Plugins Admin: Avoid disabling auto-enabled apps (#97800)

pkg/api/dtos/plugins.go

@@ -12,6 +12,7 @@ type PluginSetting struct {
 	Id               string               `json:"id"`
 	Enabled          bool                 `json:"enabled"`
 	Pinned           bool                 `json:"pinned"`
+	AutoEnabled      bool                 `json:"autoEnabled"`
 	Module           string               `json:"module"`
 	BaseUrl          string               `json:"baseUrl"`
 	Info             plugins.Info         `json:"info"`

pkg/api/frontendsettings.go

@@ -721,6 +721,7 @@ func (hs *HTTPServer) pluginSettings(ctx context.Context, orgID int64) (map[stri
 			OrgID:         orgID,
 			Enabled:       plugin.AutoEnabled,
 			Pinned:        plugin.AutoEnabled,
+			AutoEnabled:   plugin.AutoEnabled,
 			PluginVersion: plugin.Info.Version,
 		}
 

pkg/api/plugins.go

@@ -216,6 +216,7 @@ func (hs *HTTPServer) GetPluginSettingByID(c *contextmodel.ReqContext) response.
 	if plugin.IsApp() {
 		dto.Enabled = plugin.AutoEnabled
 		dto.Pinned = plugin.AutoEnabled
+		dto.AutoEnabled = plugin.AutoEnabled
 	}
 
 	ps, err := hs.PluginSettings.GetPluginSettingByPluginID(c.Req.Context(), &pluginsettings.GetByPluginIDArgs{
@@ -254,9 +255,13 @@ func (hs *HTTPServer) UpdatePluginSetting(c *contextmodel.ReqContext) response.R
 	}
 	pluginID := web.Params(c.Req)[":pluginId"]
 
-	if _, exists := hs.pluginStore.Plugin(c.Req.Context(), pluginID); !exists {
+	p, exists := hs.pluginStore.Plugin(c.Req.Context(), pluginID)
+	if !exists {
 		return response.Error(http.StatusNotFound, "Plugin not installed", nil)
 	}
+	if p.AutoEnabled && !cmd.Enabled {
+		return response.Error(http.StatusBadRequest, "Cannot disable auto-enabled plugin", nil)
+	}
 
 	cmd.OrgId = c.SignedInUser.GetOrgID()
 	cmd.PluginId = pluginID

pkg/api/plugins_test.go

@@ -871,3 +871,43 @@ func Test_PluginsSettings(t *testing.T) {
 		})
 	}
 }
+
+func Test_UpdatePluginSetting(t *testing.T) {
+	pID := "test-app"
+	p1 := createPlugin(plugins.JSONData{
+		ID: pID, Type: "app", Name: pID,
+		Info: plugins.Info{
+			Version: "1.0.0",
+		},
+		AutoEnabled: true,
+	}, plugins.ClassExternal, plugins.NewFakeFS(),
+	)
+	pluginRegistry := &fakes.FakePluginRegistry{
+		Store: map[string]*plugins.Plugin{
+			p1.ID: p1,
+		},
+	}
+
+	pluginSettings := pluginsettings.FakePluginSettings{Plugins: map[string]*pluginsettings.DTO{
+		pID: {ID: 0, OrgID: 1, PluginID: pID, PluginVersion: "1.0.0", Enabled: true},
+	}}
+
+	t.Run("should return an error when trying to disable an auto-enabled plugin", func(t *testing.T) {
+		server := SetupAPITestServer(t, func(hs *HTTPServer) {
+			hs.Cfg = setting.NewCfg()
+			hs.PluginSettings = &pluginSettings
+			hs.pluginStore = pluginstore.New(pluginRegistry, &fakes.FakeLoader{})
+			hs.pluginFileStore = filestore.ProvideService(pluginRegistry)
+			hs.managedPluginsService = managedplugins.NewNoop()
+			hs.log = log.NewNopLogger()
+		})
+
+		input := strings.NewReader(`{"enabled": false}`)
+		endpoint := fmt.Sprintf("/api/plugins/%s/settings", pID)
+		req := webtest.RequestWithSignedInUser(server.NewPostRequest(endpoint, input), userWithPermissions(1, []ac.Permission{{Action: pluginaccesscontrol.ActionWrite, Scope: "plugins:id:test-app"}}))
+		res, err := server.SendJSON(req)
+		require.NoError(t, err)
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+		require.NoError(t, res.Body.Close())
+	})
+}