Plugin Authentication Type Constraints

Plugin Authentication Type Constraints

Overview

SimpleChat now enforces authentication type constraints per plugin type. Different plugin types may support different authentication methods based on their requirements and the APIs they integrate with. This feature provides a structured way to define and retrieve allowed authentication types for each plugin type.

Version Implemented: v0.237.001

Key Features

• Per-Plugin Auth Types: Each plugin type can define its own allowed authentication types
• Schema-Based Defaults: Falls back to global AuthType enum from plugin.schema.json
• Definition File Overrides: Plugin-specific definition files can restrict available auth types
• API Endpoint: RESTful endpoint to query allowed auth types for any plugin type

How It Works

Authentication Type Resolution

The system resolves allowed authentication types in this order:

1. Check Plugin Definition File: {plugin_type}.definition.json
   • If allowedAuthTypes array exists and is non-empty, use it
2. Fallback to Global Schema: plugin.schema.json
   • Use the AuthType enum from definitions

API Endpoint

GET /api/plugins/{plugin_type}/auth-types

Response:

{
  "allowedAuthTypes": ["none", "api_key", "oauth2", "basic"],
  "source": "definition"
}

Response Fields:

Configuration Files

Plugin Schema (Global Defaults)

Location: static/json/schemas/plugin.schema.json

{
  "definitions": {
    "AuthType": {
      "enum": ["none", "api_key", "oauth2", "basic", "bearer", "custom"]
    }
  }
}

Plugin Definition Files (Per-Plugin Overrides)

Location: static/json/schemas/{plugin_type}.definition.json

Example for a plugin that only supports API key authentication:

{
  "name": "weather_plugin",
  "displayName": "Weather API",
  "description": "Get weather information",
  "allowedAuthTypes": ["none", "api_key"]
}

Technical Architecture

Backend Implementation

Location: route_backend_plugins.py

@bpap.route('/api/plugins/<plugin_type>/auth-types', methods=['GET'])
@login_required
@user_required
def get_plugin_auth_types(plugin_type):
    """
    Returns allowed auth types for a plugin type. Uses definition file if present,
    otherwise falls back to AuthType enum in plugin.schema.json.
    """
    schema_dir = os.path.join(current_app.root_path, 'static', 'json', 'schemas')
    safe_type = re.sub(r'[^a-zA-Z0-9_]', '_', plugin_type).lower()

    # Try to load from plugin definition file
    definition_path = os.path.join(schema_dir, f'{safe_type}.definition.json')
    schema_path = os.path.join(schema_dir, 'plugin.schema.json')

    allowed_auth_types = []
    source = "schema"

    # Load defaults from schema
    try:
        with open(schema_path, 'r', encoding='utf-8') as schema_file:
            schema = json.load(schema_file)
        allowed_auth_types = (
            schema
            .get('definitions', {})
            .get('AuthType', {})
            .get('enum', [])
        )
    except Exception:
        allowed_auth_types = []

    # Override with definition file if present
    if os.path.exists(definition_path):
        try:
            with open(definition_path, 'r', encoding='utf-8') as definition_file:
                definition = json.load(definition_file)
            allowed_from_definition = definition.get('allowedAuthTypes')
            if isinstance(allowed_from_definition, list) and allowed_from_definition:
                allowed_auth_types = allowed_from_definition
                source = "definition"
        except Exception:
            pass

    return jsonify({
        "allowedAuthTypes": allowed_auth_types,
        "source": source
    })

Security

• Plugin type is sanitized to prevent path traversal
• Only alphanumeric characters and underscores are allowed in plugin type names
• Endpoint requires user authentication

Common Authentication Types

Use Cases

Restricting Auth for Internal Plugins

An internal plugin might only support specific authentication:

{
  "name": "internal_hr_system",
  "allowedAuthTypes": ["oauth2"]
}

Simple Public API Plugin

A public weather API might need no authentication:

{
  "name": "public_weather",
  "allowedAuthTypes": ["none", "api_key"]
}

Frontend Integration

The frontend can query auth types to:

1. Display only valid authentication options in plugin configuration UI
2. Validate user selections before saving
3. Show appropriate configuration fields based on auth type

Example usage:

async function loadAuthTypes(pluginType) {
    const response = await fetch(`/api/plugins/${pluginType}/auth-types`);
    const data = await response.json();
    return data.allowedAuthTypes;
}

Known Limitations

• Auth types must be predefined in the schema
• Custom auth implementations require additional plugin code
• Definition files must be manually created for each plugin type

Related Features

• Plugin Management
• Action/Plugin Registration
• OpenAPI Plugin Integration