Update plugins to only be enabled when ALLOW_PLUGINS=1 env variable is set or AllowPlugins: true in dev.js

client/components/app/ConfigSideNav.vue

@@ -109,13 +109,16 @@ export default {
           id: 'config-authentication',
           title: this.$strings.HeaderAuthentication,
           path: '/config/authentication'
-        },
+        }
-        {
+      ]
+
+      if (this.$store.state.pluginsEnabled) {
+        configRoutes.push({
           id: 'config-plugins',
           title: 'Plugins',
           path: '/config/plugins'
-        }
+        })
-      ]
+      }
 
       if (this.currentLibraryId) {
         configRoutes.push({

client/pages/login.vue

@@ -170,7 +170,10 @@ export default {
       this.$store.commit('setServerSettings', serverSettings)
       this.$store.commit('setSource', Source)
       this.$store.commit('libraries/setEReaderDevices', ereaderDevices)
-      this.$store.commit('setPlugins', plugins)
+      if (plugins !== undefined) {
+        this.$store.commit('setPlugins', plugins)
+      }
+
       this.$setServerLanguageCode(serverSettings.language)
 
       if (serverSettings.chromecastEnabled) {

client/store/index.js

@@ -29,7 +29,8 @@ export const state = () => ({
   innerModalOpen: false,
   lastBookshelfScrollData: {},
   routerBasePath: '/',
-  plugins: []
+  plugins: [],
+  pluginsEnabled: false
 })
 
 export const getters = {
@@ -64,6 +65,7 @@ export const getters = {
     return state.serverSettings.homeBookshelfView
   },
   getPluginExtensions: (state) => (target) => {
+    if (!state.pluginsEnabled) return []
     return state.plugins
       .map((pext) => {
         const extensionsMatchingTarget = pext.extensions?.filter((ext) => ext.target === target) || []
@@ -256,5 +258,6 @@ export const mutations = {
   },
   setPlugins(state, val) {
     state.plugins = val
+    state.pluginsEnabled = true
   }
 }

index.js

@@ -13,6 +13,7 @@ if (isDev) {
   if (devEnv.SkipBinariesCheck) process.env.SKIP_BINARIES_CHECK = '1'
   if (devEnv.AllowIframe) process.env.ALLOW_IFRAME = '1'
   if (devEnv.BackupPath) process.env.BACKUP_PATH = devEnv.BackupPath
+  if (devEnv.AllowPlugins) process.env.ALLOW_PLUGINS = '1'
   process.env.SOURCE = 'local'
   process.env.ROUTER_BASE_PATH = devEnv.RouterBasePath || ''
 }

server/Auth.js

@@ -935,14 +935,12 @@ class Auth {
    */
   async getUserLoginResponsePayload(user) {
     const libraryIds = await Database.libraryModel.getAllLibraryIds()
-    return {
+
-      user: user.toOldJSONForBrowser(),
+    let plugins = undefined
-      userDefaultLibraryId: user.getDefaultLibraryId(libraryIds),
+    if (process.env.ALLOW_PLUGINS === '1') {
-      serverSettings: Database.serverSettings.toJSONForBrowser(),
-      ereaderDevices: Database.emailSettings.getEReaderDevices(user),
       // TODO: Should be better handled by the PluginManager
       // restrict plugin extensions that are not allowed for the user type
-      plugins: this.pluginManifests.map((manifest) => {
+      plugins = this.pluginManifests.map((manifest) => {
         const manifestExtensions = (manifest.extensions || []).filter((ext) => {
           if (ext.restrictToAccountTypes?.length) {
             return ext.restrictToAccountTypes.includes(user.type)
@@ -950,7 +948,15 @@ class Auth {
           return true
         })
         return { ...manifest, extensions: manifestExtensions }
-      }),
+      })
+    }
+
+    return {
+      user: user.toOldJSONForBrowser(),
+      userDefaultLibraryId: user.getDefaultLibraryId(libraryIds),
+      serverSettings: Database.serverSettings.toJSONForBrowser(),
+      ereaderDevices: Database.emailSettings.getEReaderDevices(user),
+      plugins,
       Source: global.Source
     }
   }

server/Server.js

@@ -151,10 +151,14 @@ class Server {
       })
     }
 
-    // Initialize plugins
+    if (process.env.ALLOW_PLUGINS === '1') {
-    await PluginManager.init()
+      Logger.info(`[Server] Experimental plugin support enabled`)
-    // TODO: Prevents circular dependency for SocketAuthority
+
-    this.auth.pluginManifests = PluginManager.pluginManifests
+      // Initialize plugins
+      await PluginManager.init()
+      // TODO: Prevents circular dependency for SocketAuthority
+      this.auth.pluginManifests = PluginManager.pluginManifests
+    }
   }
 
   /**