feat(plugins): create plugin sandbox with capability-based permissions (#824)

[ogundeleoluwaferanmi35]

Summary

Resolves #824 by introducing a capability-based permission sandbox for the plugin system and CLI scaffolding.

Objectives & Changes Implemented

1. Capability-Based Permissions Model (src/plugins/capabilitySandbox.ts):

   • Defined standardized capability scopes (CAPABILITY_SCOPES) and error codes (CAPABILITY_ERROR_CODES).
   • Implemented PluginCapabilityController managing dynamic capability tracking (grant, revoke, revokeAll, assertCapability).
   • Added automated cleanup of active store listeners and resources when capabilities are revoked.
   • Built createSandboxedDashboardApi with strict per-capability guards on getState, getConfig, subscribe, actions, notifications, storage, fetch, and openWindow.
   • Added bidirectional postMessage RPC bridge (handlePluginRpcMessage) supporting requests, responses, subscriptions, and broadcast of PLUGIN_CAPABILITY_REVOKED events.
   • Provided client helper SDK (createSandboxClient) with request matching, timeouts, and revocation listeners.

2. Isolated Plugin Storage (src/plugins/pluginStorage.ts):

   • Partitioned storage per plugin under stellar-dashboard:plugin-data:<pluginId> to prevent cross-plugin data leakage or collision.
   • Integrated automatic purge of isolated plugin storage upon plugin uninstallation.

3. Plugin Manager Integration (src/plugins/PluginManager.ts):

   • Integrated PluginCapabilityController lifecycle into PluginManager.
   • Added getCapabilityController, grantCapability, revokeCapability, and revokeAllCapabilities.
   • Injected sandboxed controller and API into iframe widget frames and module plugins.
   • Ensured proper controller disposal on uninstallation.

4. UI Revocation Controls (src/components/dashboard/PluginRegistryView.tsx):

   • Displayed granted capability chips for each installed plugin with one-click revocation buttons (×).
   • Updated plugin cards with dynamic revocation handlers.

5. CLI Scaffolding (scripts/create-plugin.mjs):

   • Added --capabilities / --permissions flag parsing.
   • Added validation against allowed scopes and input checking.
   • Updated scaffold templates to demonstrate capability-guarded calls and revocation listeners over postMessage.

6. Documentation & Developer Guidance (docs/plugins/README.md):

   • Documented the capability-based security model, scopes matrix, RPC bridge protocol, error codes, and migration notes.

Acceptance Criteria Checklist

• Clear handling for invalid input, unsupported environments, and failure paths.
• Automated tests covering primary flow, boundary conditions, and failure cases:
  • src/plugins/__tests__/capabilitySandbox.test.ts (22 tests)
  • src/plugins/__tests__/pluginSandbox.test.tsx (5 tests)
  • src/plugins/__tests__/PluginManager.test.ts (3 tests)
  • tests/create-plugin.test.mjs (8 tests)
• User-facing documentation updated in docs/plugins/README.md.
• Free of merge conflicts with target branch (master).
• Zero ESLint errors or warnings on touched files.

[vercel]

@0dillon is attempting to deploy a commit to the nanle-code's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@ogundeleoluwaferanmi35 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits