feat: move proxmox discovery/import/sync into a first-party plugin

src/backend/database/database.ts

@@ -25,7 +25,7 @@ import userPreferencesRoutes from "./routes/user-preferences.js";
 import hostSidebarPreferencesRoutes from "./routes/host-sidebar-preferences.js";
 import credentialSidebarPreferencesRoutes from "./routes/credential-sidebar-preferences.js";
 import uiPreferencesRoutes from "./routes/ui-preferences.js";
-import proxmoxRoutes from "./routes/proxmox.js";
+import proxmoxDispatch from "./routes/proxmox-dispatch.js";
 import termixIdRoutes from "./routes/termix-id.js";
 import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
 import { registerTailscaleRoutes } from "./routes/tailscale-routes.js";
@@ -1768,7 +1768,7 @@ app.use("/user-preferences", userPreferencesRoutes);
 app.use("/host-sidebar/preferences", hostSidebarPreferencesRoutes);
 app.use("/credential-sidebar/preferences", credentialSidebarPreferencesRoutes);
 app.use("/ui-preferences", uiPreferencesRoutes);
-app.use("/proxmox", proxmoxRoutes);
+app.use("/proxmox", proxmoxDispatch);
 app.use("/termix-id", termixIdRoutes);
 registerAuditLogRoutes(app, authenticateJWT);
 registerTailscaleRoutes(app, authenticateJWT);

src/backend/database/routes/proxmox-dispatch.ts

@@ -0,0 +1,48 @@
+// Mounted at /proxmox. The Proxmox discovery/import/sync feature ships as a
+// first-party in-process plugin (plugins/proxmox) rather than a route file
+// imported directly here, so this module exists to keep /proxmox/* working
+// at its original path without handing the plugin a reference to the shared
+// app instance. The plugin runtime registers its router via
+// registerProxmoxRouter when it activates, and clears it on deactivate, so a
+// disabled plugin falls back to the 404 below.
+//
+// Unlike /plugin-api, this dispatcher applies no auth of its own: it forwards
+// to exactly one first-party router (the Proxmox plugin's own), and every
+// route in that router already applies authenticateJWT/requireDataAccess
+// itself, the same as every other router mounted alongside it here (/users,
+// /host, /snippets, ...). /plugin-api gates at the mount point because it
+// forwards to arbitrary third-party plugin code that cannot be assumed to
+// gate itself; that reasoning does not apply to a single first-party router
+// that already does.
+
+import type { Request, Response, NextFunction, Router } from "express";
+import { databaseLogger } from "../../utils/logger.js";
+
+let activeRouter: Router | null = null;
+
+export function registerProxmoxRouter(router: Router): void {
+  activeRouter = router;
+  databaseLogger.info("Registered Proxmox plugin router", {
+    operation: "proxmox_dispatch_register",
+  });
+}
+
+export function unregisterProxmoxRouter(): void {
+  if (!activeRouter) return;
+  activeRouter = null;
+  databaseLogger.info("Unregistered Proxmox plugin router", {
+    operation: "proxmox_dispatch_register",
+  });
+}
+
+export default function proxmoxDispatch(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): void {
+  if (!activeRouter) {
+    res.status(404).json({ error: "Proxmox discovery is not available" });
+    return;
+  }
+  activeRouter(req, res, next);
+}

src/backend/database/routes/proxmox-import-auth.ts

@@ -1,44 +0,0 @@
-// Pure decision: which auth settings an imported Proxmox guest inherits.
-//
-// The frontend carries a parallel copy in
-// src/ui/components/proxmox/proxmox-import-auth.ts. The two drifting apart is
-// what produced the reported import bug, so both are kept behaviourally
-// identical and each is unit-tested against the same matrix.
-export function resolveProxmoxImportAuth(
-  defaultAuthType: string | undefined,
-  credentialId: number | null | undefined,
-): {
-  authType: string;
-  credentialId: number | null;
-  overrideCredentialUsername: number;
-} {
-  // An explicit special auth type (none/opkssh/tailscale/vault/…) wins.
-  if (
-    defaultAuthType &&
-    defaultAuthType !== "credential" &&
-    !["password", "key"].includes(defaultAuthType)
-  ) {
-    return {
-      authType: defaultAuthType,
-      credentialId: null,
-      overrideCredentialUsername: 0,
-    };
-  }
-
-  // A credential (configured default OR inherited from the source host) is a
-  // concrete auth source -> use it, even when defaultAuthType is the
-  // "password"/"key" default.
-  if (credentialId) {
-    return {
-      authType: "credential",
-      credentialId,
-      overrideCredentialUsername: 0,
-    };
-  }
-
-  return {
-    authType: "none",
-    credentialId: null,
-    overrideCredentialUsername: 0,
-  };
-}

src/backend/database/routes/proxmox-jump-hosts.ts

@@ -1,17 +0,0 @@
-export function parseProxmoxJumpHosts(raw: unknown): unknown[] | null {
-  if (!raw) return null;
-  if (Array.isArray(raw)) return raw;
-  if (typeof raw !== "string") return null;
-
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-
-export function serializeProxmoxJumpHosts(raw: unknown): string | null {
-  const parsed = parseProxmoxJumpHosts(raw);
-  return parsed ? JSON.stringify(parsed) : null;
-}