UBERF-10272: Allow workspace owners to enable/disable modules

Signed-off-by: Andrey Sobolev <[email protected]>

Author: haiodo

Diff for: models/all/src/index.ts

@@ -321,7 +321,7 @@ export default function buildModel (enabled: string[] = ['*'], disabled: string[
       boardModel,
       boardId,
       {
-        label: board.string.ConfigLabel,
+        label: undefined, // board.string.ConfigLabel,
         description: board.string.ConfigDescription,
         enabled: false,
         beta: true,
@@ -333,7 +333,7 @@ export default function buildModel (enabled: string[] = ['*'], disabled: string[
       bitrixModel,
       bitrixId,
       {
-        label: bitrix.string.ConfigLabel,
+        label: undefined, // bitrix.string.ConfigLabel,
         description: bitrix.string.ConfigDescription,
         enabled: false,
         beta: true,

Diff for: models/setting/src/index.ts

@@ -289,8 +289,7 @@ export function createModel (builder: Builder): void {
       icon: setting.icon.Setting,
       component: setting.component.Configure,
       order: 1200,
-      role: AccountRole.Owner,
-      adminOnly: true
+      role: AccountRole.Owner
     },
     setting.ids.Configure
   )

Diff for: packages/core/src/classes.ts

@@ -268,6 +268,7 @@ export interface PluginConfiguration extends Doc {
   pluginId: Plugin
   transactions: Ref<Doc>[]
 
+  // If not set will not be shown in configuration UI
   label?: IntlString
   icon?: Asset
   description?: IntlString

Diff for: server/middleware/src/index.ts

@@ -37,3 +37,4 @@ export * from './triggers'
 export * from './txPush'
 export * from './queue'
 export * from './identity'
+export * from './pluginConfig'

Diff for: server/middleware/src/pluginConfig.ts

@@ -0,0 +1,73 @@
+//
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+import { aiBotAccountEmail } from '@hcengineering/ai-bot'
+import core, {
+  AccountRole,
+  MeasureContext,
+  Tx,
+  TxProcessor,
+  systemAccountUuid,
+  type Doc,
+  type SessionData,
+  type TxApplyIf,
+  type TxCUD
+} from '@hcengineering/core'
+import platform, { PlatformError, Severity, Status } from '@hcengineering/platform'
+import { BaseMiddleware, Middleware, TxMiddlewareResult, type PipelineContext } from '@hcengineering/server-core'
+
+/**
+ * @public
+ */
+export class PluginConfigurationMiddleware extends BaseMiddleware implements Middleware {
+  private constructor (context: PipelineContext, next?: Middleware) {
+    super(context, next)
+  }
+
+  static async create (
+    ctx: MeasureContext,
+    context: PipelineContext,
+    next: Middleware | undefined
+  ): Promise<PluginConfigurationMiddleware> {
+    return new PluginConfigurationMiddleware(context, next)
+  }
+
+  tx (ctx: MeasureContext<SessionData>, txes: Tx[]): Promise<TxMiddlewareResult> {
+    const account = ctx.contextData.account
+    if (account.uuid === systemAccountUuid || account.fullSocialIds.some((it) => it.value === aiBotAccountEmail)) {
+      // We pass for system accounts and services.
+      return this.provideTx(ctx, txes)
+    }
+    function checkTx (tx: Tx): void {
+      if (TxProcessor.isExtendsCUD(tx._class)) {
+        const cud = tx as TxCUD<Doc>
+        if (cud.objectClass === core.class.PluginConfiguration && ctx.contextData.account.role !== AccountRole.Owner) {
+          throw new PlatformError(
+            new Status(Severity.ERROR, platform.status.Forbidden, {
+              account: account.uuid
+            })
+          )
+        }
+      }
+    }
+    for (const tx of txes) {
+      checkTx(tx)
+      if (tx._class === core.class.TxApplyIf) {
+        const atx = tx as TxApplyIf
+        atx.txes.forEach(checkTx)
+      }
+    }
+    return this.provideTx(ctx, txes)
+  }
+}

Diff for: server/server-pipeline/src/pipeline.ts

@@ -31,6 +31,7 @@ import {
   ModelMiddleware,
   ModifiedMiddleware,
   NotificationsMiddleware,
+  PluginConfigurationMiddleware,
   PrivateMiddleware,
   QueryJoinMiddleware,
   QueueMiddleware,
@@ -119,6 +120,7 @@ export function createServerPipeline (
       LookupMiddleware.create,
       IdentityMiddleware.create,
       ModifiedMiddleware.create,
+      PluginConfigurationMiddleware.create,
       PrivateMiddleware.create,
       NotificationsMiddleware.create,
       (ctx: MeasureContext, context: PipelineContext, next?: Middleware) =>