feat(cabana): read-only Plugins screen with installed plugins

- GET /plugins (backend.view_plugins, superusers always pass) lists the
  plugins from party.Installed, or party.Activated IDs for older builds,
  with the built framework version and whether the registry is configured
- Settings -> System -> Plugins entry with the new SettingsEntry.path,
  added only for principals allowed to open it
- PluginsView at /system/plugins with an Installed tab (reka-ui Tabs);
  settings panel, rail, breadcrumbs and page title know the route
- OpenAPI and SPA types regenerated; contract, token-class and
  conformance inventories list the route; en/pl strings; docs

modules/cabana/README.md

@@ -57,6 +57,7 @@ Use cases:
 - Roles screen: Settings → System → Roles (controller `cabana.RolesControllerID`, permission `cabana.PermissionManageRoles`) lists, creates, edits and deletes backend roles with name, code (slugged from the name), description and a checkbox permission editor. System roles (`is_system`, or a code that code-declared `pact.Permission` grants attach to) keep their code and cannot be deleted, a role any administrator holds (deleted ones included) cannot be deleted, a code another role uses is refused, and a non-superuser editor cannot add or remove a permission they lack. The update form's Administrators tab lists the role's holders read-only (a form partial): superusers only for superuser editors, deleted and deactivated holders marked, the first 100 with a note naming the total, each login linked to the Administrators preview for an editor holding `cabana.PermissionManageUsers`; roles are assigned only on the Administrators form.
 - Record actions on another plugin's controller: a plugin implementing `pact.HasAdminActionExtensions` adds `pact.AdminRecordAction` entries to any admin controller by its ID (`pact.AdminActionExtension`), its own, another plugin's or the admin's own Administrators screen (`cabana.AdministratorsControllerID`). They are merged at boot after the target's own record actions, in plugin activation order, offered on the target's preview screen and run through the same row-locked record action route; the target's `RequiredPermissions` and the action's own `Permissions` both apply. Contributions targeting `cabana.AdministratorsControllerID` run `guardOutranked` before `Run` (403 `user.outranked`, `Run` not called). An unknown controller ID, a target without a preview block, a name the target already registers (the owner's or an earlier contribution), a reserved or non-identifier name, a missing `Run` or an empty label stops the boot. Extensions are compiled only when the admin is active.
 - Form fields on another plugin's controller: a `pact.AdminActionExtension` with `Form` set to a `pact.AdminFormExtension` places fields and tabs in any admin controller's form by its ID. Its fields document is the `fields.yaml` format plus `before:`/`after:` anchors, `zone:` (only the tab zone for now) and a `tabs:` list, compiled at boot with every `fields.yaml` check; extensions apply in plugin activation order and the form is sent in the compiled order, so the SPA adds no ordering. `Hide` removes owner fields, `Permissions` and `Visible` decide per request who sees the fields (schema, show and save alike), widget fields run the extension's `Actions` and partial fields render from its `Dir` through `PartialData`. Extension values leave the save body before any owner path reads them; `Save` runs in the record's save transaction after the owner row is written (`pact.AdminFormErrors` answers 422, its notices join `meta.notices`) and `Load` serves the values on show. A form no extension lays out compiles unchanged. Unknown anchors, duplicate names, anchor cycles, anchors outside `Requires()`, other zones, `fileupload` fields and clashing widget action or partial names stop the boot naming the plugin, the controller and the name.
+- Plugins screen: Settings → System → Plugins opens the admin SPA route `/system/plugins` (the settings entry carries `path` instead of a controller) for administrators holding `cabana.PermissionViewPlugins` (`backend.view_plugins`, granted to no role in code; superusers always pass). GET `/plugins` lists the plugins the application was built with from the `party.Installed` metadata `summer build` bakes (name, description, version, source, module and package), or only the IDs of `party.Activated` for an application built before that metadata existed, with the framework version and the state of the plugin registry (`plugins.registry_url`, read through `kiosk.RegistryURL`).
 - Administrators screen: when some plugin registers admin controllers, `cabana.Activate` also compiles the admin's own screens, an internal plugin with ID `summercms.cabana`. Settings → System → Administrators (controller `cabana.AdministratorsControllerID`, permission `cabana.PermissionManageUsers`) lists backend administrators with their role and last sign-in, opens a preview of each, where record actions (the admin's own and contributed ones) are offered, and creates and edits administrators: login, email, names, a password (hashed at `admin.password.bcrypt_cost`, at least 4 characters and at most 72 bytes), the role and per-administrator permission overrides. The server enforces the privilege rules in the save transaction: only a superuser sees superusers or sends the superuser switch, an administrator can neither grant permissions or roles above their own grants nor change an administrator who holds more than they do, their own role, superuser flag, permissions and password are not changed here, and the last active superuser cannot be demoted. A password set for another administrator ends their sessions (personal API tokens stay valid, as with `admin:reset-password`). Administrators are activated, deactivated and restored by record and bulk actions and deleted softly through `deleted_at` (never hard-deleted); the list shows deleted and deactivated rows with their row states and filters deleted ones, and the preview shows a status hint. Deactivating or deleting an administrator ends their sessions and stops their personal API tokens; the last active superuser cannot be demoted, deactivated or deleted on any of these paths (a transaction-scoped advisory lock serializes the check). The permission codes `cabana.PermissionManageUsers` and `cabana.PermissionManageRoles` are registered with no role grant, so after an upgrade only superusers see the screens until an administrator grants them. An application without admin controllers still activates no admin.
 - Danger record actions: `pact.AdminRecordAction.Danger` is served as `danger` on the record response's `cabana.RecordAction` (absent when false, so existing payloads are unchanged); the admin's confirm dialog then uses its danger variant.
 - Prompted record actions: a `pact.AdminRecordAction` with a `Prompt` (`pact.AdminActionPrompt`) asks the administrator for one text value in its confirm dialog. The record response serves it as `prompt` on the action's `cabana.RecordAction` (absent for every other action, so existing payloads are unchanged), and the action route accepts the body key `payload`, a JSON string, only for such an action: trimmed, not empty and at most `max_length` runes (422 on `payload` with `backend::lang.form.action_prompt_required` or `action_prompt_too_long`, `backend::lang.form.action_prompt_invalid` for another JSON type), then handed to `Run` as `pact.AdminRecordActionInput.Value`. Every other record action keeps refusing `record_id`, `values` and `payload`. A prompt without a label fails boot, owned or contributed.
@@ -91,7 +92,8 @@ Guarded routes run surf's `locale.from-principal` after the backend guard: an in
 | GET `/account/tokens/scopes` | Scopes the caller may assign (`cabana.AdminAPITokenScope`), including `*`, `admin:read` and overlapping plugin scopes. Interactive session only. |
 | GET `/account/contributions` | The sections plugins contribute to My account (`cabana.AccountContributionView`): translated label, description and status for the signed-in administrator, and the actions (`cabana.AccountContributionActionView`) they hold the permissions for and whose `Applies` reports true. A section whose status or one of whose actions' `Applies` failed carries `error: true`. An empty list when no plugin contributes. Interactive session only. |
 | POST `/account/contributions/{name}/actions/{action}` | Run one contributed action for the signed-in administrator: 404 for an unknown section or action, 403 without the action's permissions, 409 when it no longer applies; `Run` gets the administrator's id inside a transaction and answers `cabana.AccountActionResultView` (translated `message`, optional `url`, only an `http`/`https` or same-origin URL). Interactive session only, AJAX header required. |
-| GET `/navigation`, GET `/settings` | Navigation and settings entries the administrator may open and, for a navigation entry with a `Visible` func, that it answers true for the request; a settings entry's `controller` names the admin controller a link entry opens and is empty for a singleton form. |
+| GET `/navigation`, GET `/settings` | Navigation and settings entries the administrator may open and, for a navigation entry with a `Visible` func, that it answers true for the request; a settings entry's `controller` names the admin controller a link entry opens and is empty for a singleton form, and `path` (only on the admin's own Plugins entry) names the SPA route it opens. |
+| GET `/plugins` | The Plugins screen (`cabana.PluginsOverview`): the framework version the application was built with, the registry state (`cabana.RegistryState`: `enabled`, `status` ok or disabled) and every activated plugin in summer.yaml order (`cabana.InstalledPlugin`). 403 without `cabana.PermissionViewPlugins`. |
 | GET `/field-types` | The plugin field types (`pact.HasFormFieldTypes`) sorted by name, each with its `element`, `translatable` flag and the versioned URLs of its `scripts` and `styles` (`cabana.FieldTypesResponse`); an empty list when no plugin registers one. The SPA loads them after sign-in. Needs any backend session. |
 | POST `/{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload` | Store one multipart part named `file` through the `Upload` of the field's plugin field type and answer 201 `{url}` (`cabana.FieldUploadResponse`). `{id}` 0 is the create form and passes no record; any other id loads the record through the form scope (404 outside it). 403 when the controller does not declare the save the upload belongs to (create for `{id}` 0, which needs the list's `create` toolbar button, update otherwise), as the save routes answer. 404 for a field without a plugin type with `Upload` or whose context does not allow the operation, 413 over `http.body_limits.upload_bytes`, 422 on the field for a malformed body or a `pact.FormFieldError`. The body is read and checked whole before `Upload` runs, so a refused request stores nothing. |
 | GET `/settings/{code}/schema`, GET and PUT `/settings/{code}` | Settings form schema, values and update. |
@@ -296,6 +298,10 @@ func (p *Plugin) AdminFS() fs.FS { return adminFS }
 | `cabana.AdminRelationLinkRequest` | Documented body of the link route: `ids` and the optional `pivot` object. |
 | `cabana.BackendUser` / `cabana.BackendUserRole` / `cabana.BackendUsers` | GORM models of the backend user tables and the principal loader used by the guard. |
 | `cabana.PermissionManageUsers` / `cabana.PermissionManageRoles` | The permission codes of the Administrators (`backend.manage_users`) and Roles (`backend.manage_roles`) screens, granted to no role in code. |
+| `cabana.PermissionViewPlugins` | The permission code of the Plugins screen (`backend.view_plugins`), granted to no role in code. |
+| `cabana.PluginsOverview` / `cabana.InstalledPlugin` / `cabana.RegistryState` | The GET `/plugins` payload: framework version, registry state and the installed plugins with their baked metadata. |
+| `cabana.SettingsEntry.Path` | The SPA route a settings entry of the admin's own opens (`/system/plugins`); empty, and omitted from JSON, for plugin entries. |
+| `cabana.AdminPluginsInstalled` | Swag annotation of GET `/plugins`. |
 | `cabana.AdministratorsControllerID` / `cabana.RolesControllerID` | The admin controller IDs of the Administrators (`summercms.cabana.users`) and Roles (`summercms.cabana.roles`) screens; a plugin names the first in `pact.AdminActionExtension.Controller` to add record actions to it. |
 | `cabana.BackendUser.Fillable` / `cabana.BackendUser.Rules` | The columns the Administrators screen fills from a form (login, email, first and last name) and their base rules. |
 | `cabana.BackendUserRole.Fillable` / `cabana.BackendUserRole.Rules` | The columns a role form fills (name, code, description) and their base rules. |
@@ -396,7 +402,7 @@ TOKEN=$(./bin/acme admin:token:create admin@example.com --name agent --scope blo
 
 ## Dependencies
 
-- SummerCMS modules: [backpack](../backpack/README.md), [boardwalk](../boardwalk/README.md), [bonfire](../bonfire/README.md), [bouncer](../bouncer/README.md), [diary](../diary/README.md) (component logger `cabana`; the `admin.auth` audit record keeps its message), [lagoon](../lagoon/README.md), [pact](../pact/README.md), [party](../party/README.md), [phrasebook](../phrasebook/README.md), [seaglass](../seaglass/README.md) (sanitizes `richeditor` values), [towel](../towel/README.md).
+- SummerCMS modules: [backpack](../backpack/README.md), [boardwalk](../boardwalk/README.md), [bonfire](../bonfire/README.md), [bouncer](../bouncer/README.md), [diary](../diary/README.md) (component logger `cabana`; the `admin.auth` audit record keeps its message), [kiosk](../kiosk/README.md) (the plugin registry URL and client of the Plugins screen), [lagoon](../lagoon/README.md), [pact](../pact/README.md), [party](../party/README.md), [phrasebook](../phrasebook/README.md), [seaglass](../seaglass/README.md) (sanitizes `richeditor` values), [towel](../towel/README.md).
 - Third-party: `gorm.io/gorm` (with `gorm.io/gorm/clause`), `github.com/goccy/go-yaml` (with its `ast` package), `golang.org/x/net/html` (with its `atom` package; parses rendered partials for the allowlist walk).
 - Standard library: `bytes`, `context`, `crypto/sha256`, `database/sql`, `encoding/hex`, `encoding/json`, `errors`, `fmt`, `html/template`, `io`, `io/fs`, `log/slog`, `math`, `net`, `net/http`, `path`, `reflect`, `regexp`, `slices`, `sort`, `strconv`, `strings`, `time`, `unicode/utf8`.
 - Tests additionally use `github.com/testcontainers/testcontainers-go` and its `modules/postgres` package, and [signpost](../signpost/README.md) for the dependent dropdown fixture.
@@ -422,3 +428,5 @@ A Detached bulk action (`pact.AdminBulkAction.Detached`) is covered by the Postg
 The localization of refusals is covered by Docker-free unit tests in `localize_error_test.go` (TestLocalizeControllerErrorValidation, TestLocalizeControllerErrorForbidden and TestWriteCRUDErrorLocalized, on a two-locale catalog; the plugin's error value stays unchanged and text without `::` is never looked up) and by the Postgres tests TestValidationErrorLocalized (a form hook's `cabana.ValidationError` in en and pl) and TestReorderHookRefusalLocalized (both refusal types from `pact.ReorderAfterSave`).
 
 The Roles form's holders list is covered by the Docker-free TestRolesHoldersPartial in `backend_screens_test.go` (the users partial field on the update form's Administrators tab, the view model guard, links, state lines, escaped holder strings, the empty line and the note) and the Postgres test TestRolesHolders in `roles_postgres_test.go` (superusers hidden from non-superuser editors, D-03; deleted and deactivated holders; preview links only with `cabana.PermissionManageUsers`; the empty role; the 100-row cap with its note; 403 without `cabana.PermissionManageRoles`).
+
+The Plugins screen is covered by the Docker-free TestPluginsScreenSmoke in `plugins_smoke_test.go`: the installed list from `party.Installed` and the `party.Activated` fallback, 401 and 403 without `cabana.PermissionViewPlugins`, and the settings entry with its `path` only for allowed administrators.

modules/cabana/admin_openapi.go

@@ -479,6 +479,19 @@ func AdminFieldTypes() {}
 // @Router /settings [get]
 func AdminSettingsList() {}
 
+// AdminPluginsInstalled documents GET /plugins.
+//
+// @Summary Installed plugins
+// @Description The plugins the application was built with, in summer.yaml order, with the name, description, version and source summer build baked in (only the ID for an application built before plugin metadata existed), the framework version the application was built with and whether the plugin registry is configured (registry.enabled false and registry.status disabled when plugins.registry_url is empty). Requires backend.view_plugins (superusers always pass).
+// @Tags admin
+// @Produce json
+// @Security BackendBearer
+// @Success 200 {object} Envelope[PluginsOverview]
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 403 {object} ErrorEnvelope
+// @Router /plugins [get]
+func AdminPluginsInstalled() {}
+
 // AdminSettingsSchema documents GET /settings/{code}/schema.
 //
 // @Summary Admin settings schema

modules/cabana/backend_screens.go

@@ -77,12 +77,15 @@ func (s *backendScreens) AdminControllers() []pact.AdminController {
 	return []pact.AdminController{usersAdmin{screens: s}, rolesAdmin{screens: s}}
 }
 
-// Permissions declares the two screen permissions with no role grants
-// (D-04): an upgrade gives no existing role access to the screens.
+// Permissions declares the screen permissions with no role grants (D-04):
+// an upgrade gives no existing role access to the screens. The Plugins
+// screen (PermissionViewPlugins) is served by cabana itself, not by an
+// admin controller.
 func (*backendScreens) Permissions() []pact.Permission {
 	return []pact.Permission{
 		{Code: PermissionManageUsers, Tab: "backend::lang.permissions.tab_system", Label: "backend::lang.permissions.manage_users"},
 		{Code: PermissionManageRoles, Tab: "backend::lang.permissions.tab_system", Label: "backend::lang.permissions.manage_roles"},
+		{Code: PermissionViewPlugins, Tab: "backend::lang.permissions.tab_system", Label: "backend::lang.permissions.view_plugins"},
 	}
 }
 

modules/cabana/http.go

@@ -337,6 +337,8 @@ func (s *service) mount(r pact.Router) {
 		// Form previews render through RenderMarkdown; nothing is stored.
 		g.Post("/markdown/preview", requireAjax(s.markdownPreview))
 		g.Get("/settings", s.settingsList)
+		// The read-only Plugins screen (backend.view_plugins).
+		g.Get("/plugins", s.pluginsInstalled)
 		g.Get("/settings/{code}/schema", s.settingsSchema)
 		constrainSetting(g)
 		g.Get("/settings/{code}", s.settingsGet)

modules/cabana/navigation.go

@@ -32,6 +32,9 @@ type SettingsEntry struct {
 	// Controller is the admin controller a link entry opens; empty for a
 	// singleton settings form.
 	Controller string `json:"controller"`
+	// Path is the admin SPA route an entry of the admin's own opens (the
+	// Plugins screen, /system/plugins); omitted for plugin entries.
+	Path string `json:"path,omitempty"`
 }
 
 // Metadata returns only entries the backend principal may open. Denied
@@ -103,6 +106,13 @@ func (r *Registry) Metadata(ctx context.Context, principal *bouncer.Principal, t
 			Controller: item.Controller,
 		})
 	}
+	if r.listsPluginsScreen(principal) {
+		settings = append(settings, pluginsSettingsEntry(
+			translateKey(ctx, tr, "backend::lang.plugins.menu_label"),
+			translateKey(ctx, tr, "backend::lang.plugins.menu_description"),
+			translateKey(ctx, tr, "backend::lang.settings.category_system"),
+		))
+	}
 	sort.SliceStable(settings, func(i, j int) bool {
 		if settings[i].Order == settings[j].Order {
 			return settings[i].Code < settings[j].Code
@@ -112,6 +122,20 @@ func (r *Registry) Metadata(ctx context.Context, principal *bouncer.Principal, t
 	return navigation, settings
 }
 
+// listsPluginsScreen reports whether the settings list links the Plugins
+// screen for principal: the admin's own screens are compiled (they declare
+// PermissionViewPlugins), no plugin took the settings code "plugins", and
+// the principal may open the screen.
+func (r *Registry) listsPluginsScreen(principal *bouncer.Principal) bool {
+	if _, declared := r.permissions[PermissionViewPlugins]; !declared {
+		return false
+	}
+	if _, taken := r.settings[pluginsSettingsCode]; taken {
+		return false
+	}
+	return Allows(principal, []string{PermissionViewPlugins})
+}
+
 // openableTarget returns the controller a main item should link to. It is the
 // item's own controller unless the principal cannot open it or it is the
 // controller of a side item hidden for this request (in hidden), in which

modules/cabana/openapi_conformance_test.go

@@ -412,6 +412,9 @@ func conformCases() []conformCase {
 		{"GET /settings", 200, "cabana.Envelope-array_cabana_SettingsEntry", func(t *testing.T, e *conformEnv) *httptest.ResponseRecorder {
 			return e.send(t, http.MethodGet, "/settings", nil, true)
 		}, into[cabana.Envelope[[]cabana.SettingsEntry]](), nil},
+		{"GET /plugins", 200, "cabana.Envelope-cabana_PluginsOverview", func(t *testing.T, e *conformEnv) *httptest.ResponseRecorder {
+			return e.send(t, http.MethodGet, "/plugins", nil, true)
+		}, into[cabana.Envelope[cabana.PluginsOverview]](), nil},
 		{"GET /settings/{code}/schema", 200, "cabana.Envelope-cabana_FormView", func(t *testing.T, e *conformEnv) *httptest.ResponseRecorder {
 			return e.send(t, http.MethodGet, "/settings/conform/schema", nil, true)
 		}, into[cabana.Envelope[cabana.FormView]](), nil},
@@ -1032,6 +1035,10 @@ func newConformEnv(t *testing.T) *conformEnv {
 	}
 	login := "conform-" + stamp
 	insertAdmin(t, gdb, login, login+"@example.test", adminTestPassword, true, false)
+	// The Plugins screen needs backend.view_plugins, which no role holds.
+	if err := gdb.Exec(`UPDATE backend_users SET permissions = ? WHERE login = ?`, `{"backend.view_plugins":1}`, login).Error; err != nil {
+		t.Fatal(err)
+	}
 
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, "app.yaml"), []byte("name: cabana-conform\nlocale: en\nfallback_locale: en\n"), 0o644); err != nil {
@@ -1041,7 +1048,8 @@ func newConformEnv(t *testing.T) *conformEnv {
 	if err != nil {
 		t.Fatal(err)
 	}
-	for key, value := range map[string]any{"http.body_limits.default_bytes": 1048576, "http.body_limits.upload_bytes": 1048576} {
+	// plugins.registry_url "" keeps GET /plugins from calling a registry.
+	for key, value := range map[string]any{"http.body_limits.default_bytes": 1048576, "http.body_limits.upload_bytes": 1048576, "plugins.registry_url": ""} {
 		if err := cfg.Set(key, value); err != nil {
 			t.Fatal(err)
 		}

modules/cabana/plugins.go

@@ -0,0 +1,156 @@
+package cabana
+
+import (
+	"net/http"
+
+	"git.golem15.com/golem15/summercms/modules/bonfire"
+	"git.golem15.com/golem15/summercms/modules/bouncer"
+	"git.golem15.com/golem15/summercms/modules/kiosk"
+	"git.golem15.com/golem15/summercms/modules/party"
+)
+
+// The admin's read-only Plugins screen (Settings → System → Plugins): the
+// plugins the application was built with, their versions and, when the
+// plugin registry is configured, available updates and a marketplace
+// search. The SPA calls only these endpoints; cabana calls the registry.
+
+// PermissionViewPlugins opens the Plugins screen. No role is granted it in
+// code: until an administrator grants it, only superusers see the screen.
+const PermissionViewPlugins = "backend.view_plugins"
+
+// pluginsSettingsCode is the settings code of the Plugins screen entry and
+// pluginsScreenPath the SPA route it opens.
+const (
+	pluginsSettingsCode = "plugins"
+	pluginsScreenPath   = "/system/plugins"
+)
+
+// States of the plugin registry on the Plugins screen.
+const (
+	// registryStatusOK: the registry answered (or is configured and was
+	// not needed for this answer).
+	registryStatusOK = "ok"
+	// registryStatusDisabled: plugins.registry_url is empty; no request
+	// leaves the process.
+	registryStatusDisabled = "disabled"
+	// registryStatusUnavailable: the registry did not answer in time or
+	// answered with an error.
+	registryStatusUnavailable = "unavailable"
+)
+
+// PluginsOverview is the GET /plugins payload: the framework version the
+// application was built with, the state of the plugin registry and every
+// activated plugin in summer.yaml order.
+type PluginsOverview struct {
+	Framework string            `json:"framework"`
+	Registry  RegistryState     `json:"registry"`
+	Plugins   []InstalledPlugin `json:"plugins"`
+}
+
+// RegistryState tells the admin whether the plugin registry is configured
+// (Enabled, false when plugins.registry_url is empty) and how it answered:
+// Status is ok, disabled or unavailable.
+type RegistryState struct {
+	Enabled bool   `json:"enabled"`
+	Status  string `json:"status"`
+}
+
+// InstalledPlugin is one activated plugin with the metadata summer build
+// baked in (party.Info) and, for a plugin the registry lists, the newest
+// release the built framework version allows. Name, Description, Version,
+// Source, Module and Package are empty for an application built before
+// plugin metadata existed and for a plugin without plugin.yaml (Name and
+// Description). Latest is the newest compatible release; UpdateAvailable
+// is true when it is newer than the installed version, and UpdateCommand
+// is then the summer command that installs it. LatestFramework names the
+// framework version a newer, incompatible release needs.
+type InstalledPlugin struct {
+	ID              string `json:"id"`
+	Name            string `json:"name"`
+	Description     string `json:"description"`
+	Version         string `json:"version"`
+	Source          string `json:"source"`
+	Module          string `json:"module"`
+	Package         string `json:"package"`
+	Listed          bool   `json:"listed"`
+	Latest          string `json:"latest"`
+	LatestFramework string `json:"latestFramework"`
+	UpdateAvailable bool   `json:"updateAvailable"`
+	UpdateCommand   string `json:"updateCommand"`
+}
+
+// pluginsSettingsEntry is the Settings → System link to the Plugins
+// screen. It opens an SPA route, not an admin controller.
+func pluginsSettingsEntry(label, description, category string) SettingsEntry {
+	return SettingsEntry{
+		Code: pluginsSettingsCode, Label: label, Description: description,
+		Category: category, Icon: "puzzle", Order: 120, Keywords: []string{},
+		Path: pluginsScreenPath,
+	}
+}
+
+// pluginsPrincipal answers 401 without a backend principal and 403 when
+// the principal may not open the Plugins screen; ok is false after either.
+func pluginsPrincipal(w http.ResponseWriter, r *http.Request) (*bouncer.Principal, bool) {
+	principal, ok := bouncer.User(r.Context())
+	if !ok || principal == nil || !principal.Backend {
+		WriteError(w, http.StatusUnauthorized, "unauthenticated", msgUnauthenticated)
+		return nil, false
+	}
+	if !Allows(principal, []string{PermissionViewPlugins}) {
+		WriteError(w, http.StatusForbidden, "forbidden", msgForbidden)
+		return nil, false
+	}
+	return principal, true
+}
+
+// pluginsInstalled answers GET /plugins.
+func (s *service) pluginsInstalled(w http.ResponseWriter, r *http.Request) {
+	if _, ok := pluginsPrincipal(w, r); !ok {
+		return
+	}
+	overview := s.installedPlugins()
+	overview.Registry = s.registryState()
+	WriteData(w, http.StatusOK, overview, nil)
+}
+
+// registryState reports whether plugins.registry_url is set.
+func (s *service) registryState() RegistryState {
+	if kiosk.RegistryURL(s.config()) == "" {
+		return RegistryState{Enabled: false, Status: registryStatusDisabled}
+	}
+	return RegistryState{Enabled: true, Status: registryStatusOK}
+}
+
+// installedPlugins lists the activated plugins from the metadata summer
+// build published (party.Installed). An application built before that
+// metadata existed lists the IDs of party.Activated instead, and its
+// framework version comes from the binary's build information.
+func (s *service) installedPlugins() PluginsOverview {
+	overview := PluginsOverview{Plugins: []InstalledPlugin{}}
+	if s == nil || s.app == nil {
+		overview.Framework = bonfire.BuildVersion().Framework
+		return overview
+	}
+	if installed, ok := s.app.Lookup[party.Installed](); ok {
+		overview.Framework = installed.Framework
+		for _, info := range installed.Plugins {
+			overview.Plugins = append(overview.Plugins, InstalledPlugin{
+				ID: info.ID, Name: info.Name, Description: info.Description,
+				Version: info.Version, Source: info.Source,
+				Module: info.Module, Package: info.Package,
+			})
+		}
+	} else if activated, ok := s.app.Lookup[party.Activated](); ok {
+		for _, plugin := range activated {
+			if plugin == nil || plugin.ID() == backendScreensPluginID {
+				continue
+			}
+			overview.Plugins = append(overview.Plugins, InstalledPlugin{ID: plugin.ID()})
+		}
+	}
+	if overview.Framework == "" {
+		overview.Framework = bonfire.BuildVersion().Framework
+	}
+	return overview
+}

modules/cabana/plugins_smoke_test.go

@@ -0,0 +1,164 @@
+package cabana
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/backpack"
+	"git.golem15.com/golem15/summercms/modules/bouncer"
+	"git.golem15.com/golem15/summercms/modules/compass"
+	"git.golem15.com/golem15/summercms/modules/party"
+)
+
+// pluginsConfig is an application config whose plugins.registry_url is
+// registry ("" disables the registry).
+func pluginsConfig(t *testing.T, registry string) *compass.Config {
+	t.Helper()
+	cfg, err := compass.Open(compass.Options{Dir: t.TempDir(), Environ: []string{"SUMMER_ENV=development"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := cfg.Set("plugins.registry_url", registry); err != nil {
+		t.Fatal(err)
+	}
+	return cfg
+}
+
+// pluginsService is a service over the admin's own screens and the
+// screensExtender plugin, on an app with cfg that published installed
+// (when not nil) and activated.
+func pluginsService(t *testing.T, cfg *compass.Config, installed *party.Installed, activated party.Activated) *service {
+	t.Helper()
+	reg, err := compileWithScreens(t, []party.Plugin{screensExtender{}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	app := backpack.New(cfg)
+	if installed != nil {
+		if err := party.Describe(app, installed.Plugins, installed.Framework); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if activated != nil {
+		if err := app.Publish(activated); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return &service{app: app, reg: reg}
+}
+
+// pluginsCall runs handler for principal on GET target and returns the
+// recorder.
+func pluginsCall(svc *service, handler func(*service, http.ResponseWriter, *http.Request), principal *bouncer.Principal, target string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(http.MethodGet, adminAPI(target), nil)
+	if principal != nil {
+		req = req.WithContext(bouncer.WithUser(req.Context(), principal))
+	}
+	rec := httptest.NewRecorder()
+	handler(svc, rec, req)
+	return rec
+}
+
+func decodeOverview(t *testing.T, rec *httptest.ResponseRecorder) PluginsOverview {
+	t.Helper()
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var body Envelope[PluginsOverview]
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode %s: %v", rec.Body.String(), err)
+	}
+	return body.Data
+}
+
+var (
+	pluginsSuperuser = &bouncer.Principal{ID: 1, Backend: true, IsSuperuser: true}
+	pluginsViewer    = &bouncer.Principal{ID: 2, Backend: true, PermissionGrants: map[string]bool{PermissionViewPlugins: true}}
+	pluginsDenied    = &bouncer.Principal{ID: 3, Backend: true, PermissionGrants: map[string]bool{"acme.ext.access": true}}
+)
+
+// testInstalled is what summer build baked for a module plugin, a
+// submodule plugin and an in-app plugin without plugin.yaml.
+func testInstalled() *party.Installed {
+	return &party.Installed{Framework: "v0.6.0", Plugins: []party.Info{
+		{ID: "acme.blog", Module: "example.test/acme-blog", Package: "example.test/acme-blog", Name: "Blog", Description: "Posts and categories.", Version: "v0.1.0", Source: party.SourceModule},
+		{ID: "acme.translate", Module: "example.test/acme-translate", Package: "example.test/acme-translate", Name: "Translate", Description: "Translations.", Version: "v0.1.1-3-gabc1234", Source: party.SourceSubmodule},
+		{ID: "acme.local", Package: "example.test/app/plugins/acme/local", Source: party.SourceLocal},
+	}}
+}
+
+// TestPluginsScreenSmoke is the Plugins screen end to end through cabana's
+// handlers: who may open it, what it lists and how it links from Settings.
+func TestPluginsScreenSmoke(t *testing.T) {
+	t.Run("installed", func(t *testing.T) {
+		svc := pluginsService(t, pluginsConfig(t, ""), testInstalled(), nil)
+
+		overview := decodeOverview(t, pluginsCall(svc, (*service).pluginsInstalled, pluginsSuperuser, "/plugins"))
+		if overview.Framework != "v0.6.0" || len(overview.Plugins) != 3 {
+			t.Fatalf("superuser overview = %+v", overview)
+		}
+		blog := overview.Plugins[0]
+		if blog.ID != "acme.blog" || blog.Name != "Blog" || blog.Version != "v0.1.0" || blog.Source != party.SourceModule || blog.Description != "Posts and categories." || blog.Module != "example.test/acme-blog" {
+			t.Fatalf("blog = %+v", blog)
+		}
+		if got := overview.Plugins[1]; got.Version != "v0.1.1-3-gabc1234" || got.Source != party.SourceSubmodule {
+			t.Fatalf("translate = %+v", got)
+		}
+		if got := overview.Plugins[2]; got.ID != "acme.local" || got.Name != "" || got.Version != "" || got.Source != party.SourceLocal {
+			t.Fatalf("local = %+v", got)
+		}
+		if overview.Registry.Enabled || overview.Registry.Status != registryStatusDisabled {
+			t.Fatalf("registry with an empty plugins.registry_url = %+v", overview.Registry)
+		}
+
+		// The permission opens the screen; without it the answer is 403.
+		if rec := pluginsCall(svc, (*service).pluginsInstalled, pluginsDenied, "/plugins"); rec.Code != http.StatusForbidden {
+			t.Fatalf("without %s: status=%d body=%s", PermissionViewPlugins, rec.Code, rec.Body.String())
+		}
+		if rec := pluginsCall(svc, (*service).pluginsInstalled, nil, "/plugins"); rec.Code != http.StatusUnauthorized {
+			t.Fatalf("anonymous: status=%d", rec.Code)
+		}
+		if got := decodeOverview(t, pluginsCall(svc, (*service).pluginsInstalled, pluginsViewer, "/plugins")); len(got.Plugins) != 3 {
+			t.Fatalf("viewer overview = %+v", got)
+		}
+
+		// Settings → System links the screen only for allowed principals.
+		for _, tc := range []struct {
+			name      string
+			principal *bouncer.Principal
+			want      bool
+		}{{"superuser", pluginsSuperuser, true}, {"viewer", pluginsViewer, true}, {"denied", pluginsDenied, false}} {
+			rec := pluginsCall(svc, (*service).settingsList, tc.principal, "/settings")
+			var body Envelope[[]SettingsEntry]
+			if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+				t.Fatal(err)
+			}
+			found := false
+			for _, entry := range body.Data {
+				if entry.Code == pluginsSettingsCode {
+					found = true
+					if entry.Path != "/system/plugins" || entry.Controller != "" {
+						t.Fatalf("%s: plugins entry = %+v", tc.name, entry)
+					}
+				} else if entry.Path != "" {
+					t.Fatalf("%s: entry %s has a path %q", tc.name, entry.Code, entry.Path)
+				}
+			}
+			if found != tc.want {
+				t.Fatalf("%s: plugins entry listed=%v, want %v: %s", tc.name, found, tc.want, rec.Body.String())
+			}
+		}
+
+		// An app built before plugin metadata existed lists the activated IDs.
+		legacy := pluginsService(t, pluginsConfig(t, "https://registry.example.test"), nil, party.Activated{screensExtender{}})
+		old := decodeOverview(t, pluginsCall(legacy, (*service).pluginsInstalled, pluginsSuperuser, "/plugins"))
+		if len(old.Plugins) != 1 || old.Plugins[0].ID != "acme.ext" || old.Plugins[0].Version != "" || old.Framework == "" {
+			t.Fatalf("legacy overview = %+v", old)
+		}
+		if !old.Registry.Enabled {
+			t.Fatalf("configured registry reported %+v", old.Registry)
+		}
+	})
+}

modules/cabana/security_coverage_test.go

@@ -53,6 +53,7 @@ var phase09Routes = []adminRoute{
 	{key: "GET /navigation"},
 	{key: "GET /field-types"},
 	{key: "GET /settings"},
+	{key: "GET /plugins"},
 	{key: "GET /settings/{code}/schema"},
 	{key: "GET /settings/{code}"},
 	{key: "PUT /settings/{code}"},
@@ -307,6 +308,7 @@ type phase09Call struct {
 
 func phase09ProtectedCalls() []phase09Call {
 	return []phase09Call{
+		{"plugins-installed", (*service).pluginsInstalled},
 		{"list", (*service).list},
 		{"create", (*service).create},
 		{"bulk-delete", (*service).bulkDelete},

modules/cabana/token_routes_test.go

@@ -49,6 +49,7 @@ var tokenRouteClasses = map[string]tokenRouteClass{
 	"GET /navigation":                classAllowsNav,
 	"GET /field-types":               classExplicitGate,
 	"GET /settings":                  classAllowsSettings,
+	"GET /plugins":                   classAllowsProtect,
 	"GET /settings/{code}/schema":    classAllowsSettings,
 	"GET /settings/{code}":           classAllowsSettings,
 	"PUT /settings/{code}":           classAllowsSettings,

modules/phrasebook/backend/lang/en/lang.yaml

@@ -543,12 +543,30 @@ user:
     users_more:
       one: "Showing the first :shown of :count administrator. Filter the Administrators list by this role to see all of them."
       other: "Showing the first :shown of :count administrators. Filter the Administrators list by this role to see all of them."
+plugins:
+  menu_label: "Plugins"
+  menu_description: "Installed plugins, their versions and available updates, and the plugin marketplace."
+  title: "Plugins"
+  framework: "Framework :version"
+  tabs_label: "Plugins screen sections"
+  tab_installed: "Installed"
+  tab_marketplace: "Marketplace"
+  column_plugin: "Plugin"
+  column_version: "Version"
+  column_source: "Source"
+  source_module: "Go module"
+  source_submodule: "Git submodule"
+  source_local: "In the application"
+  no_version: "No version"
+  empty: "No plugins are installed."
+  load_failed: "The plugin list could not be loaded."
 permissions:
   tab_system: "System"
   manage_users: "Manage administrators"
   manage_users_comment: "Create, edit, deactivate and delete administrator accounts."
   manage_roles: "Manage roles"
   manage_roles_comment: "Create and edit roles and the permissions they grant."
+  view_plugins: "View plugins"
 version:
   available: "A new version of the admin is available."
   reload: "Reload"

modules/phrasebook/backend/lang/pl/lang.yaml

@@ -579,12 +579,30 @@ user:
       few: "Pokazano pierwszych :shown z :count administratorów. Aby zobaczyć wszystkich, przefiltruj listę Administratorzy według tej roli."
       many: "Pokazano pierwszych :shown z :count administratorów. Aby zobaczyć wszystkich, przefiltruj listę Administratorzy według tej roli."
       other: "Pokazano pierwszych :shown z :count administratora. Aby zobaczyć wszystkich, przefiltruj listę Administratorzy według tej roli."
+plugins:
+  menu_label: "Wtyczki"
+  menu_description: "Zainstalowane wtyczki, ich wersje i dostępne aktualizacje oraz katalog wtyczek."
+  title: "Wtyczki"
+  framework: "Framework :version"
+  tabs_label: "Sekcje ekranu Wtyczki"
+  tab_installed: "Zainstalowane"
+  tab_marketplace: "Katalog"
+  column_plugin: "Wtyczka"
+  column_version: "Wersja"
+  column_source: "Źródło"
+  source_module: "Moduł Go"
+  source_submodule: "Submoduł git"
+  source_local: "W aplikacji"
+  no_version: "Brak wersji"
+  empty: "Brak zainstalowanych wtyczek."
+  load_failed: "Nie udało się wczytać listy wtyczek."
 permissions:
   tab_system: "System"
   manage_users: "Zarządzanie administratorami"
   manage_users_comment: "Tworzenie, edycja, dezaktywacja i usuwanie kont administratorów."
   manage_roles: "Zarządzanie rolami"
   manage_roles_comment: "Tworzenie i edycja ról oraz uprawnień, które nadają."
+  view_plugins: "Podgląd wtyczek"
 version:
   available: "Dostępna jest nowa wersja panelu."
   reload: "Odśwież"