[oyi77]

Description

Second slice of the original PR #3668 split into 3 independent PRs as requested.

Contains the WordPress-style plugin UI extensibility:

• Plugin admin pages — dynamic route for rendered plugin pages
• API route for plugin page rendering with sanitization (DOMPurify + XSS protection)
• API endpoint for plugin UI extension listings
• Sidebar integration — Plugins section that fetches and renders plugin admin pages
• API key auth enforcement on render and ui-extensions routes
• JSX syntax fix in Sidebar (unclosed .map() chain)
• API route tests for plugin UI extensibility

Commits (3):

1. Add plugin UI extensibility — admin pages, render routes, sidebar, dashboard widgets
2. Harden plugin page rendering and API auth (DOMPurify sanitization, API key checks)
3. Add API route tests for plugin UI extensibility

Related

Part of the split from original PR #3668

[gemini-code-assist]

Code Review

This pull request introduces plugin UI extensibility, adding a dynamic plugin page component, API routes for rendering plugin pages and fetching UI extensions, and dynamic sidebar integration. The review feedback highlights a critical authentication mismatch where dashboard client-side fetches will fail with a 401 error if API key authentication is strictly required. Additionally, the reviewer recommends using an AbortController to prevent race conditions in the page component, wrapping request.json() in a try-catch block with Zod validation to prevent unhandled exceptions, refactoring duplicated authentication helpers, and correcting the unit tests to properly verify authentication behavior instead of just asserting function existence.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If isRequireApiKeyEnabled() is active, this route strictly requires an API key. However, the dashboard client-side fetches (such as the ones in Sidebar.tsx and the plugin page component) do not provide an API key in their headers. This will cause the plugin pages and sidebar integration to fail with a 401 Unauthorized error for authenticated dashboard users.

Consider allowing session-based authentication (e.g., validating the user's session cookie) as an alternative to API key authentication for these dashboard-facing routes, or retrieve the API key from the dashboard context and pass it in the fetch headers.

[gemini-code-assist]

To prevent race conditions and memory leaks when the component unmounts or when the name or slug parameters change rapidly, use an AbortController to cancel any pending fetch requests.

  useEffect(() => {
    const controller = new AbortController();
    setLoading(true);
    setError(null);
    fetch(`/api/plugins/${name}/render?page=${slug}`, { signal: controller.signal })
      .then((res) => {
        if (!res.ok) throw new Error("Failed to load plugin page");
        return res.json();
      })
      .then((data) => {
        setContent(data.content);
      })
      .catch((err) => {
        if (err.name !== "AbortError") {
          setError(err.message);
        }
      })
      .finally(() => {
        if (!controller.signal.aborted) {
          setLoading(false);
        }
      });
    return () => {
      controller.abort();
    };
  }, [name, slug]);

[gemini-code-assist]

Calling request.json() outside of a try-catch block will cause an unhandled exception and a 500 Internal Server Error if the request body is empty or contains invalid JSON. Additionally, the input should be validated using a Zod schema to comply with the repository style guide.

  let body;
  try {
    body = await request.json();
  } catch (err) {
    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
  }
  const { page, params: pageParams } = body;

References

1. Always validate inputs with Zod schemas from src/shared/validation/schemas.ts. ^(link)

[gemini-code-assist]

The checkAuth and errorResp helper functions are duplicated exactly between src/app/api/plugins/[name]/render/route.ts and src/app/api/plugins/ui-extensions/route.ts. Consider refactoring these helpers into a shared utility file to improve maintainability.

[gemini-code-assist]

These tests claim to verify that the render and ui-extensions routes call checkAuth, but they only assert that typeof mod.GET === "function". This is a duplicate assertion of the previous tests and does not actually verify any authentication behavior.

To properly test this, you should call the route handler with a mock Request (without an API key) and assert that it returns a 401 status code when isRequireApiKeyEnabled() is active.

[oyi77]

Force-pushed with clean commits — branch now contains only 3 plugin UI commits (was 33 commits with 30 unrelated changes).

[diegosouzapw]

Thanks @oyi77 for the continued work on the plugin system (#3668 split — UI-extensibility).

This is conflicting against release/v3.8.30 and is a large surface (~190 files). Two things before it can move forward:

1. Rebase onto the latest release/v3.8.30 and resolve conflicts.
2. Landing the plugin epic is a maintainer product decision (which milestone it targets) — we'll confirm that separately.

Keeping it open and queued — thanks for the patience!

[oyi77]

Acknowledged — rebasing onto release/v3.8.30 is in progress. The plugin UI-extensibility is held pending the maintainer's product decision on milestone targeting. Keeping open as queued. 🙏

[oyi77]

Closing stale PR — conflicts with current release branch. Will reopen fresh if needed.