Go to file

Alex Dunmow 6dd745bc34 Let a plugin grant and revoke file access

WO-FL-009. The files family reaches the CMS File access grant store: a plugin
grants one file to a member or an address, lists what a file has handed out,
and revokes what it gave. The response carries the signed unlock link, so a
seller can deliver a file to somebody with no account. Nothing on the wire
names the calling plugin: the host stamps plugin:<name> on what this family
writes and refuses a revoke of anything else. ADR 0008.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-17 10:47:13 +08:00

abi

Let a plugin grant and revoke file access

2026-09-17 10:47:13 +08:00

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

auth

chore: checkpoint all working changes

2026-09-05 21:14:15 +08:00

blocks

feat(abi): add keyed page and render response contracts

2026-08-19 21:50:28 +08:00

content

feat(content)!: PublishedBlockConfigs capability — published block content crosses the ABI

2026-07-07 23:36:17 +08:00

crypto

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

datasources

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

datatables

feat(datatables): DataTables capability for site data table access

2026-07-12 20:08:14 +08:00

docs/adr

Let a plugin grant and revoke file access

2026-09-17 10:47:13 +08:00

document

feat(abi): add keyed page and render response contracts

2026-08-19 21:50:28 +08:00

egress

chore: checkpoint all working changes

2026-09-05 21:14:15 +08:00

gating

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

menus

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

plugin

Let a plugin grant and revoke file access

2026-09-17 10:47:13 +08:00

rbac

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

render

fix(render): reject active-content link schemes

2026-08-19 22:44:40 +08:00

settings

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

subscriptions

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

templates

feat(abi): add keyed page and render response contracts

2026-08-19 21:50:28 +08:00

video

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

AGENTS.md

docs: correct PageDocument contract description; drop stale chrome/sync sections

2026-07-07 13:36:25 +08:00

CLAUDE.md

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

go.mod

feat(egress): http.request capability + allowed_hosts manifest (ADR 0023)

2026-07-08 02:00:29 +08:00

go.sum

feat(egress): http.request capability + allowed_hosts manifest (ADR 0023)

2026-07-08 02:00:29 +08:00

Makefile

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

README.md

docs: correct PageDocument contract description; drop stale chrome/sync sections

2026-07-07 13:36:25 +08:00

README.md

block/pluginsdk

The plugin-facing SDK for BlockNinja CMS plugins. Plugins import THIS module, never the first-party core module.

What lives here

abi/proto/v1/ — THE single source-of-truth ABI proto tree for the wasm plugin contract. The wire between host and guest is proto-only; any language can generate its own bindings from these .proto files. (This tree used to be duplicated by hand in cms/backend/abi and core/abi; it now lives here once.)
abi/v1/ — the generated Go bindings (abiv1). Regenerate with make proto.
plugin/ — the Go registration + DI surface (PluginRegistration, CoreServices/ServiceDeps, block/template registries) and the minimal Go wasm transport shim under plugin/wasmguest/ (exports, dispatch, hostcalls, context rehydration), its capability stubs (plugin/wasmguest/caps/), and the database/sql driver over the host DB (plugin/wasmguest/bnwasm/).
Guest-facing type packages plugins consume: blocks/ (incl. blocks/builtin, blocks/shared, blocks/tags), templates/ (the template registry + types, including PageDocument — the body-plus-envelope contribution a full-page template makes; the host owns the chrome), auth/, settings/, content/, gating/, crypto/, rbac/, video/, ai/, subscriptions/, menus/, datasources/.

The Go surface here is one language binding. The proto tree is the contract: a non-Go plugin implements the ABI hooks directly and never sees the Go structs.

Rules

NEVER use replace directives in go.mod. Module resolution goes through the Gitea module proxy — to test local changes, tag and push a version.
All consumers are in-house — no backwards-compatibility shims.
Plugins import block/pluginsdk/..., never the first-party core module.

Design

Program spec (in the cms repo): docs/superpowers/specs/2026-07-07-proto-first-plugin-sdk-design.md.