Apps (plugins): reference

#Manifest (deplao-plugin.json)

#Plugin permissions

#Extension points (contributes)

#SDK deplao.*

Errors come back as an Error with a code (the same error codes as the API: FORBIDDEN_SCOPE, FORBIDDEN_ACCOUNT, VALIDATION_ERROR…) and a status. deplao.cloudflare adds PLUGIN_PERMISSION, CF_NOT_CONNECTED, CF_PERMISSION, CF_NAME_FORBIDDEN, CF_BUNDLE_INVALID, CF_API.

#Backend (runtime local)

module.exports = {
  async activate({ deplao, settings, pluginId, dataDir }) {},
  async deactivate() {},                        // 5 seconds max
  async onUpgrade(prevVersion) {},
  async onSettingsChanged(settings) {},
  nodes: { 'shop.lookup': async (cfg, run, ctx) => ({ found: true }) },   // 60 seconds
  routes: { 'GET /orders/:code': async (req, ctx) => ({ status: 200, body: {} }) },   // 30 seconds
  handlers: { remind: async (ctx) => {} },     // schedules, 120 seconds
  commands: { book: async (params, ctx) => ({}) },   // UI backend.call, composer buttons
};

• Runs in a separate process (utilityProcess, 256 MB heap) and only receives a few environment variables; require('electron') and process.exit are blocked; console.* goes to the plugin log.
• After a crash it restarts automatically after 2 s, 10 s, 60 s; on the 4th crash the plugin is turned off ("Disabled due to error", Tắt do lỗi). If it fails to answer 3 pings in a row, it is restarted.
• A plugin is still Node code running on the machine: Deplao only hands out data according to the approved permissions, but it does not isolate the process's file system or network access. Only install plugins from trusted sources.

#Runtime remote

• Deplao calls POST {remote.baseUrl}/rpc with the body { id, method, params } and the headers X-Deplao-Plugin, X-Deplao-Timestamp, X-Deplao-Signature: v1=HMAC-SHA256(secret, timestamp + "." + body). Respond with { result } or { error: { code, message } }.
• method: activate, deactivate, ping, node.execute, route.handle, schedule.run, composer.command, settings.changed.
• On install, Deplao creates a secret and an API key (bound to the plugin, revoked when it is uninstalled) and shows them once. Your server uses the key to call API v1 and to register webhooks for receiving events.
• baseUrl must be https (http is allowed only for 127.0.0.1 during development).

#Security

• The plugin UI runs on its own origin deplao-plugin://<id> in a sandboxed iframe (no popups, no navigating the app's pages, no access to the app's DOM, store or IPC); the CSP blocks external scripts, outgoing connections except ui.connectSrc, and external images except ui.imgSrc.
• Every data call goes through API v1 with the principal plugin:<id>: limited to the scopes and accounts granted at install time, with requests logged just like for API keys.
• Zip packages are checked: max 50 MB, max 200 MB unpacked, no absolute paths or .., no symlinks, matching CRCs.
• The plugin management IPC channels (plugins:*) cannot be called through the API or from a plugin. The same applies to the Cloudflare channels (cloudflare:*), except cloudflare:workers:* when the app has the cloudflare:workers permission: Deplao checks the permission and the name prefix before making the call.