feat: host lock api so a plugin can load hosts from a config file (#1581)

src/backend/sync/server/push.ts

@@ -11,6 +11,12 @@ import type { SyncRow } from "@termix-ssh/plugin-sdk/backend";
 import { getEntity } from "../../plugins/sync-registry.js";
 import { PermissionManager } from "../../utils/permission-manager.js";
 import { syncLogger } from "../../utils/logger.js";
+import {
+  hasHostLocks,
+  hostLock,
+  manualCreateBlockedBy,
+} from "../../hosts/locks.js";
+import { createCurrentHostResolutionRepository } from "../../database/repositories/factory.js";
 import {
   createResolvers,
   deleteStoredRow,
@@ -48,6 +54,22 @@ export type PushResult =
 
 export const MAX_PUSH_OPS = 500;
 
+/** A host a plugin manages can't be changed from a desktop either. */
+async function hostPushLocked(
+  userId: string,
+  syncId: string,
+  exists: boolean,
+): Promise<boolean> {
+  if (!hasHostLocks()) return false;
+  if (!exists) return manualCreateBlockedBy() !== null;
+  const hostId =
+    await createCurrentHostResolutionRepository().findHostIdBySyncIdForUser(
+      syncId,
+      userId,
+    );
+  return hostId !== null && hostId !== undefined && hostLock(hostId) !== null;
+}
+
 function isPushOp(value: unknown): value is PushOp {
   if (!value || typeof value !== "object") return false;
   const op = value as Record<string, unknown>;
@@ -166,6 +188,13 @@ export async function applyPush(
       results.set(key, { ...base, status: "rejected", reason: "permission" });
       continue;
     }
+    if (
+      op.entityType === "hosts" &&
+      (await hostPushLocked(userId, op.syncId, exists))
+    ) {
+      results.set(key, { ...base, status: "rejected", reason: "locked" });
+      continue;
+    }
 
     try {
       if (op.op === "delete") {