* feat(httpclient): implement HttpClient service for outbound HTTP requests in plugins Signed-off-by: Deluan <deluan@navidrome.org> * feat(httpclient): enhance SSRF protection by validating host requests against private IPs Signed-off-by: Deluan <deluan@navidrome.org> * feat(httpclient): support DELETE requests with body in HttpClient service Signed-off-by: Deluan <deluan@navidrome.org> * feat(httpclient): refactor HTTP client initialization and enhance redirect handling Signed-off-by: Deluan <deluan@navidrome.org> * refactor(http): standardize naming conventions for HTTP types and methods Signed-off-by: Deluan <deluan@navidrome.org> * refactor example plugin to use host.HTTPSend for improved error management Signed-off-by: Deluan <deluan@navidrome.org> * fix(plugins): fix IPv6 SSRF bypass and wildcard host matching Fix two bugs in the plugin HTTP/WebSocket host validation: 1. extractHostname now strips IPv6 brackets when no port is present (e.g. "[::1]" → "::1"). Previously, net.SplitHostPort failed for bracketed IPv6 without a port, leaving brackets intact. This caused net.ParseIP to return nil, bypassing the private/loopback SSRF guard. 2. matchHostPattern now treats "*" as an allow-all pattern. Previously, a bare "*" only matched via exact equality, so plugins declaring requiredHosts: ["*"] (like webhook-rs) had all requests rejected. --------- Signed-off-by: Deluan <deluan@navidrome.org>
Navidrome Host Function Wrappers for Rust
This directory contains auto-generated Rust wrappers for Navidrome's host services. These wrappers provide idiomatic Rust APIs for interacting with Navidrome from WASM plugins.
⚠️ Auto-Generated Code
Do not edit these files manually. They are generated by the ndpgen tool.
To regenerate:
make gen
Usage
Add this crate as a dependency in your plugin's Cargo.toml:
[dependencies]
nd-host = { path = "../../pdk/rust/host" }
Then import the services you need:
use nd_host::{cache, scheduler, library};
use nd_host::library::Library; // Import the typed struct
#[plugin_fn]
pub fn my_callback(input: String) -> FnResult<String> {
// Use the cache service
cache::set("my_key", b"my_value", 3600)?;
// Schedule a recurring task
scheduler::schedule_recurring("@every 5m", "payload", "task_id")?;
// Access library data with typed structs
let libraries: Vec<Library> = library::get_all_libraries()?;
for lib in &libraries {
info!("Library: {} with {} songs", lib.name, lib.total_songs);
}
Ok("done".to_string())
}
Typed Structs
Services that work with domain objects provide typed Rust structs instead of
serde_json::Value. This enables compile-time type checking and IDE
autocompletion.
For example, the library module provides a Library struct:
use nd_host::library::Library;
let libs: Vec<Library> = library::get_all_libraries()?;
println!("First library: {} ({} songs)", libs[0].name, libs[0].total_songs);
All structs derive Debug, Clone, Serialize, and Deserialize for
convenient use with logging and serialization.
Available Services
| Module | Description |
|---|---|
artwork |
Access album and artist artwork |
cache |
Temporary key-value storage with TTL |
kvstore |
Persistent key-value storage |
library |
Access the music library (albums, artists, tracks) |
scheduler |
Schedule one-time and recurring tasks |
subsonicapi |
Make Subsonic API calls |
websocket |
Send real-time messages to clients |
Building Plugins
Rust plugins must be compiled to WebAssembly:
cargo build --target wasm32-wasip1 --release
See the webhook-rs example for a complete plugin implementation.