fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own (#1632)

* fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own

* fix(sync): switch off an untrusted mirrored plugin when the server updates it

* fix: require local consent for mirrored plugin activation

* docs: describe consent fields on the plugin state endpoint

src/backend/database/routes/plugins.ts

@@ -243,7 +243,9 @@ export async function listPreLoginPlugins(): Promise<
  *       frontends in the same order the server does.
  *
  *       On a desktop linked to a server, `runsOnServer` marks plugins that
- *       only run on that server and stay off here on purpose.
+ *       only run on that server and stay off here on purpose, and, for
+ *       admins, `managedByServer` marks plugins whose on/off state the server
+ *       decides.
  *     tags:
  *       - Plugins
  *     responses:
@@ -370,6 +372,7 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
           features,
           env,
           signedBy: loaded?.signedBy ?? null,
+          managedByServer: linked && (await isManagedByLinkedServer(record.id)),
           capabilities,
           grantedCapabilities: grantsByPlugin.get(record.id) ?? [],
           lastError: loaded?.lastError ?? record.lastError ?? null,
@@ -393,9 +396,7 @@ router.get("/", authenticateJWT, async (req: Request, res: Response) => {
 });
 
 async function isManagedByLinkedServer(pluginId: string): Promise<boolean> {
-  if (process.env.ELECTRON_EMBEDDED !== "true") return false;
-  const { getLink } = await import("../../sync/client/link-store.js");
-  if (!(await getLink())) return false;
+  if (!(await isLinkedDesktop())) return false;
   const { isServerManaged } = await import("../../sync/client/plugins.js");
   return isServerManaged(pluginId);
 }
@@ -500,7 +501,7 @@ router.get(
  * /plugins/onboarding/apply:
  *   post:
  *     summary: Apply the onboarding plugin picker
- *     description: Sets every listed plugin to enabled, disabled or removed in one pass. Choices are first raised so that every kept plugin still has its hard dependencies (the adjustments list says which and why). Enabling runs dependencies first, disabling and removing run dependents first, and one plugin failing does not stop the rest. Removing a bundled plugin deletes it and its data; it can be reinstalled from the registry later. Clears the fresh-install pending flag. With dryRun nothing changes and the response lists what would.
+ *     description: Sets every listed plugin to enabled, disabled or removed in one pass. Choices are first raised so that every kept plugin still has its hard dependencies (the adjustments list says which and why). Enabling runs dependencies first, disabling and removing run dependents first, and one plugin failing does not stop the rest. Removing a bundled plugin deletes it and its data; it can be reinstalled from the registry later. Clears the fresh-install pending flag. With dryRun nothing changes and the response lists what would. On a linked desktop, locally managed plugins require version and capabilities matching the reviewed manifest when enabling.
  *     tags:
  *       - Plugins
  *     requestBody:
@@ -887,7 +888,7 @@ router.delete(
  * /plugins/{id}/state:
  *   patch:
  *     summary: Enable or disable a plugin
- *     description: Persists the new state and starts or stops the plugin immediately. Disabling releases everything the plugin owns, including any port it was listening on. Enabling also starts any installed hard dependency that is off, and disabling also stops the running plugins that depend on it. With dryRun nothing changes and the response lists what would.
+ *     description: Persists the new state and starts or stops the plugin immediately. Disabling releases everything the plugin owns, including any port it was listening on. Enabling also starts any installed hard dependency that is off, and disabling also stops the running plugins that depend on it. With dryRun nothing changes and the response lists what would. On a linked desktop, locally managed plugins require version and capabilities matching the reviewed manifest when enabling.
  *     tags:
  *       - Plugins
  *     parameters:
@@ -909,6 +910,12 @@ router.delete(
  *             properties:
  *               enabled:
  *                 type: boolean
+ *               version:
+ *                 type: string
+ *               capabilities:
+ *                 type: array
+ *                 items:
+ *                   type: string
  *     responses:
  *       200:
  *         description: The plugin's new state.
@@ -962,7 +969,26 @@ router.patch(
         return;
       }
 
-      const result = await setPluginState(pluginId, enabled);
+      let result;
+      if (enabled && (await isLinkedDesktop())) {
+        const version = readVersion(req.body);
+        const capabilities = readCapabilities(req.body);
+        if (version === null || capabilities === null) {
+          res
+            .status(400)
+            .json({ error: "Invalid plugin version or capabilities" });
+          return;
+        }
+        const { enablePluginWithConsent } =
+          await import("../../plugins/manage.js");
+        result = await enablePluginWithConsent(pluginId, {
+          version,
+          capabilities,
+          userId: (req as AuthenticatedRequest).userId as string,
+        });
+      } else {
+        result = await setPluginState(pluginId, enabled);
+      }
       await auditPluginAction(
         req,
         enabled ? "enable_plugin" : "disable_plugin",