feat: harden plugin api for separate repos, signed updates and generic external login

src/ui/tests/sidebar/host-export-payload.test.ts

@@ -6,8 +6,14 @@ import {
   SECRET_KEYS,
   type ExportPayload,
   type FieldGroup,
+  pluginSecretKeys,
 } from "../../sidebar/host-export-payload";
 
+// What the remote-desktop manifest declares for its guacamoleConfig field.
+const RDP_SECRETS = {
+  "remote-desktop": { guacamoleConfig: ["gateway-password"] },
+};
+
 const ALL_GROUPS = new Set<FieldGroup>([
   "connection",
   "notes",
@@ -208,7 +214,13 @@ describe("buildExportPayload", () => {
   });
 
   it("nulls the guacamole gateway password when credentials are excluded", () => {
-    const out = buildExportPayload(rdpRaw(), null, ALL_GROUPS, false);
+    const out = buildExportPayload(
+      rdpRaw(),
+      null,
+      ALL_GROUPS,
+      false,
+      RDP_SECRETS,
+    );
     const config = gatewayConfig(out.hosts[0]);
     expect(config["gateway-password"]).toBeNull();
     expect(config["gateway-hostname"]).toBe("gw.example.com");
@@ -222,7 +234,7 @@ describe("buildExportPayload", () => {
 
   it("does not mutate the source payload when nulling nested secrets", () => {
     const raw = rdpRaw();
-    buildExportPayload(raw, null, ALL_GROUPS, false);
+    buildExportPayload(raw, null, ALL_GROUPS, false, RDP_SECRETS);
     const config = gatewayConfig(raw.hosts[0]);
     expect(config["gateway-password"]).toBe("gw-secret");
   });
@@ -270,7 +282,7 @@ describe("maskSecrets", () => {
   });
 
   it("masks the guacamole gateway password", () => {
-    const out = maskSecrets(rdpRaw());
+    const out = maskSecrets(rdpRaw(), RDP_SECRETS);
     const config = gatewayConfig(out.hosts[0]);
     expect(config["gateway-password"]).toBe("<included>");
     expect(config["gateway-hostname"]).toBe("gw.example.com");
@@ -286,3 +298,26 @@ describe("maskSecrets", () => {
     expect(JSON.stringify(out)).not.toContain("proxy-secret-2");
   });
 });
+
+describe("pluginSecretKeys", () => {
+  it("reads secretKeys off each plugin's host fields", () => {
+    expect(
+      pluginSecretKeys([
+        {
+          id: "remote-desktop",
+          contributes: {
+            settings: {
+              host: {
+                fields: [
+                  { key: "guacamoleConfig", secretKeys: ["gateway-password"] },
+                  { key: "enableRdp" },
+                ],
+              },
+            },
+          },
+        },
+        { id: "docker", contributes: null },
+      ]),
+    ).toEqual(RDP_SECRETS);
+  });
+});