From 917ce9e177021d2581169cd9a1095e3e1c0b2d0b Mon Sep 17 00:00:00 2001
From: Andrew Kingston <andrew@kingston.dev>
Date: Wed, 14 Sep 2022 11:58:59 +0100
Subject: [PATCH] Add validation to plugins uploaded using file upload and
 allow component uploads via non-file sources in cloud

---
 packages/server/src/api/controllers/plugin/index.ts | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/packages/server/src/api/controllers/plugin/index.ts b/packages/server/src/api/controllers/plugin/index.ts
index 4f842b7708..0cd074e16b 100644
--- a/packages/server/src/api/controllers/plugin/index.ts
+++ b/packages/server/src/api/controllers/plugin/index.ts
@@ -53,10 +53,6 @@ export async function upload(ctx: any) {
 export async function create(ctx: any) {
   const { source, url, headers, githubToken } = ctx.request.body
 
-  if (!env.SELF_HOSTED) {
-    ctx.throw(400, "Plugins not supported outside of self-host.")
-  }
-
   try {
     let metadata
     let directory
@@ -87,6 +83,13 @@ export async function create(ctx: any) {
 
     validate(metadata?.schema)
 
+    // Only allow components in cloud
+    if (!env.SELF_HOSTED && metadata?.schema?.type !== PluginType.COMPONENT) {
+      throw new Error(
+        "Only component plugins are supported outside of self-host"
+      )
+    }
+
     const doc = await storePlugin(metadata, directory, source)
 
     ctx.body = {
@@ -198,6 +201,7 @@ export async function storePlugin(
 
 export async function processPlugin(plugin: FileType, source?: string) {
   const { metadata, directory } = await fileUpload(plugin)
+  validate(metadata?.schema)
 
   // Only allow components in cloud
   if (!env.SELF_HOSTED && metadata?.schema?.type !== PluginType.COMPONENT) {