Run cd web && npm install && npm run build to "
+ "generate core/templates/static/dist/index.html, "
+ "or use the legacy dashboard at "
+ "/dashboard-legacy.
"
+ ""
+ ),
+ status_code=status_code,
+ media_type="text/html",
+ )
+ return Response(
+ _render_spa_index(index),
+ status_code=status_code,
+ media_type="text/html",
+ )
+
+
+async def redirect_dashboard_v2(request: Request) -> Response:
+ """308 redirect old /dashboard-v2/* URLs to the new /dashboard/* prefix."""
+ suffix = request.path_params.get("path", "")
+ target = "/dashboard"
+ if suffix:
+ target += f"/{suffix}"
+ elif request.url.path.endswith("/"):
+ target += "/"
+ if request.url.query:
+ target += f"?{request.url.query}"
+ return RedirectResponse(url=target, status_code=308)
+
+
+def register_spa_routes(mcp: Any) -> None:
+ """Register the SPA support routes on a FastMCP instance.
+
+ Mounts:
+ - ``/static/dist`` (StaticFiles) for hashed JS/CSS/asset bundles.
+ - ``/api/me`` and ``/api/i18n/{lang}`` JSON endpoints.
+ - ``/dashboard`` and ``/dashboard/{path:path}`` SPA index serving.
+ """
+ logger.info("Registering SPA (/dashboard) routes...")
+
+ # JSON helpers
+ mcp.custom_route("/api/me", methods=["GET"])(api_me)
+ mcp.custom_route("/api/i18n/{lang}", methods=["GET"])(api_i18n)
+ mcp.custom_route("/api/plugins", methods=["GET"])(api_plugins)
+
+ # SPA catch-alls. Both the bare path and any sub-path resolve to index.html
+ # so react-router-dom can take over.
+ mcp.custom_route("/dashboard", methods=["GET"])(serve_spa)
+ mcp.custom_route("/dashboard/", methods=["GET"])(serve_spa)
+ mcp.custom_route("/dashboard/{path:path}", methods=["GET"])(serve_spa)
+ mcp.custom_route("/dashboard-v2", methods=["GET"])(redirect_dashboard_v2)
+ mcp.custom_route("/dashboard-v2/", methods=["GET"])(redirect_dashboard_v2)
+ mcp.custom_route("/dashboard-v2/{path:path}", methods=["GET"])(redirect_dashboard_v2)
+
+ # Static assets (JS/CSS bundles) — only mount if dist/ exists, otherwise
+ # FastMCP's underlying Starlette app refuses the mount on a missing dir.
+ if os.path.isdir(SPA_DIST_DIR):
+ try:
+ # FastMCP exposes its inner Starlette app via .http_app() in v3+.
+ # Fall back to .app if available.
+ inner_app = None
+ for attr in ("http_app", "app", "_app"):
+ candidate = getattr(mcp, attr, None)
+ inner_app = candidate() if callable(candidate) else candidate
+ if inner_app is not None:
+ break
+ if inner_app is not None and hasattr(inner_app, "mount"):
+ inner_app.mount(
+ "/static/dist",
+ StaticFiles(directory=SPA_DIST_DIR, check_dir=False),
+ name="spa-dist",
+ )
+ logger.info("Mounted SPA static at /static/dist -> %s", SPA_DIST_DIR)
+ else:
+ # If we can't mount, fall back to a per-file route handler so
+ # bundles still load. This is slower but functional.
+ async def _serve_dist_file(request: Request) -> Response:
+ rel = request.path_params.get("filename", "")
+ full = os.path.normpath(os.path.join(SPA_DIST_DIR, rel))
+ if not full.startswith(SPA_DIST_DIR) or not os.path.isfile(full):
+ return Response(status_code=404)
+ return FileResponse(full)
+
+ mcp.custom_route("/static/dist/{filename:path}", methods=["GET"])(_serve_dist_file)
+ logger.info("Registered fallback /static/dist/{path} route")
+ except Exception as exc: # pragma: no cover — defensive
+ logger.warning("Could not mount SPA static dir: %s", exc)
+ else:
+ logger.info(
+ "SPA dist not present yet (%s); build with `cd web && npm run build`", SPA_DIST_DIR
+ )
+
+ logger.info("SPA routes registered successfully")
diff --git a/core/database.py b/core/database.py
index 1fa6a78..52ec382 100644
--- a/core/database.py
+++ b/core/database.py
@@ -37,7 +37,7 @@ logger = logging.getLogger(__name__)
_DEFAULT_DATA_DIR = "/app/data" if Path("/app").exists() else "./data"
# Schema version — increment when adding migrations
-SCHEMA_VERSION = 13
+SCHEMA_VERSION = 14
# Initial schema DDL
_SCHEMA_SQL = """\
@@ -281,6 +281,23 @@ _MIGRATIONS: dict[int, str] = {
# callers don't have to pass `model=...` every time.
"ALTER TABLE site_provider_keys ADD COLUMN default_model TEXT;\n"
),
+ 14: (
+ # F.19.2.2: every user API key gets full-tier scope by design.
+ # Tool visibility is gated per-site via ``sites.tool_scope`` and
+ # per-tool toggles, not per-key. Older keys were issued before
+ # the F.19.2.0 tier system added ``editor`` / ``settings`` /
+ # ``install`` between ``read`` and ``write``, so their stored
+ # scope string ("read write admin" or narrower) doesn't list the
+ # new tiers explicitly. The universal-tier closure already maps
+ # ``admin`` to every tier, so functionally these keys see every
+ # tool — but enumerating the scope names explicitly keeps the
+ # DB consistent with the dashboard preset dropdown and removes
+ # any risk if a future change checks scope names directly
+ # without going through UNIVERSAL_SCOPE_TIERS.
+ "UPDATE user_api_keys "
+ "SET scopes = 'read editor settings install write admin' "
+ "WHERE scopes IN ('read write admin', 'read write', 'admin');\n"
+ ),
}
@@ -759,6 +776,27 @@ class Database:
)
return row["cnt"] if row else 0
+ async def count_all_users(self) -> int:
+ """Return total number of registered users."""
+ row = await self.fetchone("SELECT COUNT(*) AS cnt FROM users")
+ return row["cnt"] if row else 0
+
+ async def count_all_sites(self) -> int:
+ """Return total number of user-owned sites across all users."""
+ row = await self.fetchone("SELECT COUNT(*) AS cnt FROM sites")
+ return row["cnt"] if row else 0
+
+ async def count_recent_users(self, days: int = 7) -> int:
+ """Return number of users registered in the last N days."""
+ import time
+
+ cutoff = time.time() - days * 86400
+ row = await self.fetchone(
+ "SELECT COUNT(*) AS cnt FROM users WHERE created_at > ?",
+ (cutoff,),
+ )
+ return row["cnt"] if row else 0
+
# ------------------------------------------------------------------
# Settings CRUD (Phase 4C.3)
# ------------------------------------------------------------------
diff --git a/core/endpoints/__init__.py b/core/endpoints/__init__.py
index 39328c0..72787e1 100644
--- a/core/endpoints/__init__.py
+++ b/core/endpoints/__init__.py
@@ -7,7 +7,7 @@ Each endpoint exposes only the tools relevant to its purpose.
Endpoints:
/mcp - Admin endpoint (all tools, requires Master API Key)
/mcp/wordpress - WordPress tools only (92 tools)
- /mcp/wordpress-advanced - WordPress Advanced tools (22 tools)
+ /mcp/wordpress-specialist - WordPress Specialist tools (companion-backed)
/mcp/gitea - Gitea tools only (55 tools)
/mcp/project/{id} - Project-specific tools
diff --git a/core/endpoints/config.py b/core/endpoints/config.py
index c479206..586fa41 100644
--- a/core/endpoints/config.py
+++ b/core/endpoints/config.py
@@ -16,7 +16,7 @@ class EndpointType(Enum):
SYSTEM = "system" # Phase X.3 - System tools only
WORDPRESS = "wordpress"
WOOCOMMERCE = "woocommerce"
- WORDPRESS_ADVANCED = "wordpress_advanced"
+ WORDPRESS_SPECIALIST = "wordpress_specialist"
GITEA = "gitea"
N8N = "n8n"
SUPABASE = "supabase" # Phase G
@@ -181,15 +181,28 @@ ENDPOINT_CONFIGS = {
},
max_tools=35,
),
- # WordPress Advanced endpoint - advanced operations
- EndpointType.WORDPRESS_ADVANCED: EndpointConfig(
- path="/wordpress-advanced",
- name="WordPress Advanced",
- description="WordPress advanced operations (database, bulk, system)",
- endpoint_type=EndpointType.WORDPRESS_ADVANCED,
- plugin_types=["wordpress_advanced"],
+ # F.19.1 WordPress Specialist endpoint - companion-backed advanced
+ # management (plugins/themes/users/options/cron/maintenance). No
+ # Docker socket; only needs Airano MCP Bridge v2.11.0+ on the WP
+ # side. Currently 6 read-only tools; F.19.2 will expand the surface.
+ EndpointType.WORDPRESS_SPECIALIST: EndpointConfig(
+ path="/wordpress-specialist",
+ name="WordPress Specialist",
+ description="Specialist WordPress management (plugins, themes, users, options, cron) — companion-backed",
+ endpoint_type=EndpointType.WORDPRESS_SPECIALIST,
+ plugin_types=["wordpress_specialist"],
require_master_key=False,
- allowed_scopes={"admin"}, # Admin scope required
+ allowed_scopes={"read", "write", "admin"},
+ # Same blacklist as the basic wordpress endpoint — keep system
+ # tools off the per-plugin endpoint regardless of how the tool
+ # registry expands.
+ tool_blacklist={
+ "manage_api_keys_create",
+ "manage_api_keys_delete",
+ "manage_api_keys_rotate",
+ "oauth_register_client",
+ "oauth_revoke_client",
+ },
max_tools=30,
),
# Gitea endpoint - Git repository management
diff --git a/core/endpoints/factory.py b/core/endpoints/factory.py
index 4a76193..af2a599 100644
--- a/core/endpoints/factory.py
+++ b/core/endpoints/factory.py
@@ -162,10 +162,13 @@ class MCPEndpointFactory:
Returns:
Plugin type or None for system tools
"""
- # Check for wordpress_advanced first (before wordpress_)
- # Tools are named: wordpress_advanced_wp_db_*, wordpress_advanced_bulk_*, wordpress_advanced_system_*
- if tool_name.startswith("wordpress_advanced_"):
- return "wordpress_advanced"
+ # Check the multi-word WordPress variant BEFORE the bare
+ # ``wordpress_`` prefix — tool names are
+ # ``wordpress_specialist_wp_plugin_list``,
+ # ``wordpress_create_post`` etc. (``wordpress_advanced`` was
+ # sunset in F.19.3.2-.3 / 2026-05-04.)
+ if tool_name.startswith("wordpress_specialist_"):
+ return "wordpress_specialist"
if tool_name.startswith("wordpress_"):
return "wordpress"
diff --git a/core/endpoints/registry.py b/core/endpoints/registry.py
index bc70ffe..1368920 100644
--- a/core/endpoints/registry.py
+++ b/core/endpoints/registry.py
@@ -58,7 +58,7 @@ class EndpointRegistry:
"""
Initialize the default set of endpoints.
- Creates admin, wordpress, wordpress-advanced, and gitea endpoints.
+ Creates admin, wordpress, wordpress-specialist, and gitea endpoints.
"""
if self._initialized:
logger.warning("Endpoints already initialized")
diff --git a/core/health.py b/core/health.py
index d164d87..464fb08 100644
--- a/core/health.py
+++ b/core/health.py
@@ -520,7 +520,7 @@ class HealthMonitor:
if not self.site_manager:
return {"healthy": False, "message": "SiteManager not available"}
- # Look up site info by full_id (handles multi-word plugin types like wordpress_advanced)
+ # Look up site info by full_id (handles multi-word plugin types like wordpress_specialist)
site_info = self._find_site_info(project_id)
if not site_info:
return {"healthy": False, "message": f"Site not found: {project_id}"}
@@ -547,7 +547,11 @@ class HealthMonitor:
)
# Fallback: authenticated health check for WordPress-based plugins
- if plugin_type in ("wordpress", "wordpress_advanced", "woocommerce"):
+ if plugin_type in (
+ "wordpress",
+ "wordpress_specialist",
+ "woocommerce",
+ ):
try:
import aiohttp
diff --git a/core/oauth/server.py b/core/oauth/server.py
index de129fe..27705a3 100644
--- a/core/oauth/server.py
+++ b/core/oauth/server.py
@@ -114,8 +114,13 @@ class OAuthServer:
error_description="Only S256 code_challenge_method is supported (OAuth 2.1)",
)
- # Validate scope
- requested_scopes = scope.split() if scope else ["read", "write", "admin"]
+ # Validate scope. F.19.2.2: default to every tier explicitly so
+ # an OAuth client without a scope hint gets the same surface as a
+ # dashboard-issued user key. The binding narrowing is per-site
+ # (intersection with the site's tool_scope preset).
+ requested_scopes = (
+ scope.split() if scope else ["read", "editor", "settings", "install", "write", "admin"]
+ )
for s in requested_scopes:
if s not in client.allowed_scopes:
raise OAuthError(
diff --git a/core/plugin_visibility.py b/core/plugin_visibility.py
index 788ac08..0a9f23b 100644
--- a/core/plugin_visibility.py
+++ b/core/plugin_visibility.py
@@ -7,15 +7,24 @@ plugins listed in the ENABLED_PLUGINS setting (DB > ENV > default).
Usage:
from core.plugin_visibility import get_public_plugin_types, is_plugin_public
- public_types = get_public_plugin_types() # {"wordpress", "woocommerce", "supabase"}
+ public_types = get_public_plugin_types()
if is_plugin_public("gitea"): # True
...
"""
import os
-# Default plugins available to public (OAuth) users
-DEFAULT_PUBLIC_PLUGINS = {"wordpress", "woocommerce", "supabase", "openpanel", "gitea"}
+# Default plugins available to public (OAuth) users.
+DEFAULT_PUBLIC_PLUGINS = {
+ "wordpress",
+ "woocommerce",
+ "wordpress_specialist",
+ "supabase",
+ "openpanel",
+ "gitea",
+ "n8n",
+ "coolify",
+}
def _parse_plugins(val: str) -> set[str]:
diff --git a/core/settings.py b/core/settings.py
index bd6f8e8..cf71963 100644
--- a/core/settings.py
+++ b/core/settings.py
@@ -3,7 +3,10 @@
Usage:
from core.settings import get_setting
- enabled = await get_setting("ENABLED_PLUGINS", "wordpress,woocommerce,supabase,openpanel,gitea")
+ enabled = await get_setting(
+ "ENABLED_PLUGINS",
+ "wordpress,woocommerce,wordpress_specialist,supabase,openpanel,gitea,n8n,coolify",
+ )
max_sites = int(await get_setting("MAX_SITES_PER_USER", "10"))
"""
@@ -15,9 +18,14 @@ logger = logging.getLogger(__name__)
# Cached plugin set for sync access (updated when settings change)
_cached_plugins: set[str] | None = None
+# Cached int settings for sync access (updated when settings change)
+_cached_max_sites: int | None = None
+_cached_rate_per_min: int | None = None
+_cached_rate_per_hr: int | None = None
+
# Default values for all managed settings
SETTING_DEFAULTS: dict[str, str] = {
- "ENABLED_PLUGINS": "wordpress,woocommerce,supabase,openpanel,gitea",
+ "ENABLED_PLUGINS": "wordpress,woocommerce,wordpress_specialist,supabase,openpanel,gitea,n8n,coolify",
"MAX_SITES_PER_USER": "10",
"USER_RATE_LIMIT_PER_MIN": "30",
"USER_RATE_LIMIT_PER_HR": "500",
@@ -84,15 +92,77 @@ async def get_setting(key: str, default: str | None = None) -> str | None:
return SETTING_DEFAULTS.get(key)
+def get_cached_max_sites() -> int:
+ """Return the cached MAX_SITES_PER_USER value (sync, uses last refresh)."""
+ if _cached_max_sites is not None:
+ return _cached_max_sites
+ env_val = os.environ.get("MAX_SITES_PER_USER")
+ if env_val:
+ try:
+ return max(1, int(env_val))
+ except ValueError:
+ pass
+ return int(SETTING_DEFAULTS["MAX_SITES_PER_USER"])
+
+
+def get_cached_rate_per_min() -> int:
+ """Return the cached USER_RATE_LIMIT_PER_MIN value (sync, uses last refresh)."""
+ if _cached_rate_per_min is not None:
+ return _cached_rate_per_min
+ env_val = os.environ.get("USER_RATE_LIMIT_PER_MIN")
+ if env_val:
+ try:
+ return max(1, int(env_val))
+ except ValueError:
+ pass
+ return int(SETTING_DEFAULTS["USER_RATE_LIMIT_PER_MIN"])
+
+
+def get_cached_rate_per_hr() -> int:
+ """Return the cached USER_RATE_LIMIT_PER_HR value (sync, uses last refresh)."""
+ if _cached_rate_per_hr is not None:
+ return _cached_rate_per_hr
+ env_val = os.environ.get("USER_RATE_LIMIT_PER_HR")
+ if env_val:
+ try:
+ return max(1, int(env_val))
+ except ValueError:
+ pass
+ return int(SETTING_DEFAULTS["USER_RATE_LIMIT_PER_HR"])
+
+
async def refresh_plugin_cache() -> None:
- """Refresh the cached plugin set from DB/ENV/default."""
- global _cached_plugins
+ """Refresh all sync-readable setting caches from DB/ENV/default."""
+ global _cached_plugins, _cached_max_sites, _cached_rate_per_min, _cached_rate_per_hr
+
val = await get_setting("ENABLED_PLUGINS")
if val:
_cached_plugins = {p.strip().lower() for p in val.split(",") if p.strip()}
else:
_cached_plugins = None
+ try:
+ raw = await get_setting("MAX_SITES_PER_USER")
+ _cached_max_sites = max(1, int(raw)) if raw else int(SETTING_DEFAULTS["MAX_SITES_PER_USER"])
+ except (ValueError, TypeError):
+ _cached_max_sites = int(SETTING_DEFAULTS["MAX_SITES_PER_USER"])
+
+ try:
+ raw = await get_setting("USER_RATE_LIMIT_PER_MIN")
+ _cached_rate_per_min = (
+ max(1, int(raw)) if raw else int(SETTING_DEFAULTS["USER_RATE_LIMIT_PER_MIN"])
+ )
+ except (ValueError, TypeError):
+ _cached_rate_per_min = int(SETTING_DEFAULTS["USER_RATE_LIMIT_PER_MIN"])
+
+ try:
+ raw = await get_setting("USER_RATE_LIMIT_PER_HR")
+ _cached_rate_per_hr = (
+ max(1, int(raw)) if raw else int(SETTING_DEFAULTS["USER_RATE_LIMIT_PER_HR"])
+ )
+ except (ValueError, TypeError):
+ _cached_rate_per_hr = int(SETTING_DEFAULTS["USER_RATE_LIMIT_PER_HR"])
+
async def save_setting(key: str, value: str) -> None:
"""Save a setting to database and refresh caches."""
@@ -101,8 +171,7 @@ async def save_setting(key: str, value: str) -> None:
db = get_database()
await db.set_setting(key, value)
- if key == "ENABLED_PLUGINS":
- await refresh_plugin_cache()
+ await refresh_plugin_cache()
async def delete_setting_value(key: str) -> bool:
@@ -112,8 +181,7 @@ async def delete_setting_value(key: str) -> bool:
db = get_database()
deleted = await db.delete_setting(key)
- if key == "ENABLED_PLUGINS":
- await refresh_plugin_cache()
+ await refresh_plugin_cache()
return deleted
diff --git a/core/site_api.py b/core/site_api.py
index 1b5c7e1..63ed939 100644
--- a/core/site_api.py
+++ b/core/site_api.py
@@ -19,8 +19,8 @@ import aiohttp
logger = logging.getLogger(__name__)
-# Maximum sites per user (configurable via env var)
-MAX_SITES_PER_USER = int(os.getenv("MAX_SITES_PER_USER", "10"))
+# Fallback used when the settings DB is unavailable at import time
+_MAX_SITES_FALLBACK = int(os.getenv("MAX_SITES_PER_USER", "10"))
# Plugin credential field definitions — drives the dynamic "Add Site" form
# and server-side validation. Each field has:
@@ -104,13 +104,18 @@ PLUGIN_CREDENTIAL_FIELDS: dict[str, list[dict[str, Any]]] = {
),
},
],
- "wordpress_advanced": [
+ # F.19.1 WordPress Specialist — companion-backed, no Docker socket.
+ # Same auth shape as the basic wordpress plugin (Application Password)
+ # but the WP user behind the password must have ``manage_options``,
+ # AND Airano MCP Bridge v2.11.0+ must be active on the WP site for
+ # the admin namespace to exist.
+ "wordpress_specialist": [
{
"name": "username",
"label": "Username",
"type": "text",
"required": True,
- "hint": "Your WordPress admin username (HTTP Basic username for every API call).",
+ "hint": "WordPress admin username (the user that owns the Application Password).",
},
{
"name": "app_password",
@@ -119,16 +124,11 @@ PLUGIN_CREDENTIAL_FIELDS: dict[str, list[dict[str, Any]]] = {
"required": True,
"hint": (
"WordPress Admin → Users → Profile → Application Passwords. "
- "IS the API credential — no separate API key needed."
+ "The user MUST have manage_options. Requires Airano MCP "
+ "Bridge v2.11.0+ on the WP side — install from "
+ "wordpress-plugin/airano-mcp-bridge.zip in the repo."
),
},
- {
- "name": "container",
- "label": "Docker Container Name",
- "type": "text",
- "required": False,
- "hint": "Docker container running WordPress (for WP-CLI access). Leave empty if unused.",
- },
],
"gitea": [
{
@@ -268,7 +268,7 @@ PLUGIN_CREDENTIAL_FIELDS: dict[str, list[dict[str, Any]]] = {
PLUGIN_DISPLAY_NAMES: dict[str, str] = {
"wordpress": "WordPress",
"woocommerce": "WooCommerce",
- "wordpress_advanced": "WordPress Advanced",
+ "wordpress_specialist": "WordPress Specialist",
"gitea": "Gitea",
"n8n": "n8n",
"supabase": "Supabase",
@@ -282,7 +282,12 @@ PLUGIN_DISPLAY_NAMES: dict[str, str] = {
_HEALTH_ENDPOINTS: dict[str, dict[str, Any]] = {
"wordpress": {"path": "/wp-json/wp/v2/users/me", "method": "GET"},
"woocommerce": {"path": "/wp-json/wc/v3/system_status", "method": "GET"},
- "wordpress_advanced": {"path": "/wp-json/wp/v2/users/me", "method": "GET"},
+ # F.19.1: hits the companion's lightest admin route. Returns 404 if
+ # Airano MCP Bridge v2.11.0+ is missing, 403 if the user lacks
+ # ``manage_options``, 200 with a small JSON body otherwise. This
+ # makes "Test Connection" surface the actual end-to-end requirement
+ # instead of just "auth works" (which /users/me would).
+ "wordpress_specialist": {"path": "/wp-json/airano-mcp/v1/admin/maintenance", "method": "GET"},
"gitea": {"path": "/api/v1/user", "method": "GET"},
"n8n": {"path": "/healthz", "method": "GET"},
"supabase": {"path": "/rest/v1/", "method": "GET"},
@@ -314,28 +319,53 @@ def get_credential_fields(plugin_type: str) -> list[dict[str, Any]]:
return fields
-def get_user_credential_fields() -> dict[str, list[dict[str, Any]]]:
- """Get credential fields for public (non-admin) users.
+def get_user_credential_fields(is_admin: bool = False) -> dict[str, list[dict[str, Any]]]:
+ """Get credential fields for the dashboard's Add/Edit Site forms.
- Only includes plugins enabled via ENABLED_PLUGINS env var.
+ Admin users see every registered plugin so they can use admin-only
+ plugins (wordpress_specialist) without having to add them to
+ ``ENABLED_PLUGINS`` for everyone. Public users get only the plugins
+ enabled via ``ENABLED_PLUGINS`` env var (Track F.1).
+
+ F.19.1 (2026-05-01) — surfaced when an admin OAuth user added a
+ wordpress_specialist site and the manage page rendered an empty
+ credential form on revisit because the unfiltered map was being
+ filtered for public visibility. The site row exists but the
+ template can't render its fields.
+
+ Args:
+ is_admin: When True, return every plugin's credential fields.
+ Defaults to False for backward compatibility.
Returns:
- Filtered dict of plugin_type -> field definitions.
+ Dict of plugin_type -> field definitions.
"""
+ if is_admin:
+ return dict(PLUGIN_CREDENTIAL_FIELDS)
+
from core.plugin_visibility import get_public_plugin_types
public = get_public_plugin_types()
return {k: v for k, v in PLUGIN_CREDENTIAL_FIELDS.items() if k in public}
-def get_user_plugin_names() -> dict[str, str]:
- """Get plugin display names for public (non-admin) users.
+def get_user_plugin_names(is_admin: bool = False) -> dict[str, str]:
+ """Get plugin display names for the dashboard's plugin pickers.
- Only includes plugins enabled via ENABLED_PLUGINS env var.
+ Admin users see every registered plugin (so the Add Site dropdown
+ surfaces ``wordpress_specialist`` etc.); public users get only the
+ plugins enabled via ``ENABLED_PLUGINS`` env var.
+
+ Args:
+ is_admin: When True, return every plugin's display name.
+ Defaults to False for backward compatibility.
Returns:
- Filtered dict of plugin_type -> display name.
+ Dict of plugin_type -> display name.
"""
+ if is_admin:
+ return dict(PLUGIN_DISPLAY_NAMES)
+
from core.plugin_visibility import get_public_plugin_types
public = get_public_plugin_types()
@@ -387,7 +417,7 @@ async def validate_site_connection(
# Build auth headers per plugin type
headers: dict[str, str] = {}
- if plugin_type in ("wordpress", "wordpress_advanced"):
+ if plugin_type in ("wordpress", "wordpress_specialist"):
import base64
username = credentials.get("username", "")
@@ -502,10 +532,13 @@ async def create_user_site(
db = get_database()
- # Check site limit
+ # Check site limit (reads DB > ENV > default so dashboard/settings changes take effect)
+ from core.settings import get_cached_max_sites
+
+ max_sites = get_cached_max_sites()
count = await db.count_sites_by_user(user_id)
- if count >= MAX_SITES_PER_USER:
- raise ValueError(f"Site limit reached ({MAX_SITES_PER_USER} sites per user)")
+ if count >= max_sites:
+ raise ValueError(f"Site limit reached ({max_sites} sites per user)")
# Check alias uniqueness (DB constraint will also catch this)
existing = await db.get_site_by_alias(user_id, alias)
diff --git a/core/templates/base.html b/core/templates/base.html
index cf370c3..8e935ed 100644
--- a/core/templates/base.html
+++ b/core/templates/base.html
@@ -1,18 +1,100 @@
-
+
+
{% block title %}MCP Hub{% endblock %}
+
+
+
+
+
+
+{% endblock %}
+
{% block content %}
-