chore: update workflow method wrapper type

* fix(mobile): app doesn't exit full-screen mode

* chore: rename restoreSystemUI to restoreEdgeToEdge

.github/workflows/test.yml

@@ -45,6 +45,8 @@ jobs:
               - 'server/**'
               - 'pnpm-lock.yaml'
               - 'mise.toml'
+              - 'packages/plugin-core/**'
+              - 'packages/plugin-sdk/**'
             cli:
               - 'packages/cli/**'
               - 'packages/sdk/**'

mobile/lib/presentation/pages/drift_memory.page.dart

@@ -12,6 +12,7 @@ import 'package:immich_mobile/presentation/widgets/images/image_provider.dart';
 import 'package:immich_mobile/presentation/widgets/memory/memory_bottom_info.widget.dart';
 import 'package:immich_mobile/presentation/widgets/memory/memory_card.widget.dart';
 import 'package:immich_mobile/providers/haptic_feedback.provider.dart';
+import 'package:immich_mobile/utils/system_ui.utils.dart';
 import 'package:immich_mobile/widgets/memories/memory_epilogue.dart';
 import 'package:immich_mobile/widgets/memories/memory_progress_indicator.dart';
 
@@ -49,7 +50,7 @@ class DriftMemoryPage extends HookConsumerWidget {
       SystemChrome.setEnabledSystemUIMode(SystemUiMode.immersive);
       return () {
         // Clean up to normal edge to edge when we are done
-        SystemChrome.setEnabledSystemUIMode(SystemUiMode.edgeToEdge);
+        restoreEdgeToEdge();
       };
     });
 
@@ -328,7 +329,7 @@ class DriftMemoryPage extends HookConsumerWidget {
                               // turn off full screen mode here
                               // https://github.com/Milad-Akarie/auto_route_library/issues/1799
                               context.maybePop();
-                              SystemChrome.setEnabledSystemUIMode(SystemUiMode.edgeToEdge);
+                              restoreEdgeToEdge();
                             },
                             shape: const CircleBorder(),
                             color: Colors.white.withValues(alpha: 0.2),

mobile/lib/presentation/pages/drift_slideshow.page.dart

@@ -19,6 +19,7 @@ import 'package:immich_mobile/providers/asset_viewer/asset_viewer.provider.dart'
 import 'package:immich_mobile/providers/asset_viewer/video_player_provider.dart';
 import 'package:immich_mobile/providers/infrastructure/settings.provider.dart';
 import 'package:immich_mobile/routing/router.dart';
+import 'package:immich_mobile/utils/system_ui.utils.dart';
 import 'package:immich_mobile/widgets/common/immich_loading_indicator.dart';
 import 'package:immich_mobile/widgets/photo_view/photo_view.dart';
 import 'package:wakelock_plus/wakelock_plus.dart';
@@ -76,7 +77,7 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
     _pageController.dispose();
     _crossfadeController.dispose();
     unawaited(WakelockPlus.disable());
-    SystemChrome.setEnabledSystemUIMode(SystemUiMode.edgeToEdge);
+    unawaited(restoreEdgeToEdge());
     super.dispose();
   }
 
@@ -255,7 +256,7 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
   }
 
   void _onTapUp() async {
-    await SystemChrome.setEnabledSystemUIMode(_showAppBar ? SystemUiMode.immersive : SystemUiMode.edgeToEdge);
+    await (_showAppBar ? SystemChrome.setEnabledSystemUIMode(SystemUiMode.immersive) : restoreEdgeToEdge());
 
     WidgetsBinding.instance.addPostFrameCallback((_) {
       setState(() {

mobile/lib/presentation/widgets/asset_viewer/asset_viewer.page.dart

@@ -23,6 +23,7 @@ import 'package:immich_mobile/providers/asset_viewer/asset_viewer.provider.dart'
 import 'package:immich_mobile/providers/cast.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/current_album.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/timeline.provider.dart';
+import 'package:immich_mobile/utils/system_ui.utils.dart';
 import 'package:immich_mobile/widgets/photo_view/photo_view.dart';
 
 @RoutePage()
@@ -128,7 +129,7 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
     _reloadSubscription?.cancel();
     _stackChildrenKeepAlive?.close();
 
-    SystemChrome.setEnabledSystemUIMode(SystemUiMode.edgeToEdge);
+    unawaited(restoreEdgeToEdge());
 
     super.dispose();
   }
@@ -251,10 +252,8 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
   }
 
   void _setSystemUIMode(bool controls, bool details) {
-    final mode = !controls || (CurrentPlatform.isIOS && details)
-        ? SystemUiMode.immersiveSticky
-        : SystemUiMode.edgeToEdge;
-    unawaited(SystemChrome.setEnabledSystemUIMode(mode));
+    final immersive = !controls || (CurrentPlatform.isIOS && details);
+    unawaited(immersive ? SystemChrome.setEnabledSystemUIMode(SystemUiMode.immersiveSticky) : restoreEdgeToEdge());
   }
 
   @override

mobile/lib/utils/system_ui.utils.dart

@@ -0,0 +1,14 @@
+import 'dart:async';
+
+import 'package:flutter/services.dart';
+
+/// Restore the system bars and return to edge-to-edge layout.
+///
+/// On Android 15+/API 36 edge-to-edge is enforced, so calling
+/// setEnabledSystemUIMode(edgeToEdge) does NOT re-show bars that an immersive
+/// mode (immersive / immersiveSticky) previously hid. Explicitly request all
+/// overlays first, then return to edge-to-edge layout.
+Future<void> restoreEdgeToEdge() async {
+  await SystemChrome.setEnabledSystemUIMode(SystemUiMode.manual, overlays: SystemUiOverlay.values);
+  await SystemChrome.setEnabledSystemUIMode(SystemUiMode.edgeToEdge);
+}

packages/plugin-core/manifest.json

@@ -5,6 +5,7 @@
   "description": "Core workflow capabilities for Immich",
   "author": "Immich Team",
   "wasmPath": "dist/plugin.wasm",
+  "allowedHosts": ["*"],
   "templates": [
     {
       "name": "screenshots-smart-album",
@@ -222,7 +223,16 @@
       "name": "assetLock",
       "title": "Move to locked folder",
       "description": "Change visibility to locked",
-      "types": ["AssetV1"]
+      "types": ["AssetV1"],
+      "schema": {
+        "properties": {
+          "inverse": {
+            "title": "Inverse",
+            "description": "When true will unarchive any archived assets",
+            "type": "boolean"
+          }
+        }
+      }
     },
     {
       "name": "assetTimeline",
@@ -291,6 +301,40 @@
         "required": ["albumIds"]
       }
     },
+    {
+      "name": "assetDataWebhook",
+      "title": "Trigger Webhook",
+      "description": "POST/PUT event data to any URL",
+      "types": ["AssetV1"],
+      "hostFunctions": true,
+      "schema": {
+        "type": "object",
+        "properties": {
+          "url": {
+            "type": "string",
+            "title": "URL",
+            "description": "Event data will be PUT/POSTed to this URL as a JSON object"
+          },
+          "headerName": {
+            "type": "string",
+            "title": "Header name",
+            "description": "The name of an additional header to include with the request (e.g. authentication)"
+          },
+          "headerValue": {
+            "type": "string",
+            "title": "Header value",
+            "description": "The value of the additional header"
+          },
+          "method": {
+            "type": "string",
+            "title": "Method",
+            "description": "The HTTP method to use in the request",
+            "enum": ["POST", "PUT"]
+          }
+        },
+        "required": ["url"]
+      }
+    },
     {
       "name": "noop1",
       "title": "DEV: Nested properties",

packages/plugin-core/package.json

@@ -5,7 +5,7 @@
   "main": "src/index.ts",
   "scripts": {
     "build": "pnpm build:tsc && pnpm build:wasm",
-    "build:tsc": "tsc --noEmit && node esbuild.js",
+    "build:tsc": "mkdir -p dist && echo \"type Manifest = $(cat manifest.json); \nexport default Manifest;\" > dist/manifest.d.ts && tsc --noEmit && node esbuild.js",
     "build:wasm": "extism-js dist/index.js -i src/index.d.ts -o dist/plugin.wasm"
   },
   "keywords": [],

packages/plugin-core/src/index.d.ts

@@ -22,6 +22,7 @@ declare module 'main' {
   export function assetArchive(): I32;
   export function assetLock(): I32;
   export function assetTimeline(): I32;
-  export function assetTrash(): I32;
+  // export function assetTrash(): I32;
   export function assetAddToAlbums(): I32;
+  export function assetDataWebhook(): I32;
 }

packages/plugin-core/src/index.ts

@@ -1,13 +1,11 @@
-import { wrapper } from '@immich/plugin-sdk';
-import { AssetTypeEnum, AssetVisibility, WorkflowType } from '@immich/sdk';
+import { getWrapper } from '@immich/plugin-sdk';
+import { AssetVisibility } from '@immich/sdk';
+import type manifestType from '../dist/manifest';
+
+const wrapper = getWrapper<manifestType>();
 
-type AssetFileFilterConfig = {
-  pattern: string;
-  matchType?: 'contains' | 'exact' | 'regex' | 'startsWith';
-  caseSensitive?: boolean;
-};
 export const assetFileFilter = () => {
-  return wrapper<WorkflowType.AssetV1, AssetFileFilterConfig>(({ data, config }) => {
+  return wrapper<'assetFileFilter'>(({ data, config }) => {
     const { pattern, matchType = 'contains', caseSensitive = false } = config;
 
     const { asset } = data;
@@ -43,7 +41,7 @@ export const assetFileFilter = () => {
 };
 
 export const assetMissingTimeZoneFilter = () => {
-  return wrapper<WorkflowType.AssetV1, { inverse?: boolean }>(({ config, data }) => {
+  return wrapper<'assetMissingTimeZoneFilter'>(({ config, data }) => {
     const hasTimeZone = !!data.asset?.exifInfo?.timeZone;
     const needsTimeZone = config.inverse ? true : false;
     return { workflow: { continue: hasTimeZone === needsTimeZone } };
@@ -51,13 +49,7 @@ export const assetMissingTimeZoneFilter = () => {
 };
 
 export const assetLocationFilter = () => {
-  return wrapper<
-    WorkflowType.AssetV1,
-    {
-      region?: { country?: string; state?: string; city?: string };
-      coordinate?: { latitude?: string; longitude?: string; radius?: number };
-    }
-  >(({ config, data }) => {
+  return wrapper<'assetLocationFilter'>(({ config, data }) => {
     if (
       (config.region?.country && config.region.country !== data.asset.exifInfo?.country) ||
       (config.region?.state && config.region.state !== data.asset.exifInfo?.state) ||
@@ -96,13 +88,13 @@ export const assetLocationFilter = () => {
 };
 
 export const assetTypeFilter = () => {
-  return wrapper<WorkflowType.AssetV1, { allowedTypes: AssetTypeEnum[] }>(({ config, data }) => {
+  return wrapper<'assetTypeFilter'>(({ config, data }) => {
     return { workflow: { continue: config.allowedTypes.includes(data.asset.type) } };
   });
 };
 
 export const assetFavorite = () => {
-  return wrapper<WorkflowType.AssetV1, { inverse?: boolean }>(({ config, data }) => {
+  return wrapper<'assetFavorite'>(({ config, data }) => {
     const target = config.inverse ? false : true;
     if (target !== data.asset.isFavorite) {
       return {
@@ -115,13 +107,13 @@ export const assetFavorite = () => {
 };
 
 export const assetVisibility = () => {
-  return wrapper<WorkflowType.AssetV1, { visibility: AssetVisibility }>(({ config }) => ({
-    changes: { asset: { visibility: config.visibility } },
+  return wrapper<'assetVisibility'>(({ config }) => ({
+    changes: { asset: { visibility: config.visibility as AssetVisibility } },
   }));
 };
 
 export const assetArchive = () => {
-  return wrapper<WorkflowType.AssetV1, { inverse?: boolean }>(({ config, data }) => {
+  return wrapper<'assetArchive'>(({ config, data }) => {
     if (!config.inverse && data.asset.visibility !== AssetVisibility.Archive) {
       return { changes: { asset: { visibility: AssetVisibility.Archive } } };
     }
@@ -135,7 +127,7 @@ export const assetArchive = () => {
 };
 
 export const assetLock = () => {
-  return wrapper<WorkflowType.AssetV1, { inverse?: boolean }>(({ config, data }) => {
+  return wrapper<'assetLock'>(({ config, data }) => {
     if (!config.inverse && data.asset.visibility !== AssetVisibility.Locked) {
       return { changes: { asset: { visibility: AssetVisibility.Locked } } };
     }
@@ -148,13 +140,13 @@ export const assetLock = () => {
   });
 };
 
-export const assetTrash = () => {
-  // TODO use trash/untrash host functions
-  return wrapper<WorkflowType.AssetV1, { inverse?: boolean }>(() => ({}));
-};
+// export const assetTrash = () => {
+//   // TODO use trash/untrash host functions
+//   return wrapper<WorkflowType.AssetV1, { inverse?: boolean }>(() => ({}));
+// };
 
 export const assetAddToAlbums = () => {
-  return wrapper<WorkflowType.AssetV1, { albumIds: string[]; albumName?: string }>(({ config, data, functions }) => {
+  return wrapper<'assetAddToAlbums'>(({ config, data, functions }) => {
     const assetId = data.asset.id;
 
     if (config.albumIds.length === 0) {
@@ -181,3 +173,21 @@ export const assetAddToAlbums = () => {
     return {};
   });
 };
+
+export const assetDataWebhook = () => {
+  return wrapper<'assetDataWebhook'>(({ config, data }) => {
+    const headers = new Headers({ 'Content-Type': 'application/json' });
+
+    if (config.headerName && config.headerValue) {
+      headers.set(config.headerName, config.headerValue);
+    }
+
+    fetch(config.url, {
+      method: config.method ?? 'POST',
+      body: JSON.stringify(data.asset),
+      headers,
+    });
+
+    return {};
+  });
+};

packages/plugin-core/tsconfig.json

@@ -4,7 +4,7 @@
     "declaration": true,
     "emitDeclarationOnly": true,
     "esModuleInterop": true, // Enables compatibility with Babel-style module imports
-    "lib": ["es2020"], // Specify a list of library files to be included in the compilation
+    "lib": ["es2020", "DOM"], // Specify a list of library files to be included in the compilation
     "module": "nodenext", // Specify module code generation
     "moduleResolution": "nodenext",
     "noEmit": true, // Do not emit outputs (no .js or .d.ts files)

packages/plugin-sdk/src/host-functions.ts

@@ -33,6 +33,11 @@ type HostFunctionResult<T> =
 
 type QueryParams<T extends (...args: any) => any> = Parameters<T>[0];
 type AlbumSearchDto = QueryParams<typeof getAllAlbums>;
+type HttpRequestOptions = {
+  method?: string;
+  headers?: Record<string, string>;
+  body?: string;
+};
 
 export const hostFunctions = (authToken: string) => {
   const host = Host.getFunctions();

packages/plugin-sdk/src/sdk.ts

@@ -1,53 +1,104 @@
 import type { WorkflowType } from '@immich/sdk';
 import { hostFunctions } from 'src/host-functions.js';
 import type {
-  ConfigValue,
   WorkflowEventPayload,
   WorkflowResponse,
   WorkflowStepConfig,
 } from 'src/types.js';
 
-export const wrapper = <
-  T extends WorkflowType,
-  TConfig extends ConfigValue = ConfigValue,
->(
-  fn: (
-    payload: WorkflowEventPayload<T, TConfig> & {
-      functions: ReturnType<typeof hostFunctions>;
-    },
-  ) => WorkflowResponse<T> | undefined,
-) => {
-  const input = Host.inputString();
-
-  try {
-    const payload = JSON.parse(input) as WorkflowEventPayload<T, TConfig>;
-    const event = {
-      ...payload,
-      functions: hostFunctions(payload.workflow.authToken),
-    };
-
-    const eventConfigBefore = JSON.stringify(event.config);
-
-    console.debug(
-      `Inputs: trigger=${event.trigger}, event=${event.type}, config=${eventConfigBefore}`,
-    );
-
-    const response = fn(event) ?? {};
-
-    // if config changed, notify host
-    const eventConfigAfter = JSON.stringify(event.config);
-    if (!response.config && eventConfigBefore !== eventConfigAfter) {
-      response.config = event.config as WorkflowStepConfig;
-    }
-
-    console.debug(
-      `Outputs: workflow=${JSON.stringify(response.workflow)}, changes=${JSON.stringify(response.changes)}, data=${JSON.stringify(response.data)}, config=${JSON.stringify(response.config)}`,
-    );
-
-    const output = JSON.stringify(response);
-    Host.outputString(output);
-  } catch (error: Error | any) {
-    console.error(`Unhandled plugin exception: ${error.message || error}`);
-    throw error;
-  }
+type Property = {
+  type: 'string' | 'boolean' | 'number';
+  array?: boolean;
+  enum?: string[];
+} & {
+  type: 'object';
+  properties: { [K: string]: Property };
+  required?: string[];
 };
+
+type RequiredProperties<
+  Properties extends { [K: string]: unknown },
+  Required extends string[] | undefined,
+  RequiredKeys extends string = Required extends undefined
+    ? never
+    : NonNullable<Required>[number],
+> = {
+  properties: Pick<Properties, RequiredKeys> &
+    Partial<Omit<Properties, RequiredKeys>>;
+};
+
+type GetConfigType<T extends Property> = 'enum' extends keyof T
+  ? NonNullable<T['enum']>[number]
+  : T['type'] extends 'boolean'
+    ? boolean
+    : T['type'] extends 'number'
+      ? number
+      : T['type'] extends 'string'
+        ? string
+        : T['type'] extends 'object'
+          ? ConfigValue<T>
+          : never;
+
+type ConfigValue<
+  T extends { properties: { [K: string]: Property }; required?: string[] },
+  Properties extends { [K: string]: Property } = T['properties'],
+> = T extends never
+  ? never
+  : RequiredProperties<
+      {
+        [K in keyof Properties]: Properties[K]['array'] extends true
+          ? Array<GetConfigType<Properties[K]>>
+          : GetConfigType<Properties[K]>;
+      },
+      'required' extends keyof T ? T['required'] : undefined
+    >['properties'];
+
+export const getWrapper =
+  <T extends Record<string, any>>() =>
+  <
+    K extends T['methods'][number]['name'],
+    L extends WorkflowType = (T['methods'][number] & {
+      name: K;
+    })['types'][number],
+    TConfig = ConfigValue<(T['methods'][number] & { name: K })['schema']>,
+  >(
+    fn: (
+      payload: WorkflowEventPayload<L, TConfig> & {
+        functions: ReturnType<typeof hostFunctions>;
+      },
+    ) => WorkflowResponse<L> | undefined,
+  ) => {
+    const input = Host.inputString();
+
+    try {
+      const payload = JSON.parse(input) as WorkflowEventPayload<K, TConfig>;
+      const event = {
+        ...payload,
+        functions: hostFunctions(payload.workflow.authToken),
+      };
+
+      const eventConfigBefore = JSON.stringify(event.config);
+
+      console.debug(
+        `Inputs: trigger=${event.trigger}, event=${event.type}, config=${eventConfigBefore}`,
+      );
+
+      const response = fn(event) ?? {};
+
+      // if config changed, notify host
+      const eventConfigAfter = JSON.stringify(event.config);
+      if (!response.config && eventConfigBefore !== eventConfigAfter) {
+        response.config = event.config as WorkflowStepConfig;
+      }
+
+      console.debug(
+        `Outputs: workflow=${JSON.stringify(response.workflow)}, changes=${JSON.stringify(response.changes)}, data=${JSON.stringify(response.data)}, config=${JSON.stringify(response.config)}`,
+      );
+
+      const output = JSON.stringify(response);
+      Host.outputString(output);
+    } catch (error: Error | any) {
+      console.error(`Unhandled plugin exception: ${error.message || error}`);
+      throw error;
+    }
+  };

server/src/dtos/plugin-manifest.dto.ts

@@ -58,6 +58,7 @@ const PluginManifestSchema = z
     wasmPath: z.string().min(1).describe('WASM file path'),
     author: z.string().min(1).describe('Plugin author'),
     methods: z.array(PluginManifestMethodSchema).optional().default([]).describe('Plugin methods'),
+    allowedHosts: z.array(z.string()).optional().default([]).describe('Hostnames the plugin can access'),
     templates: z
       .array(PluginManifestTemplateSchema)
       .optional()

server/src/queries/plugin.repository.sql

@@ -6,6 +6,7 @@ select
   "plugin"."name",
   "plugin"."version",
   "plugin"."wasmBytes",
+  "plugin"."allowedHosts",
   (
     select
       coalesce(json_agg(agg), '[]')
@@ -36,6 +37,7 @@ select
   "plugin"."createdAt",
   "plugin"."updatedAt",
   "plugin"."templates",
+  "plugin"."allowedHosts",
   (
     select
       coalesce(json_agg(agg), '[]')
@@ -72,6 +74,7 @@ select
   "plugin"."createdAt",
   "plugin"."updatedAt",
   "plugin"."templates",
+  "plugin"."allowedHosts",
   (
     select
       coalesce(json_agg(agg), '[]')
@@ -108,6 +111,7 @@ select
   "plugin"."createdAt",
   "plugin"."updatedAt",
   "plugin"."templates",
+  "plugin"."allowedHosts",
   (
     select
       coalesce(json_agg(agg), '[]')
@@ -144,6 +148,7 @@ select
   "plugin"."createdAt",
   "plugin"."updatedAt",
   "plugin"."templates",
+  "plugin"."allowedHosts",
   (
     select
       coalesce(json_agg(agg), '[]')

server/src/repositories/plugin.repository.ts

@@ -20,6 +20,7 @@ export type PluginHostFunction = (callContext: CallContext, input: bigint) => Pr
 export type PluginLoadOptions = {
   runInWorker?: boolean;
   functions?: Record<string, PluginHostFunction>;
+  allowedHosts?: string[];
 };
 
 export type PluginMethodSearchResponse = {
@@ -60,6 +61,7 @@ export class PluginRepository {
         'plugin.name',
         'plugin.version',
         'plugin.wasmBytes',
+        'plugin.allowedHosts',
         jsonArrayFrom(
           eb
             .selectFrom('plugin_method')
@@ -82,6 +84,7 @@ export class PluginRepository {
       'plugin.createdAt',
       'plugin.updatedAt',
       'plugin.templates',
+      'plugin.allowedHosts',
       jsonArrayFrom(
         eb
           .selectFrom('plugin_method')
@@ -159,6 +162,7 @@ export class PluginRepository {
             wasmBytes: eb.ref('excluded.wasmBytes'),
             templates: eb.ref('excluded.templates'),
             sha256hash: eb.ref('excluded.sha256hash'),
+            allowedHosts: eb.ref('excluded.allowedHosts'),
           })),
         )
         .returning(['id', 'name'])
@@ -202,7 +206,7 @@ export class PluginRepository {
     });
   }
 
-  async load({ key, label, wasmBytes }: PluginLoad, { runInWorker, functions }: PluginLoadOptions) {
+  async load({ key, label, wasmBytes }: PluginLoad, { runInWorker, functions, allowedHosts }: PluginLoadOptions) {
     const data = new Uint8Array(wasmBytes.buffer, wasmBytes.byteOffset, wasmBytes.byteLength);
     const logger = LoggingRepository.create(`Plugin:${label}`);
     const pool = createPool<ExtismPlugin>(
@@ -216,6 +220,7 @@ export class PluginRepository {
               functions: {
                 'extism:host/user': functions ?? {},
               },
+              allowedHosts,
               logger: {
                 trace: (message) => logger.verbose(message),
                 info: (message) => logger.log(message),
@@ -224,6 +229,7 @@ export class PluginRepository {
                 error: (message) => logger.error(message),
               } as Console,
               logLevel: asExtismLogLevel(logger.getLogLevel()),
+              enableWasiOutput: true,
             },
           ),
         destroy: (plugin) => plugin.close(),

server/src/schema/migrations/1782360420756-AddPluginAllowedHosts.ts

@@ -0,0 +1,9 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await sql`ALTER TABLE "plugin" ADD "allowedHosts" character varying[] NOT NULL DEFAULT '{}';`.execute(db);
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await sql`ALTER TABLE "plugin" DROP COLUMN "allowedHosts";`.execute(db);
+}

server/src/schema/tables/plugin.table.ts

@@ -43,6 +43,9 @@ export class PluginTable {
   @Column({ type: 'bytea' })
   sha256hash!: Buffer;
 
+  @Column({ type: 'character varying', default: [], array: true })
+  allowedHosts!: Generated<string[]>;
+
   @CreateDateColumn()
   createdAt!: Generated<Timestamp>;
 

server/src/services/workflow-execution.service.ts

@@ -90,7 +90,7 @@ export class WorkflowExecutionService extends BaseService {
     };
 
     const plugins = await this.pluginRepository.getForLoad();
-    for (const { id, name, version, wasmBytes, methods } of plugins) {
+    for (const { id, name, version, wasmBytes, methods, allowedHosts } of plugins) {
       const method = methods.some(({ hostFunctions }) => !hostFunctions);
       if (method) {
         const label = `${name}@${version}`;
@@ -108,7 +108,7 @@ export class WorkflowExecutionService extends BaseService {
         const label = `${name}@${version}/worker`;
         const key = this.getPluginKey({ id, hostFunctions: true });
         try {
-          await this.pluginRepository.load({ key, label, wasmBytes }, { runInWorker: true, functions });
+          await this.pluginRepository.load({ key, label, wasmBytes }, { runInWorker: true, functions, allowedHosts });
           this.logger.log(`Loaded plugin with host functions: ${label}`);
         } catch (error) {
           this.logger.error(`Unable to load plugin with host functions ${label} (${id})`, error);
@@ -214,6 +214,7 @@ export class WorkflowExecutionService extends BaseService {
           author: manifest.author,
           version: manifest.version,
           templates: manifest.templates,
+          allowedHosts: manifest.allowedHosts,
           wasmBytes,
           sha256hash,
         },