Plugins: Expose core APIs only for certain plugins (#107967)

* feat(plugins): add a way to expose core apis only to certain plugins

* review: update naming

* review: update the owners of the feature toggle

* feat: share the restricted apis with extensions

* fix: linters

* feat: remove the `addPanel` api

* chore: fix linting and betterer issue

* tests: use `@ts-expect-error` for more clarity

pkg/setting/setting_plugins.go

@@ -110,6 +110,26 @@ func (cfg *Cfg) processPreinstallPlugins(rawInstallPlugins []string, preinstallP
 	}
 }
 
+// readPluginAPIRestrictionsSection reads a plugin API restrictions section and returns a map of API names to plugin lists
+func readPluginAPIRestrictionsSection(iniFile *ini.File, sectionName string) map[string][]string {
+	result := make(map[string][]string)
+
+	if !iniFile.HasSection(sectionName) {
+		return result
+	}
+
+	section := iniFile.Section(sectionName)
+	for _, key := range section.Keys() {
+		apiName := key.Name()
+		pluginList := util.SplitString(key.MustString(""))
+		if len(pluginList) > 0 {
+			result[apiName] = pluginList
+		}
+	}
+
+	return result
+}
+
 func (cfg *Cfg) readPluginSettings(iniFile *ini.File) error {
 	pluginsSection := iniFile.Section("plugins")
 
@@ -179,5 +199,9 @@ func (cfg *Cfg) readPluginSettings(iniFile *ini.File) error {
 
 	cfg.PluginUpdateStrategy = pluginsSection.Key("update_strategy").In(PluginUpdateStrategyLatest, []string{PluginUpdateStrategyLatest, PluginUpdateStrategyMinor})
 
+	// Plugin API restrictions - read from sections
+	cfg.PluginRestrictedAPIsAllowList = readPluginAPIRestrictionsSection(iniFile, "plugins.restricted_apis_allowlist")
+	cfg.PluginRestrictedAPIsBlockList = readPluginAPIRestrictionsSection(iniFile, "plugins.restricted_apis_blocklist")
+
 	return nil
 }