shim plugin related APIs, proxy web requests.

server/index.js

@@ -30,9 +30,11 @@ app.use((req, res, next) => {
 
 const fsRoutes = require("./routes/fs");
 const vaultRoutes = require("./routes/vault");
+const proxyRoutes = require("./routes/proxy");
 
 app.use("/api/fs", fsRoutes);
 app.use("/api/vault", vaultRoutes);
+app.use("/api/proxy", proxyRoutes);
 
 // Serve vault files for resource URLs (images, attachments, etc.)
 // Vault ID is the first path segment: /vault-files/<vault-id>/path/to/file

server/routes/proxy.js

@@ -0,0 +1,45 @@
+const express = require("express");
+
+const router = express.Router();
+
+// POST /api/proxy  -  forward a request to an external URL (bypasses browser CORS)
+// Used by the requestUrl shim for plugin installation, update checks, etc.
+router.post("/", async (req, res) => {
+  const { url, method, headers, body, binary } = req.body;
+  if (!url) {
+    return res.status(400).json({ error: "Missing url" });
+  }
+
+  try {
+    const fetchOpts = {
+      method: method || "GET",
+      headers: headers || {},
+    };
+    if (body && method !== "GET" && method !== "HEAD") {
+      if (binary && typeof body === "string") {
+        fetchOpts.body = Buffer.from(body, "base64");
+      } else {
+        fetchOpts.body = body;
+      }
+    }
+
+    const upstream = await fetch(url, fetchOpts);
+    const respBody = Buffer.from(await upstream.arrayBuffer());
+
+    // Forward response headers
+    const respHeaders = {};
+    upstream.headers.forEach((val, key) => {
+      respHeaders[key] = val;
+    });
+
+    res.json({
+      status: upstream.status,
+      headers: respHeaders,
+      body: respBody.toString("base64"),
+    });
+  } catch (e) {
+    res.status(502).json({ error: e.message });
+  }
+});
+
+module.exports = router;