[MM-49929] Work templates: allow simple users to list marketplace plugins (#22151)

api4/plugin.go

@@ -288,17 +288,18 @@ func getMarketplacePlugins(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleReadPlugins) {
-		c.SetPermissionError(model.PermissionSysconsoleReadPlugins)
-		return
-	}
-
 	filter, err := parseMarketplacePluginFilter(r.URL)
 	if err != nil {
 		c.Err = model.NewAppError("getMarketplacePlugins", "app.plugin.marshal.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
 		return
 	}
 
+	// if we are looking for remote only, we don't need to check for permissions
+	if !filter.RemoteOnly && !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleReadPlugins) {
+		c.SetPermissionError(model.PermissionSysconsoleReadPlugins)
+		return
+	}
+
 	plugins, appErr := c.App.GetMarketplacePlugins(filter)
 	if appErr != nil {
 		c.Err = appErr
@@ -386,12 +387,19 @@ func parseMarketplacePluginFilter(u *url.URL) (*model.MarketplacePluginFilter, e
 	filter := u.Query().Get("filter")
 	serverVersion := u.Query().Get("server_version")
 	localOnly, _ := strconv.ParseBool(u.Query().Get("local_only"))
+	remoteOnly, _ := strconv.ParseBool(u.Query().Get("remote_only"))
+
+	if localOnly && remoteOnly {
+		return nil, errors.New("local_only and remote_only cannot be both true")
+	}
+
 	return &model.MarketplacePluginFilter{
 		Page:          page,
 		PerPage:       perPage,
 		Filter:        filter,
 		ServerVersion: serverVersion,
 		LocalOnly:     localOnly,
+		RemoteOnly:    remoteOnly,
 	}, nil
 }
 

api4/plugin_test.go

@@ -1126,6 +1126,62 @@ func TestGetLocalPluginInMarketplace(t *testing.T) {
 	})
 }
 
+func TestGetRemotePluginInMarketplace(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	samplePlugins := []*model.MarketplacePlugin{
+		{
+			BaseMarketplacePlugin: &model.BaseMarketplacePlugin{
+				HomepageURL: "https://example.com/mattermost/mattermost-plugin-nps",
+				IconData:    "https://example.com/icon.svg",
+				DownloadURL: "www.github.com/example",
+				Manifest: &model.Manifest{
+					Id:               "testplugin2",
+					Name:             "testplugin2",
+					Description:      "a second plugin",
+					Version:          "1.2.2",
+					MinServerVersion: "",
+				},
+			},
+			InstalledVersion: "",
+		},
+	}
+
+	testServer := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		res.WriteHeader(http.StatusOK)
+		json, err := json.Marshal([]*model.MarketplacePlugin{samplePlugins[0]})
+		require.NoError(t, err)
+		res.Write(json)
+	}))
+	defer testServer.Close()
+
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.PluginSettings.Enable = true
+		*cfg.PluginSettings.EnableMarketplace = true
+		*cfg.PluginSettings.EnableRemoteMarketplace = true
+		*cfg.PluginSettings.EnableUploads = true
+		*cfg.PluginSettings.MarketplaceURL = testServer.URL
+	})
+
+	// Upload one local plugin
+	path, _ := fileutils.FindDir("tests")
+	tarData, err := os.ReadFile(filepath.Join(path, "testplugin.tar.gz"))
+	require.NoError(t, err)
+
+	manifest, _, err := th.SystemAdminClient.UploadPlugin(bytes.NewReader(tarData))
+	require.NoError(t, err)
+
+	plugins, _, err := th.SystemAdminClient.GetMarketplacePlugins(&model.MarketplacePluginFilter{RemoteOnly: true})
+	require.NoError(t, err)
+
+	require.Len(t, plugins, 1)
+	require.Equal(t, samplePlugins[0], plugins[0])
+
+	_, err = th.SystemAdminClient.RemovePlugin(manifest.Id)
+	require.NoError(t, err)
+}
+
 func TestGetPrepackagedPluginInMarketplace(t *testing.T) {
 	th := Setup(t)
 	defer th.TearDown()