
// The connection form and the probe. Everything under here reads or writes the admin credential.
|
|
ownerOnly: ['/_config'],
|
|
|
|
// Probes that look like writes and are not. Without declaring these a read-level account meets
|
|
// what reads as a broken feature: the "test connection" button 403s.
|
|
readOnlyWrites: ['/_config/test'],
|
|
},
|
|
],
|
|
};
|