fix(plugins): resolve gateway auth against active http route registry

MarsDoge · MarsDoge · commit ec920546fa1f · 2026-03-17T13:57:46.000+08:00
diff --git a/src/gateway/server/plugins-http.test.ts b/src/gateway/server/plugins-http.test.ts
@@ -461,4 +461,31 @@ describe("plugin HTTP route auth checks", () => {
     });
     expect(shouldEnforceGatewayAuthForPluginPath(registry, "/plugin/secure/report")).toBe(true);
   });
+
+  it("prefers the active route registry for auth checks when the explicit registry is stale", () => {
+    const startupRegistry = createTestRegistry();
+    const staleExplicitRegistry = createTestRegistry({
+      httpRoutes: [createRoute({ path: "/plugins/diffs", auth: "plugin" })],
+    });
+
+    setActivePluginRegistry(createTestRegistry());
+    pinActivePluginHttpRouteRegistry(startupRegistry);
+
+    const unregister = registerPluginHttpRoute({
+      path: "/bluebubbles-webhook",
+      auth: "gateway",
+      handler: () => true,
+    });
+
+    try {
+      expect(
+        shouldEnforceGatewayAuthForPluginPath(staleExplicitRegistry, "/bluebubbles-webhook"),
+      ).toBe(true);
+      expect(shouldEnforceGatewayAuthForPluginPath(staleExplicitRegistry, "/plugins/diffs")).toBe(
+        false,
+      );
+    } finally {
+      unregister();
+    }
+  });
 });
diff --git a/src/gateway/server/plugins-http/route-auth.ts b/src/gateway/server/plugins-http/route-auth.ts
@@ -1,4 +1,5 @@
 import type { PluginRegistry } from "../../../plugins/registry.js";
+import { resolveActivePluginHttpRouteRegistry } from "../../../plugins/runtime.js";
 import {
   isProtectedPluginRoutePathFromContext,
   resolvePluginRoutePathContext,
@@ -26,5 +27,8 @@ export function shouldEnforceGatewayAuthForPluginPath(
   if (isProtectedPluginRoutePathFromContext(pathContext)) {
     return true;
   }
-  return matchedPluginRoutesRequireGatewayAuth(findMatchingPluginHttpRoutes(registry, pathContext));
+  const activeRegistry = resolveActivePluginHttpRouteRegistry(registry);
+  return matchedPluginRoutesRequireGatewayAuth(
+    findMatchingPluginHttpRoutes(activeRegistry, pathContext),
+  );
 }
