Plugin catalogue: vetted and own plugins only
Imported from GitHub issue El-SaMa/lamoi-waas#13 by @El-SaMa.
Tasks
-
catalogue.jsonin this repo: each plugin with slug (renamed fork where white-label needs it), version pin, why it is allowed, network-activated or per-site optional, plans that include it, owner (us or vendor), last security review date. - Start set: WooCommerce, our own (Arx Pro, Photon, LAFU gift cards, Faktura, Backsies WP, Site Insights), forms, SEO, cookie consent, SMTP (if needed), redirects, Finnish payment and shipping integrations. Each gets a short review.
- Enforcement: clients cannot install or upload anything (
DISALLOW_FILE_MODS); per-site toggles only for catalogue items, via the OMA dashboard and the connector. - Vulnerability monitoring: a daily Windmill job checks the catalogue against a vulnerability feed and alerts.
Acceptance criteria
- Catalogue file validated in CI; toggling an optional plugin from the connector works on staging and is logged.
Depends on
#4.
Plan key W13. Epic: El-SaMa/lamoi-waas#25.