P1 fixes: outbox no_handlers, HTML sanitization, WebSocket plugin check, fail-closed plugin gate, plugin admin-only

2026-07-29 12:33:46 +02:00
parent 8539a6402c
commit 8dacb739bd
5 changed files with 42 additions and 14 deletions
@@ -458,6 +458,10 @@ def create_app() -> FastAPI:
                            plugin_dep = Depends(require_active_plugin(plugin_name))
                            for route in router.routes:
                                if isinstance(route, WebSocketRoute):
+                                    # WebSocket routes also need plugin check — don't skip (P1.9 fix)
+                                    if not hasattr(route, 'dependencies'):
+                                        route.dependencies = []
+                                    route.dependencies.append(plugin_dep)
                                    continue
                                # Add require_active_plugin to each HTTP route's dependencies
                                if not hasattr(route, 'dependencies'):