Plugins: Add validation stage to plugin loader pipeline (#73053)

* first pass

* change validation signature

* err tracking

* fix

* undo golden

* 1 more

* fix

* adjust doc

* add test helper

* fix linter

pkg/plugins/manager/fakes/fakes.go

@@ -486,6 +486,17 @@ func (f *FakeBootstrapper) Bootstrap(ctx context.Context, src plugins.PluginSour
 	return []*plugins.Plugin{}, nil
 }
 
+type FakeValidator struct {
+	ValidateFunc func(ctx context.Context, ps []*plugins.Plugin) ([]*plugins.Plugin, error)
+}
+
+func (f *FakeValidator) Validate(ctx context.Context, ps []*plugins.Plugin) ([]*plugins.Plugin, error) {
+	if f.ValidateFunc != nil {
+		return f.ValidateFunc(ctx, ps)
+	}
+	return []*plugins.Plugin{}, nil
+}
+
 type FakeInitializer struct {
 	IntializeFunc func(ctx context.Context, ps []*plugins.Plugin) ([]*plugins.Plugin, error)
 }

pkg/plugins/manager/loader/angular/angularinspector/angularinspector.go

@@ -73,6 +73,6 @@ func NewDefaultStaticDetectorsProvider() angulardetector.DetectorsProvider {
 
 // NewStaticInspector returns the default Inspector, which is a PatternsListInspector that only uses the
 // static (hardcoded) angular detection patterns.
-func NewStaticInspector() (Inspector, error) {
-	return &PatternsListInspector{DetectorsProvider: NewDefaultStaticDetectorsProvider()}, nil
+func NewStaticInspector() Inspector {
+	return &PatternsListInspector{DetectorsProvider: NewDefaultStaticDetectorsProvider()}
 }

pkg/plugins/manager/loader/loader.go

@@ -2,154 +2,63 @@ package loader
 
 import (
 	"context"
-	"errors"
-	"time"
 
 	"github.com/grafana/grafana/pkg/plugins"
-	"github.com/grafana/grafana/pkg/plugins/config"
 	"github.com/grafana/grafana/pkg/plugins/log"
-	"github.com/grafana/grafana/pkg/plugins/manager/loader/angular/angularinspector"
-	"github.com/grafana/grafana/pkg/plugins/manager/loader/assetpath"
 	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/bootstrap"
 	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/discovery"
 	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/initialization"
 	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/termination"
-	"github.com/grafana/grafana/pkg/plugins/manager/process"
-	"github.com/grafana/grafana/pkg/plugins/manager/registry"
-	"github.com/grafana/grafana/pkg/plugins/manager/signature"
-	"github.com/grafana/grafana/pkg/plugins/oauth"
+	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/validation"
 )
 
-var _ plugins.ErrorResolver = (*Loader)(nil)
-
 type Loader struct {
 	discovery   discovery.Discoverer
 	bootstrap   bootstrap.Bootstrapper
 	initializer initialization.Initializer
 	termination termination.Terminator
-
-	processManager          process.Service
-	pluginRegistry          registry.Service
-	roleRegistry            plugins.RoleRegistry
-	signatureValidator      signature.Validator
-	externalServiceRegistry oauth.ExternalServiceRegistry
-	assetPath               *assetpath.Service
-	log                     log.Logger
-	cfg                     *config.Cfg
-
-	angularInspector angularinspector.Inspector
-
-	errs map[string]*plugins.SignatureError
+	validation  validation.Validator
+	log         log.Logger
 }
 
-func ProvideService(cfg *config.Cfg, authorizer plugins.PluginLoaderAuthorizer,
-	pluginRegistry registry.Service, roleRegistry plugins.RoleRegistry, assetPath *assetpath.Service,
-	angularInspector angularinspector.Inspector, externalServiceRegistry oauth.ExternalServiceRegistry,
-	discovery discovery.Discoverer, bootstrap bootstrap.Bootstrapper, initializer initialization.Initializer,
-	termination termination.Terminator) *Loader {
-	return New(cfg, authorizer, pluginRegistry, process.NewManager(pluginRegistry), roleRegistry, assetPath,
-		angularInspector, externalServiceRegistry, discovery, bootstrap, initializer, termination)
+func ProvideService(discovery discovery.Discoverer, bootstrap bootstrap.Bootstrapper, validation validation.Validator,
+	initializer initialization.Initializer, termination termination.Terminator) *Loader {
+	return New(discovery, bootstrap, validation, initializer, termination)
 }
 
-func New(cfg *config.Cfg, authorizer plugins.PluginLoaderAuthorizer, pluginRegistry registry.Service,
-	processManager process.Service, roleRegistry plugins.RoleRegistry, assetPath *assetpath.Service,
-	angularInspector angularinspector.Inspector, externalServiceRegistry oauth.ExternalServiceRegistry,
-	discovery discovery.Discoverer, bootstrap bootstrap.Bootstrapper, initializer initialization.Initializer,
-	termination termination.Terminator) *Loader {
+func New(
+	discovery discovery.Discoverer, bootstrap bootstrap.Bootstrapper, validation validation.Validator,
+	initializer initialization.Initializer, termination termination.Terminator) *Loader {
 	return &Loader{
-		pluginRegistry:          pluginRegistry,
-		signatureValidator:      signature.NewValidator(authorizer),
-		processManager:          processManager,
-		errs:                    make(map[string]*plugins.SignatureError),
-		log:                     log.New("plugin.loader"),
-		roleRegistry:            roleRegistry,
-		cfg:                     cfg,
-		assetPath:               assetPath,
-		angularInspector:        angularInspector,
-		externalServiceRegistry: externalServiceRegistry,
-		discovery:               discovery,
-		bootstrap:               bootstrap,
-		initializer:             initializer,
-		termination:             termination,
+		discovery:   discovery,
+		bootstrap:   bootstrap,
+		validation:  validation,
+		initializer: initializer,
+		termination: termination,
+		log:         log.New("plugin.loader"),
 	}
 }
 
 func (l *Loader) Load(ctx context.Context, src plugins.PluginSource) ([]*plugins.Plugin, error) {
-	// <DISCOVERY STAGE>
 	discoveredPlugins, err := l.discovery.Discover(ctx, src)
 	if err != nil {
 		return nil, err
 	}
-	// </DISCOVERY STAGE>
 
-	// <BOOTSTRAP STAGE>
 	bootstrappedPlugins, err := l.bootstrap.Bootstrap(ctx, src, discoveredPlugins)
 	if err != nil {
 		return nil, err
 	}
-	// </BOOTSTRAP STAGE>
 
-	// <VERIFICATION STAGE>
-	verifiedPlugins := make([]*plugins.Plugin, 0, len(bootstrappedPlugins))
-	for _, plugin := range bootstrappedPlugins {
-		signingError := l.signatureValidator.Validate(plugin)
-		if signingError != nil {
-			l.log.Warn("Skipping loading plugin due to problem with signature",
-				"pluginID", plugin.ID, "status", signingError.SignatureStatus)
-			plugin.SignatureError = signingError
-			l.errs[plugin.ID] = signingError
-			// skip plugin so it will not be loaded any further
-			continue
-		}
-
-		// clear plugin error if a pre-existing error has since been resolved
-		delete(l.errs, plugin.ID)
-
-		// verify module.js exists for SystemJS to load.
-		// CDN plugins can be loaded with plugin.json only, so do not warn for those.
-		if !plugin.IsRenderer() && !plugin.IsCorePlugin() {
-			f, err := plugin.FS.Open("module.js")
-			if err != nil {
-				if errors.Is(err, plugins.ErrFileNotExist) {
-					l.log.Warn("Plugin missing module.js", "pluginID", plugin.ID,
-						"warning", "Missing module.js, If you loaded this plugin from git, make sure to compile it.")
-				}
-			} else if f != nil {
-				if err := f.Close(); err != nil {
-					l.log.Warn("Could not close module.js", "pluginID", plugin.ID, "err", err)
-				}
-			}
-		}
-
-		// detect angular for external plugins
-		if plugin.IsExternalPlugin() {
-			var err error
-
-			cctx, canc := context.WithTimeout(ctx, time.Second*10)
-			plugin.AngularDetected, err = l.angularInspector.Inspect(cctx, plugin)
-			canc()
-
-			if err != nil {
-				l.log.Warn("Could not inspect plugin for angular", "pluginID", plugin.ID, "err", err)
-			}
-
-			// Do not initialize plugins if they're using Angular and Angular support is disabled
-			if plugin.AngularDetected && !l.cfg.AngularSupportEnabled {
-				l.log.Error("Refusing to initialize plugin because it's using Angular, which has been disabled", "pluginID", plugin.ID)
-				continue
-			}
-		}
-
-		verifiedPlugins = append(verifiedPlugins, plugin)
+	verifiedPlugins, err := l.validation.Validate(ctx, bootstrappedPlugins)
+	if err != nil {
+		return nil, err
 	}
-	// </VERIFICATION STAGE>
 
-	// <INITIALIZATION STAGE>
 	initializedPlugins, err := l.initializer.Initialize(ctx, verifiedPlugins)
 	if err != nil {
 		return nil, err
 	}
-	// </INITIALIZATION STAGE>
 
 	return initializedPlugins, nil
 }
@@ -157,15 +66,3 @@ func (l *Loader) Load(ctx context.Context, src plugins.PluginSource) ([]*plugins
 func (l *Loader) Unload(ctx context.Context, pluginID string) error {
 	return l.termination.Terminate(ctx, pluginID)
 }
-
-func (l *Loader) PluginErrors() []*plugins.Error {
-	errs := make([]*plugins.Error, 0, len(l.errs))
-	for _, err := range l.errs {
-		errs = append(errs, &plugins.Error{
-			PluginID:  err.PluginID,
-			ErrorCode: err.AsErrorCode(),
-		})
-	}
-
-	return errs
-}

pkg/plugins/manager/loader/loader_test.go

@@ -14,15 +14,12 @@ import (
 	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/plugins/config"
 	"github.com/grafana/grafana/pkg/plugins/manager/fakes"
-	"github.com/grafana/grafana/pkg/plugins/manager/loader/angular/angularinspector"
-	"github.com/grafana/grafana/pkg/plugins/manager/loader/assetpath"
 	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/bootstrap"
 	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/discovery"
 	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/initialization"
 	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/termination"
-	"github.com/grafana/grafana/pkg/plugins/manager/signature"
+	"github.com/grafana/grafana/pkg/plugins/manager/pipeline/validation"
 	"github.com/grafana/grafana/pkg/plugins/manager/sources"
-	"github.com/grafana/grafana/pkg/plugins/pluginscdn"
 	"github.com/grafana/grafana/pkg/services/org"
 )
 
@@ -61,12 +58,11 @@ func TestLoader_Load(t *testing.T) {
 		return
 	}
 	tests := []struct {
-		name         string
-		class        plugins.Class
-		cfg          *config.Cfg
-		pluginPaths  []string
-		want         []*plugins.Plugin
-		pluginErrors map[string]*plugins.Error
+		name        string
+		class       plugins.Class
+		cfg         *config.Cfg
+		pluginPaths []string
+		want        []*plugins.Plugin
 	}{
 		{
 			name:        "Load a Core plugin",
@@ -272,18 +268,13 @@ func TestLoader_Load(t *testing.T) {
 					Signature: "unsigned",
 				},
 			},
-		}, {
+		},
+		{
 			name:        "Load an unsigned plugin (production)",
 			class:       plugins.ClassExternal,
 			cfg:         &config.Cfg{},
 			pluginPaths: []string{"../testdata/unsigned-datasource"},
 			want:        []*plugins.Plugin{},
-			pluginErrors: map[string]*plugins.Error{
-				"test-datasource": {
-					PluginID:  "test-datasource",
-					ErrorCode: "signatureMissing",
-				},
-			},
 		},
 		{
 			name:  "Load an unsigned plugin using PluginsAllowUnsigned config (production)",
@@ -330,12 +321,6 @@ func TestLoader_Load(t *testing.T) {
 			cfg:         &config.Cfg{},
 			pluginPaths: []string{"../testdata/lacking-files"},
 			want:        []*plugins.Plugin{},
-			pluginErrors: map[string]*plugins.Error{
-				"test-datasource": {
-					PluginID:  "test-datasource",
-					ErrorCode: "signatureInvalid",
-				},
-			},
 		},
 		{
 			name:  "Load a plugin with v1 manifest using PluginsAllowUnsigned config (production) should return signatureInvali",
@@ -345,12 +330,6 @@ func TestLoader_Load(t *testing.T) {
 			},
 			pluginPaths: []string{"../testdata/lacking-files"},
 			want:        []*plugins.Plugin{},
-			pluginErrors: map[string]*plugins.Error{
-				"test-datasource": {
-					PluginID:  "test-datasource",
-					ErrorCode: "signatureInvalid",
-				},
-			},
 		},
 		{
 			name:  "Load a plugin with manifest which has a file not found in plugin folder",
@@ -360,12 +339,6 @@ func TestLoader_Load(t *testing.T) {
 			},
 			pluginPaths: []string{"../testdata/invalid-v2-missing-file"},
 			want:        []*plugins.Plugin{},
-			pluginErrors: map[string]*plugins.Error{
-				"test-datasource": {
-					PluginID:  "test-datasource",
-					ErrorCode: "signatureModified",
-				},
-			},
 		},
 		{
 			name:  "Load a plugin with file which is missing from the manifest",
@@ -375,12 +348,6 @@ func TestLoader_Load(t *testing.T) {
 			},
 			pluginPaths: []string{"../testdata/invalid-v2-extra-file"},
 			want:        []*plugins.Plugin{},
-			pluginErrors: map[string]*plugins.Error{
-				"test-datasource": {
-					PluginID:  "test-datasource",
-					ErrorCode: "signatureModified",
-				},
-			},
 		},
 		{
 			name:  "Load an app with includes",
@@ -434,31 +401,19 @@ func TestLoader_Load(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		angularInspector, err := angularinspector.NewStaticInspector()
-		require.NoError(t, err)
-
-		terminationStage, err := termination.New(tt.cfg, termination.Opts{})
-		require.NoError(t, err)
-
-		l := New(tt.cfg, signature.NewUnsignedAuthorizer(tt.cfg), fakes.NewFakePluginRegistry(),
-			fakes.NewFakeProcessManager(), fakes.NewFakeRoleRegistry(),
-			assetpath.ProvideService(pluginscdn.ProvideService(tt.cfg)), angularInspector, &fakes.FakeOauthService{},
-			discovery.New(tt.cfg, discovery.Opts{}), bootstrap.New(tt.cfg, bootstrap.Opts{}),
-			initialization.New(tt.cfg, initialization.Opts{}),
-			terminationStage)
-
 		t.Run(tt.name, func(t *testing.T) {
+			terminationStage, err := termination.New(tt.cfg, termination.Opts{})
+			require.NoError(t, err)
+
+			l := New(discovery.New(tt.cfg, discovery.Opts{}), bootstrap.New(tt.cfg, bootstrap.Opts{}),
+				validation.New(tt.cfg, validation.Opts{}), initialization.New(tt.cfg, initialization.Opts{}),
+				terminationStage)
+
 			got, err := l.Load(context.Background(), sources.NewLocalSource(tt.class, tt.pluginPaths))
 			require.NoError(t, err)
 			if !cmp.Equal(got, tt.want, compareOpts...) {
 				t.Fatalf("Result mismatch (-want +got):\n%s", cmp.Diff(got, tt.want, compareOpts...))
 			}
-
-			pluginErrs := l.PluginErrors()
-			require.Equal(t, len(tt.pluginErrors), len(pluginErrs))
-			for _, pluginErr := range pluginErrs {
-				require.Equal(t, tt.pluginErrors[pluginErr.PluginID], pluginErr)
-			}
 		})
 	}
 
@@ -474,41 +429,41 @@ func TestLoader_Load(t *testing.T) {
 				return plugins.Signature{}, false
 			},
 		}
-		pJSON := plugins.JSONData{ID: "test-datasource", Type: plugins.TypeDataSource, Info: plugins.Info{Version: "1.0.0"}}
-		p := &plugins.Plugin{
-			JSONData:      pJSON,
+		pluginJSON := plugins.JSONData{ID: "test-datasource", Type: plugins.TypeDataSource, Info: plugins.Info{Version: "1.0.0"}}
+		plugin := &plugins.Plugin{
+			JSONData:      pluginJSON,
 			Signature:     plugins.SignatureStatusValid,
 			SignatureType: plugins.SignatureTypeCommunity,
 			FS:            plugins.NewFakeFS(),
 		}
 
-		cfg := &config.Cfg{}
-		angularInspector, err := angularinspector.NewStaticInspector()
-		require.NoError(t, err)
-
 		var steps []string
-		l := New(cfg, signature.NewUnsignedAuthorizer(cfg), fakes.NewFakePluginRegistry(), fakes.NewFakeProcessManager(),
-			fakes.NewFakeRoleRegistry(), assetpath.ProvideService(pluginscdn.ProvideService(cfg)),
-			angularInspector, &fakes.FakeOauthService{},
+		l := New(
 			&fakes.FakeDiscoverer{
 				DiscoverFunc: func(ctx context.Context, s plugins.PluginSource) ([]*plugins.FoundBundle, error) {
 					require.Equal(t, src, s)
 					steps = append(steps, "discover")
-					return []*plugins.FoundBundle{{Primary: plugins.FoundPlugin{JSONData: pJSON}}}, nil
+					return []*plugins.FoundBundle{{Primary: plugins.FoundPlugin{JSONData: pluginJSON}}}, nil
 				},
 			}, &fakes.FakeBootstrapper{
 				BootstrapFunc: func(ctx context.Context, s plugins.PluginSource, b []*plugins.FoundBundle) ([]*plugins.Plugin, error) {
 					require.True(t, len(b) == 1)
-					require.Equal(t, b[0].Primary.JSONData, pJSON)
+					require.Equal(t, b[0].Primary.JSONData, pluginJSON)
 					require.Equal(t, src, s)
 
 					steps = append(steps, "bootstrap")
-					return []*plugins.Plugin{p}, nil
+					return []*plugins.Plugin{plugin}, nil
 				},
-			}, &fakes.FakeInitializer{
+			}, &fakes.FakeValidator{ValidateFunc: func(ctx context.Context, ps []*plugins.Plugin) ([]*plugins.Plugin, error) {
+				require.Equal(t, []*plugins.Plugin{plugin}, ps)
+
+				steps = append(steps, "validate")
+				return ps, nil
+			}},
+			&fakes.FakeInitializer{
 				IntializeFunc: func(ctx context.Context, ps []*plugins.Plugin) ([]*plugins.Plugin, error) {
 					require.True(t, len(ps) == 1)
-					require.Equal(t, ps[0].JSONData, pJSON)
+					require.Equal(t, ps[0].JSONData, pluginJSON)
 					steps = append(steps, "initialize")
 					return ps, nil
 				},
@@ -516,19 +471,14 @@ func TestLoader_Load(t *testing.T) {
 
 		got, err := l.Load(context.Background(), src)
 		require.NoError(t, err)
-		require.Equal(t, []*plugins.Plugin{p}, got)
-		require.Equal(t, []string{"discover", "bootstrap", "initialize"}, steps)
-		require.Zero(t, len(l.PluginErrors()))
+		require.Equal(t, []*plugins.Plugin{plugin}, got)
+		require.Equal(t, []string{"discover", "bootstrap", "validate", "initialize"}, steps)
 	})
 }
 
 func TestLoader_Unload(t *testing.T) {
 	t.Run("Termination stage error is returned from Unload", func(t *testing.T) {
 		pluginID := "grafana-test-panel"
-		cfg := &config.Cfg{}
-		angularInspector, err := angularinspector.NewStaticInspector()
-		require.NoError(t, err)
-
 		tcs := []struct {
 			expectedErr error
 		}{
@@ -541,9 +491,10 @@ func TestLoader_Unload(t *testing.T) {
 		}
 
 		for _, tc := range tcs {
-			l := New(cfg, signature.NewUnsignedAuthorizer(cfg), fakes.NewFakePluginRegistry(), fakes.NewFakeProcessManager(),
-				fakes.NewFakeRoleRegistry(), assetpath.ProvideService(pluginscdn.ProvideService(cfg)), angularInspector,
-				&fakes.FakeOauthService{}, &fakes.FakeDiscoverer{}, &fakes.FakeBootstrapper{}, &fakes.FakeInitializer{},
+			l := New(&fakes.FakeDiscoverer{},
+				&fakes.FakeBootstrapper{},
+				&fakes.FakeValidator{},
+				&fakes.FakeInitializer{},
 				&fakes.FakeTerminator{
 					TerminateFunc: func(ctx context.Context, pID string) error {
 						require.Equal(t, pluginID, pID)
@@ -551,7 +502,7 @@ func TestLoader_Unload(t *testing.T) {
 					},
 				})
 
-			err = l.Unload(context.Background(), pluginID)
+			err := l.Unload(context.Background(), pluginID)
 			require.ErrorIs(t, err, tc.expectedErr)
 		}
 	})

pkg/plugins/manager/manager_integration_test.go

@@ -1,322 +0,0 @@
-package manager
-
-import (
-	"context"
-	"encoding/json"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/grafana/grafana-azure-sdk-go/azsettings"
-	"github.com/grafana/grafana-plugin-sdk-go/backend"
-	"github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
-	"github.com/stretchr/testify/require"
-	"gopkg.in/ini.v1"
-
-	"github.com/grafana/grafana/pkg/infra/db"
-	"github.com/grafana/grafana/pkg/infra/tracing"
-	"github.com/grafana/grafana/pkg/plugins"
-	"github.com/grafana/grafana/pkg/plugins/backendplugin/coreplugin"
-	"github.com/grafana/grafana/pkg/plugins/backendplugin/provider"
-	"github.com/grafana/grafana/pkg/plugins/manager/client"
-	"github.com/grafana/grafana/pkg/plugins/manager/fakes"
-	"github.com/grafana/grafana/pkg/plugins/manager/loader"
-	"github.com/grafana/grafana/pkg/plugins/manager/loader/angular/angularinspector"
-	"github.com/grafana/grafana/pkg/plugins/manager/loader/assetpath"
-	"github.com/grafana/grafana/pkg/plugins/manager/loader/finder"
-	"github.com/grafana/grafana/pkg/plugins/manager/process"
-	"github.com/grafana/grafana/pkg/plugins/manager/registry"
-	"github.com/grafana/grafana/pkg/plugins/manager/signature"
-	"github.com/grafana/grafana/pkg/plugins/manager/signature/statickey"
-	"github.com/grafana/grafana/pkg/plugins/manager/sources"
-	"github.com/grafana/grafana/pkg/plugins/manager/store"
-	"github.com/grafana/grafana/pkg/plugins/pluginscdn"
-	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
-	"github.com/grafana/grafana/pkg/services/featuremgmt"
-	"github.com/grafana/grafana/pkg/services/licensing"
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/config"
-	plicensing "github.com/grafana/grafana/pkg/services/pluginsintegration/licensing"
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pipeline"
-	"github.com/grafana/grafana/pkg/services/searchV2"
-	"github.com/grafana/grafana/pkg/setting"
-	"github.com/grafana/grafana/pkg/tsdb/azuremonitor"
-	cloudmonitoring "github.com/grafana/grafana/pkg/tsdb/cloud-monitoring"
-	"github.com/grafana/grafana/pkg/tsdb/cloudwatch"
-	"github.com/grafana/grafana/pkg/tsdb/elasticsearch"
-	pyroscope "github.com/grafana/grafana/pkg/tsdb/grafana-pyroscope-datasource"
-	"github.com/grafana/grafana/pkg/tsdb/grafanads"
-	"github.com/grafana/grafana/pkg/tsdb/graphite"
-	"github.com/grafana/grafana/pkg/tsdb/influxdb"
-	"github.com/grafana/grafana/pkg/tsdb/loki"
-	"github.com/grafana/grafana/pkg/tsdb/mssql"
-	"github.com/grafana/grafana/pkg/tsdb/mysql"
-	"github.com/grafana/grafana/pkg/tsdb/opentsdb"
-	"github.com/grafana/grafana/pkg/tsdb/parca"
-	"github.com/grafana/grafana/pkg/tsdb/postgres"
-	"github.com/grafana/grafana/pkg/tsdb/prometheus"
-	"github.com/grafana/grafana/pkg/tsdb/tempo"
-	"github.com/grafana/grafana/pkg/tsdb/testdatasource"
-)
-
-func TestIntegrationPluginManager(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-	staticRootPath, err := filepath.Abs("../../../public/")
-	require.NoError(t, err)
-
-	bundledPluginsPath, err := filepath.Abs("../../../plugins-bundled/internal")
-	require.NoError(t, err)
-
-	// We use the raw config here as it forms the basis for the setting.Provider implementation
-	// The plugin manager also relies directly on the setting.Cfg struct to provide Grafana specific
-	// properties such as the loading paths
-	raw, err := ini.Load([]byte(`
-		app_mode = production
-
-		[plugin.test-app]
-		path=testdata/test-app
-
-		[plugin.test-panel]
-		not=included
-		`),
-	)
-	require.NoError(t, err)
-
-	cfg := &setting.Cfg{
-		Raw:                    raw,
-		StaticRootPath:         staticRootPath,
-		BundledPluginsPath:     bundledPluginsPath,
-		Azure:                  &azsettings.AzureSettings{},
-		IsFeatureToggleEnabled: func(_ string) bool { return false },
-	}
-
-	tracer := tracing.InitializeTracerForTest()
-	features := featuremgmt.WithFeatures()
-
-	hcp := httpclient.NewProvider()
-	am := azuremonitor.ProvideService(cfg, hcp, features, tracer)
-	cw := cloudwatch.ProvideService(cfg, hcp, features)
-	cm := cloudmonitoring.ProvideService(hcp, tracer)
-	es := elasticsearch.ProvideService(hcp)
-	grap := graphite.ProvideService(hcp, tracer)
-	idb := influxdb.ProvideService(hcp)
-	lk := loki.ProvideService(hcp, features, tracer)
-	otsdb := opentsdb.ProvideService(hcp)
-	pr := prometheus.ProvideService(hcp, cfg, features, tracer)
-	tmpo := tempo.ProvideService(hcp)
-	td := testdatasource.ProvideService()
-	pg := postgres.ProvideService(cfg)
-	my := mysql.ProvideService(cfg, hcp)
-	ms := mssql.ProvideService(cfg)
-	sv2 := searchV2.ProvideService(cfg, db.InitTestDB(t), nil, nil, tracer, features, nil, nil, nil)
-	graf := grafanads.ProvideService(sv2, nil)
-	phlare := pyroscope.ProvideService(hcp, acimpl.ProvideAccessControl(cfg))
-	parca := parca.ProvideService(hcp)
-
-	coreRegistry := coreplugin.ProvideCoreRegistry(am, cw, cm, es, grap, idb, lk, otsdb, pr, tmpo, td, pg, my, ms, graf, phlare, parca)
-
-	pCfg, err := config.ProvideConfig(setting.ProvideProvider(cfg), cfg, featuremgmt.WithFeatures())
-	require.NoError(t, err)
-	reg := registry.ProvideService()
-	lic := plicensing.ProvideLicensing(cfg, &licensing.OSSLicensingService{Cfg: cfg})
-	angularInspector, err := angularinspector.NewStaticInspector()
-	require.NoError(t, err)
-	proc := process.NewManager(reg)
-
-	discovery := pipeline.ProvideDiscoveryStage(pCfg, finder.NewLocalFinder(pCfg.DevMode), reg)
-	bootstrap := pipeline.ProvideBootstrapStage(pCfg, signature.ProvideService(pCfg, statickey.New()), assetpath.ProvideService(pluginscdn.ProvideService(pCfg)))
-	initialize := pipeline.ProvideInitializationStage(pCfg, reg, lic, provider.ProvideService(coreRegistry), proc, &fakes.FakeOauthService{}, fakes.NewFakeRoleRegistry())
-	terminate, err := pipeline.ProvideTerminationStage(pCfg, reg, proc)
-	require.NoError(t, err)
-
-	l := loader.ProvideService(pCfg, signature.NewUnsignedAuthorizer(pCfg),
-		reg, fakes.NewFakeRoleRegistry(),
-		assetpath.ProvideService(pluginscdn.ProvideService(pCfg)),
-		angularInspector, &fakes.FakeOauthService{}, discovery, bootstrap, initialize, terminate)
-	srcs := sources.ProvideService(cfg, pCfg)
-	ps, err := store.ProvideService(reg, srcs, l)
-	require.NoError(t, err)
-
-	ctx := context.Background()
-	verifyCorePluginCatalogue(t, ctx, ps)
-	verifyBundledPlugins(t, ctx, ps)
-	verifyPluginStaticRoutes(t, ctx, ps, reg)
-	verifyBackendProcesses(t, reg.Plugins(ctx))
-	verifyPluginQuery(t, ctx, client.ProvideService(reg, pCfg))
-}
-
-func verifyPluginQuery(t *testing.T, ctx context.Context, c plugins.Client) {
-	now := time.Unix(1661420870, 0)
-	req := &backend.QueryDataRequest{
-		PluginContext: backend.PluginContext{
-			PluginID: "testdata",
-		},
-		Queries: []backend.DataQuery{
-			{
-				RefID: "A",
-				TimeRange: backend.TimeRange{
-					From: now.Add(-5 * time.Minute),
-					To:   now,
-				},
-				JSON: json.RawMessage(`{"scenarioId":"csv_metric_values","stringInput":"1,20,90,30,5,0"}`),
-			},
-		},
-	}
-
-	resp, err := c.QueryData(ctx, req)
-	require.NoError(t, err)
-	payload, err := resp.MarshalJSON()
-	require.NoError(t, err)
-	require.JSONEq(t, `{"results":{"A":{"frames":[{"schema":{"refId":"A","fields":[{"name":"time","type":"time","typeInfo":{"frame":"time.Time"}},{"name":"A-series","type":"number","typeInfo":{"frame":"int64","nullable":true}}]},"data":{"values":[[1661420570000,1661420630000,1661420690000,1661420750000,1661420810000,1661420870000],[1,20,90,30,5,0]]}}],"status":200}}}`, string(payload))
-}
-
-func verifyCorePluginCatalogue(t *testing.T, ctx context.Context, ps *store.Service) {
-	t.Helper()
-
-	expPanels := map[string]struct{}{
-		"alertGroups":    {},
-		"alertlist":      {},
-		"annolist":       {},
-		"barchart":       {},
-		"bargauge":       {},
-		"canvas":         {},
-		"dashlist":       {},
-		"debug":          {},
-		"gauge":          {},
-		"geomap":         {},
-		"gettingstarted": {},
-		"graph":          {},
-		"heatmap":        {},
-		"histogram":      {},
-		"live":           {},
-		"logs":           {},
-		"candlestick":    {},
-		"news":           {},
-		"nodeGraph":      {},
-		"flamegraph":     {},
-		"traces":         {},
-		"piechart":       {},
-		"stat":           {},
-		"state-timeline": {},
-		"status-history": {},
-		"table":          {},
-		"table-old":      {},
-		"text":           {},
-		"timeseries":     {},
-		"trend":          {},
-		"welcome":        {},
-		"xychart":        {},
-		"datagrid":       {},
-	}
-
-	expDataSources := map[string]struct{}{
-		"cloudwatch":                       {},
-		"stackdriver":                      {},
-		"grafana-azure-monitor-datasource": {},
-		"elasticsearch":                    {},
-		"graphite":                         {},
-		"influxdb":                         {},
-		"loki":                             {},
-		"opentsdb":                         {},
-		"prometheus":                       {},
-		"tempo":                            {},
-		"testdata":                         {},
-		"postgres":                         {},
-		"mysql":                            {},
-		"mssql":                            {},
-		"grafana":                          {},
-		"alertmanager":                     {},
-		"dashboard":                        {},
-		"input":                            {},
-		"jaeger":                           {},
-		"mixed":                            {},
-		"zipkin":                           {},
-		"grafana-pyroscope-datasource":     {},
-		"parca":                            {},
-	}
-
-	expApps := map[string]struct{}{
-		"test-app": {},
-	}
-
-	panels := ps.Plugins(ctx, plugins.TypePanel)
-	require.Equal(t, len(expPanels), len(panels))
-	for _, p := range panels {
-		p, exists := ps.Plugin(ctx, p.ID)
-		require.NotEqual(t, plugins.PluginDTO{}, p)
-		require.True(t, exists)
-		require.Contains(t, expPanels, p.ID)
-	}
-
-	dataSources := ps.Plugins(ctx, plugins.TypeDataSource)
-	require.Equal(t, len(expDataSources), len(dataSources))
-	for _, ds := range dataSources {
-		p, exists := ps.Plugin(ctx, ds.ID)
-		require.NotEqual(t, plugins.PluginDTO{}, p)
-		require.True(t, exists)
-		require.Contains(t, expDataSources, ds.ID)
-	}
-
-	apps := ps.Plugins(ctx, plugins.TypeApp)
-	require.Equal(t, len(expApps), len(apps))
-	for _, app := range apps {
-		p, exists := ps.Plugin(ctx, app.ID)
-		require.True(t, exists)
-		require.NotNil(t, p)
-		require.Contains(t, expApps, app.ID)
-	}
-
-	require.Equal(t, len(expPanels)+len(expDataSources)+len(expApps), len(ps.Plugins(ctx)))
-}
-
-func verifyBundledPlugins(t *testing.T, ctx context.Context, ps *store.Service) {
-	t.Helper()
-
-	dsPlugins := make(map[string]struct{})
-	for _, p := range ps.Plugins(ctx, plugins.TypeDataSource) {
-		dsPlugins[p.ID] = struct{}{}
-	}
-
-	inputPlugin, exists := ps.Plugin(ctx, "input")
-	require.True(t, exists)
-	require.NotEqual(t, plugins.PluginDTO{}, inputPlugin)
-	require.NotNil(t, dsPlugins["input"])
-
-	pluginRoutes := make(map[string]*plugins.StaticRoute)
-	for _, r := range ps.Routes() {
-		pluginRoutes[r.PluginID] = r
-	}
-
-	for _, pluginID := range []string{"input"} {
-		require.Contains(t, pluginRoutes, pluginID)
-		require.Equal(t, pluginRoutes[pluginID].Directory, inputPlugin.Base())
-	}
-}
-
-func verifyPluginStaticRoutes(t *testing.T, ctx context.Context, rr plugins.StaticRouteResolver, reg registry.Service) {
-	routes := make(map[string]*plugins.StaticRoute)
-	for _, route := range rr.Routes() {
-		routes[route.PluginID] = route
-	}
-
-	require.Len(t, routes, 2)
-
-	inputPlugin, _ := reg.Plugin(ctx, "input")
-	require.NotNil(t, routes["input"])
-	require.Equal(t, routes["input"].Directory, inputPlugin.FS.Base())
-
-	testAppPlugin, _ := reg.Plugin(ctx, "test-app")
-	require.Contains(t, routes, "test-app")
-	require.Equal(t, routes["test-app"].Directory, testAppPlugin.FS.Base())
-}
-
-func verifyBackendProcesses(t *testing.T, ps []*plugins.Plugin) {
-	for _, p := range ps {
-		if p.Backend {
-			pc, exists := p.Client()
-			require.True(t, exists)
-			require.NotNil(t, pc)
-		}
-	}
-}

pkg/plugins/manager/pipeline/bootstrap/doc.go

@@ -1,6 +1,5 @@
 // Package bootstrap defines the Bootstrap stage of the plugin loader pipeline.
 //
 // The Bootstrap stage must implement the Bootstrapper interface.
-// - Bootstrap(ctx context.Context, src plugins.PluginSource, bundles []*plugins.FoundBundle) ([]*plugins.Plugin, error)
 
 package bootstrap

pkg/plugins/manager/pipeline/discovery/doc.go

@@ -1,6 +1,5 @@
 // Package discovery defines the Discovery stage of the plugin loader pipeline.
 
 // The Discovery stage must implement the Discoverer interface.
-// - Discover(ctx context.Context, src plugins.PluginSource) ([]*plugins.FoundBundle, error)
 
 package discovery

pkg/plugins/manager/pipeline/doc.go

@@ -4,7 +4,7 @@
 // A plugin loader pipeline is defined by the following stages:
 // 	 Discovery: Find plugins (e.g. from disk, remote, etc.), and [optionally] filter the results based on some criteria.
 // 	 Bootstrap: Create the plugins found in the discovery stage and enrich them with metadata.
-// 	 Verification: Verify the plugins based on some criteria (e.g. signature validation, angular detection, etc.)
+// 	 Validation: Validate the plugins based on some criteria (e.g. signature, angular, etc.)
 // 	 Initialization: Initialize the plugin for use (e.g. register with Grafana, start the backend process, declare RBAC roles etc.)
 // - Termination: Terminate the plugin (e.g. stop the backend process, cleanup, etc.)
 

pkg/plugins/manager/pipeline/initialization/doc.go

@@ -1,6 +1,5 @@
 // Package initialization defines the Initialization stage of the plugin loader pipeline.
 //
 // The Initialization stage must implement the Initializer interface.
-// - Initialize(ctx context.Context, ps []*plugins.Plugin) ([]*plugins.Plugin, error)
 
 package initialization

pkg/plugins/manager/pipeline/termination/doc.go

@@ -1,5 +1,4 @@
 // Package termination defines the Termination stage of the plugin loader pipeline.
 //
 // The Termination stage must implement the Terminator interface.
-// - Terminate(ctx context.Context, pluginID string) error
 package termination

pkg/plugins/manager/pipeline/validation/doc.go

@@ -0,0 +1,5 @@
+// Package validation defines the Validation stage of the plugin loader pipeline.
+//
+// The Validation stage must implement the Validator interface.
+
+package validation

pkg/plugins/manager/pipeline/validation/steps.go

@@ -0,0 +1,113 @@
+package validation
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/plugins/config"
+	"github.com/grafana/grafana/pkg/plugins/log"
+	"github.com/grafana/grafana/pkg/plugins/manager/loader/angular/angularinspector"
+	"github.com/grafana/grafana/pkg/plugins/manager/signature"
+)
+
+// DefaultValidateFuncs are the default ValidateFunc used for the Validate step of the Validation stage.
+func DefaultValidateFuncs(cfg *config.Cfg) []ValidateFunc {
+	return []ValidateFunc{
+		SignatureValidationStep(signature.NewValidator(signature.NewUnsignedAuthorizer(cfg))),
+		ModuleJSValidationStep(),
+		AngularDetectionStep(cfg, angularinspector.NewStaticInspector()),
+	}
+}
+
+type PluginSignatureValidator struct {
+	signatureValidator signature.Validator
+	log                log.Logger
+}
+
+func SignatureValidationStep(signatureValidator signature.Validator) ValidateFunc {
+	return newPluginSignatureValidator(signatureValidator).Validate
+}
+
+func newPluginSignatureValidator(signatureValidator signature.Validator) *PluginSignatureValidator {
+	return &PluginSignatureValidator{
+		signatureValidator: signatureValidator,
+		log:                log.New("plugins.validator.signature"),
+	}
+}
+
+func (v *PluginSignatureValidator) Validate(_ context.Context, p *plugins.Plugin) error {
+	return v.signatureValidator.ValidateSignature(p)
+}
+
+type ModuleJSValidator struct {
+	log log.Logger
+}
+
+func ModuleJSValidationStep() ValidateFunc {
+	return newModuleJSValidator().Validate
+}
+
+func newModuleJSValidator() *ModuleJSValidator {
+	return &ModuleJSValidator{
+		log: log.New("plugins.validator.module"),
+	}
+}
+
+func (v *ModuleJSValidator) Validate(_ context.Context, p *plugins.Plugin) error {
+	if !p.IsRenderer() && !p.IsCorePlugin() {
+		f, err := p.FS.Open("module.js")
+		if err != nil {
+			if errors.Is(err, plugins.ErrFileNotExist) {
+				v.log.Warn("Plugin missing module.js", "pluginID", p.ID,
+					"warning", "Missing module.js, If you loaded this plugin from git, make sure to compile it.")
+			}
+		} else if f != nil {
+			if err = f.Close(); err != nil {
+				v.log.Warn("Could not close module.js", "pluginID", p.ID, "err", err)
+			}
+		}
+	}
+	return nil
+}
+
+type AngularDetector struct {
+	cfg              *config.Cfg
+	angularInspector angularinspector.Inspector
+	log              log.Logger
+}
+
+func AngularDetectionStep(cfg *config.Cfg, angularInspector angularinspector.Inspector) ValidateFunc {
+	return newAngularDetector(cfg, angularInspector).Validate
+}
+
+func newAngularDetector(cfg *config.Cfg, angularInspector angularinspector.Inspector) *AngularDetector {
+	return &AngularDetector{
+		cfg:              cfg,
+		angularInspector: angularInspector,
+		log:              log.New("plugins.validator.angular"),
+	}
+}
+
+func (a *AngularDetector) Validate(ctx context.Context, p *plugins.Plugin) error {
+	if p.IsExternalPlugin() {
+		var err error
+
+		cctx, canc := context.WithTimeout(ctx, time.Second*10)
+		p.AngularDetected, err = a.angularInspector.Inspect(cctx, p)
+		canc()
+
+		if err != nil {
+			a.log.Warn("Could not inspect plugin for angular", "pluginID", p.ID, "err", err)
+		}
+
+		// Do not initialize plugins if they're using Angular and Angular support is disabled
+		if p.AngularDetected && !a.cfg.AngularSupportEnabled {
+			a.log.Error("Refusing to initialize plugin because it's using Angular, which has been disabled", "pluginID", p.ID)
+			return errors.New("angular plugins are not supported")
+		}
+	}
+
+	return nil
+}

pkg/plugins/manager/pipeline/validation/validation.go

@@ -0,0 +1,67 @@
+package validation
+
+import (
+	"context"
+	"errors"
+
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/plugins/config"
+	"github.com/grafana/grafana/pkg/plugins/log"
+)
+
+// Validator is responsible for the Validation stage of the plugin loader pipeline.
+type Validator interface {
+	Validate(ctx context.Context, ps []*plugins.Plugin) ([]*plugins.Plugin, error)
+}
+
+// ValidateFunc is the function used for the Validate step of the Validation stage.
+type ValidateFunc func(ctx context.Context, p *plugins.Plugin) error
+
+type Validate struct {
+	cfg           *config.Cfg
+	validateSteps []ValidateFunc
+	log           log.Logger
+}
+
+type Opts struct {
+	ValidateFuncs []ValidateFunc
+}
+
+// New returns a new Validation stage.
+func New(cfg *config.Cfg, opts Opts) *Validate {
+	if opts.ValidateFuncs == nil {
+		opts.ValidateFuncs = DefaultValidateFuncs(cfg)
+	}
+
+	return &Validate{
+		cfg:           cfg,
+		validateSteps: opts.ValidateFuncs,
+		log:           log.New("plugins.validation"),
+	}
+}
+
+// Validate will execute the Validate steps of the Validation stage.
+func (t *Validate) Validate(ctx context.Context, ps []*plugins.Plugin) ([]*plugins.Plugin, error) {
+	if len(t.validateSteps) == 0 {
+		return ps, nil
+	}
+
+	var err error
+	verifiedPlugins := make([]*plugins.Plugin, 0, len(ps))
+	for _, p := range ps {
+		stepFailed := false
+		for _, validate := range t.validateSteps {
+			err = validate(ctx, p)
+			if err != nil && !errors.Is(err, nil) {
+				stepFailed = true
+				t.log.Error("Plugin verification failed", "pluginID", p.ID, "err", err)
+				break
+			}
+		}
+		if !stepFailed {
+			verifiedPlugins = append(verifiedPlugins, p)
+		}
+	}
+
+	return verifiedPlugins, nil
+}

pkg/plugins/manager/signature/signature.go

@@ -5,19 +5,27 @@ import (
 	"github.com/grafana/grafana/pkg/plugins/log"
 )
 
-type Validator struct {
+type Validator interface {
+	ValidateSignature(plugin *plugins.Plugin) error
+}
+
+type Validation struct {
 	authorizer plugins.PluginLoaderAuthorizer
 	log        log.Logger
 }
 
-func NewValidator(authorizer plugins.PluginLoaderAuthorizer) Validator {
-	return Validator{
+func ProvideValidatorService(authorizer plugins.PluginLoaderAuthorizer) *Validation {
+	return NewValidator(authorizer)
+}
+
+func NewValidator(authorizer plugins.PluginLoaderAuthorizer) *Validation {
+	return &Validation{
 		authorizer: authorizer,
 		log:        log.New("plugin.signature.validator"),
 	}
 }
 
-func (s *Validator) Validate(plugin *plugins.Plugin) *plugins.SignatureError {
+func (s *Validation) ValidateSignature(plugin *plugins.Plugin) error {
 	if plugin.Signature.IsValid() {
 		s.log.Debug("Plugin has valid signature", "id", plugin.ID)
 		return nil