Database-backed plugin directory - #583

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

rebuildRepo now scopes its final write to the build's id and refuses it
(rather than falling back to Create) if Delist removed the row during the
in-flight network build, and checks nameTaken before writing a renamed
plugin's document so a collision during rebuild is ErrNameTaken with the
previous document kept, not a raw DB error.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

RejectDirectoryRepo ignored BindJSON's error, which had already
written a 400 on decode failure (including on an empty body, which
was meant to mean "no reason"); the handler then wrote 200 on top of
it. Switch to ShouldBindJSON, only treat a malformed non-empty body as
an error, and switch AddDirectoryRepo to ShouldBindJSON for
consistency.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…er GC

Drop the gorm text-type tag on Build.Doc/LastError (MySQL's 64 KiB text
cap can't hold a big README+changelog+release-notes doc). Add
wasm.Options.NoCache so validating a public submission doesn't pin its
compiled module in the process-wide wazero cache forever. Bound the
directory's IP limiter map with a periodic sweep of expired addresses
(unbounded over IPv6). Set the 429 Content-Type before flushing the
header so it isn't sniffed. Use Limit(1).Find instead of First for
Detail() so crawler hits on unknown plugin names stop spamming gorm
ERROR logs. Cap GitHub release pages at 10 and rendered README/CHANGELOG
HTML at 1 MiB so one pathological repo can't cost unbounded API calls or
storage. Fix a stale renderDetail comment.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

README: note that README/changelog/release-note HTML is rendered by
GitHub's markdown API and shown as-is, including in the admin's pending
card. PLUGIN_CONTRACT: "the tool" is now "submission" (there is no
separate tool). Spec: submitter_ip is kept for the admin (rate limiting
is in-memory, not DB-backed); the wire types live in
plugins/directory/registry and are aliased in plugins/directory, only
Fetcher moves; requireDirectory's 503 is about the plugin not being
wired/initialised, not about enabled=false (admin curation works while
disabled, for seeding); expand the seeding checklist (site_url,
github_token, refresh_minutes, a manual Directory-tab pass); rename Out
of scope to Out of scope / accepted risks and record the unbounded
pending-submission count, the 90s lock-hold risk from dropping the
Docker fence, and the CSRF follow-up's new submit-then-approve angle.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…CSRF test for approve

ParseRepo now accepts any capitalisation of github.com and ErrBadRepo
mentions the bare owner/repo form. Password-typed plugin settings render
empty in every theme (the stored secret no longer reaches the page) and
an empty password is skipped on save, so blank means keep. The
Content-Type check from #571 already covers the directory endpoints;
csrf_test.go now pins the cross-site /approve case.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>