YourBot v0.0.26
Added
- Plugins can now reach an address that only your server knows, like your own game panel or a self hosted API. A plugin author's allowed domain list is fixed when they publish it, so it could never cover an address that is different for every community. An admin can now approve their own address during a plugin's setup, and it applies to that server only.
- Plugin SDK v0.10.0 adds
ctx.http.allow_host()andctx.http.revoke_host()for exactly that. Approved addresses are matched exactly, so approvingexample.comdoes not also approvepanel.example.com, and each approval is scoped to the one server that granted it.
Enhanced
- The developer portal secrets list now shows which hosts each secret may be sent to, and flags any secret that cannot be used for authentication yet.
Fixed
- Stored API keys can now be attached to a plugin's outgoing requests. Secrets saved in the developer portal were never recorded with a destination, so the platform refused to send them anywhere and any plugin calling an API that needs a bearer token was unable to authenticate. Reading a secret in code always worked and still does. Re-save a secret with a destination to enable it for requests.
- Test installs now pick up new permissions and domains when you deploy a new version. The approved list was captured when the install was first created, so a plugin that added a permission or a new domain kept being refused against code that clearly declared both, until the install was removed and added again.
- Test installs now grant every capability, including websockets, encrypted secrets and SQL. Those three had fallen out of the list, so a developer testing their own plugin on their own server hit refusals with no way to grant what was missing.
- A plugin calling an address it has not declared now gets an error that says how to fix it, naming both the manifest entry and the admin approval, instead of a bare refusal.