feat: collapse plugin runtime to one tier behind a plugin SDK

plugins/tailscale/backend/routes.ts

@@ -5,6 +5,7 @@
 
 import { Router } from "express";
 import { AuthManager } from "../../../src/backend/utils/auth-manager.js";
+import { PermissionManager } from "../../../src/backend/utils/permission-manager.js";
 import { apiLogger } from "../../../src/backend/utils/logger.js";
 import { fetchWithProxy } from "../../../src/backend/utils/proxy-agent.js";
 import { createCurrentSettingsRepository } from "../../../src/backend/database/repositories/factory.js";
@@ -39,6 +40,16 @@ export const router = Router();
 const authManager = AuthManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 
+/**
+ * Listing the tailnet uses the admin-stored API key, so it needs more than a
+ * session. Writing the key is already admin-only and reading it back is
+ * masked, but using it to enumerate every device was open to any logged-in
+ * user, which handed out an internal network inventory.
+ */
+const requireDeviceAccess = PermissionManager.getInstance().requirePermission(
+  "tailscale.devices.view",
+);
+
 function normalizeApiBase(raw: string | null): string {
   const trimmed = (raw ?? "").trim().replace(/\/+$/, "");
   return trimmed || DEFAULT_TAILSCALE_API_BASE;
@@ -49,12 +60,17 @@ function normalizeApiBase(raw: string | null): string {
  * /tailscale/devices:
  *   get:
  *     summary: List Tailscale devices
- *     description: Returns the list of devices in the configured tailnet using the stored API key.
+ *     description: >
+ *       Returns the devices in the configured tailnet using the stored admin
+ *       API key. Requires the tailscale.devices.view permission, because the
+ *       response is a full inventory of the tailnet.
  *     tags:
  *       - Tailscale
  *     responses:
  *       200:
  *         description: List of tailnet devices.
+ *       403:
+ *         description: The caller lacks tailscale.devices.view.
  *         content:
  *           application/json:
  *             schema:
@@ -67,67 +83,72 @@ function normalizeApiBase(raw: string | null): string {
  *       500:
  *         description: Failed to fetch Tailscale devices.
  */
-router.get("/devices", authenticateJWT, async (_req, res) => {
-  try {
-    const settingsRepo = createCurrentSettingsRepository();
-    const apiKey = (await settingsRepo.get("tailscale_api_key")) ?? "";
-    if (!apiKey) {
-      return res.json({ devices: [], hasApiKey: false });
-    }
-    const apiBase = normalizeApiBase(
-      await settingsRepo.get("tailscale_api_base_url"),
-    );
+router.get(
+  "/devices",
+  authenticateJWT,
+  requireDeviceAccess,
+  async (_req, res) => {
+    try {
+      const settingsRepo = createCurrentSettingsRepository();
+      const apiKey = (await settingsRepo.get("tailscale_api_key")) ?? "";
+      if (!apiKey) {
+        return res.json({ devices: [], hasApiKey: false });
+      }
+      const apiBase = normalizeApiBase(
+        await settingsRepo.get("tailscale_api_base_url"),
+      );
 
-    const url = `${apiBase}/tailnet/-/devices?fields=all`;
-    const response = await fetchWithProxy(url, {
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-        "User-Agent": "Termix/1.0",
-      },
-    });
-
-    if (!response.ok) {
-      apiLogger.warn("Tailscale API returned non-OK status", {
-        operation: "tailscale_devices",
-        status: response.status,
+      const url = `${apiBase}/tailnet/-/devices?fields=all`;
+      const response = await fetchWithProxy(url, {
+        headers: {
+          Authorization: `Bearer ${apiKey}`,
+          "User-Agent": "Termix/1.0",
+        },
       });
-      if (response.status === 401 || response.status === 403) {
-        return res.status(401).json({
-          error: "Invalid Tailscale API key",
+
+      if (!response.ok) {
+        apiLogger.warn("Tailscale API returned non-OK status", {
+          operation: "tailscale_devices",
+          status: response.status,
+        });
+        if (response.status === 401 || response.status === 403) {
+          return res.status(401).json({
+            error: "Invalid Tailscale API key",
+            devices: [],
+            hasApiKey: true,
+          });
+        }
+        return res.status(502).json({
+          error: "Tailscale API error",
           devices: [],
           hasApiKey: true,
         });
       }
-      return res.status(502).json({
-        error: "Tailscale API error",
+
+      const data = (await response.json()) as { devices: TailscaleAPIDevice[] };
+
+      const devices: TailscaleDevice[] = (data.devices ?? []).map((d) => ({
+        id: d.id,
+        name: d.name,
+        hostname: d.hostname,
+        addresses: d.addresses ?? [],
+        os: d.os,
+        lastSeen: d.lastSeen,
+      }));
+
+      res.json({ devices, hasApiKey: true });
+    } catch (err) {
+      apiLogger.error("Failed to fetch Tailscale devices", err, {
+        operation: "tailscale_devices",
+      });
+      res.status(500).json({
+        error: "Failed to fetch Tailscale devices",
         devices: [],
         hasApiKey: true,
       });
     }
-
-    const data = (await response.json()) as { devices: TailscaleAPIDevice[] };
-
-    const devices: TailscaleDevice[] = (data.devices ?? []).map((d) => ({
-      id: d.id,
-      name: d.name,
-      hostname: d.hostname,
-      addresses: d.addresses ?? [],
-      os: d.os,
-      lastSeen: d.lastSeen,
-    }));
-
-    res.json({ devices, hasApiKey: true });
-  } catch (err) {
-    apiLogger.error("Failed to fetch Tailscale devices", err, {
-      operation: "tailscale_devices",
-    });
-    res.status(500).json({
-      error: "Failed to fetch Tailscale devices",
-      devices: [],
-      hasApiKey: true,
-    });
-  }
-});
+  },
+);
 
 /** Called from activate(). Mounts this router at /tailscale via the shared
  * dispatcher. */