feat: disable ext builder option

lnbits/core/templates/admin/_tab_extensions.html

@@ -84,6 +84,27 @@
               />
             </q-item-section>
           </q-item>
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label>
+                <span v-text="$t('misc_disable_extensions_builder')"></span>
+              </q-item-label>
+              <q-item-label caption>
+                <span
+                  v-text="$t('misc_disable_extensions_builder_label')"
+                ></span>
+              </q-item-label>
+            </q-item-section>
+            <q-item-section avatar>
+              <q-toggle
+                size="md"
+                v-model="formData.lnbits_extensions_builder_deactivate_non_admins"
+                checked-icon="check"
+                color="green"
+                unchecked-icon="clear"
+              />
+            </q-item-section>
+          </q-item>
           <q-item tag="label" v-ripple>
             <q-item-section>
               <q-item-label>

lnbits/core/templates/core/extensions.html

@@ -54,9 +54,11 @@
                 v-text="$t('new_version') + ` (${updatableExtensions?.length})`"
               ></span>
             </q-badge>
+            {% if extension_builder_enabled %}
             <q-btn flat no-caps icon="architecture" to="/extensions/builder"
               ><span v-text="$t('create_extension')"></span
             ></q-btn>
+            {% endif %}
             <q-btn
               v-if="g.user.admin"
               flat

lnbits/core/views/extension_api.py

@@ -46,6 +46,7 @@ from lnbits.decorators import (
     check_admin,
     check_user_exists,
 )
+from lnbits.settings import settings
 
 from ..crud import (
     create_user_extension,
@@ -127,12 +128,16 @@ async def api_install_extension(data: CreateExtension):
     description="""
         This endpoint generates a zip file for the extension based on the provided data.
     """,
-    dependencies=[Depends(check_user_exists)],
-    response_model=None,
 )
 async def api_build_extension(
     data: ExtensionData,
+    user: User = Depends(check_user_exists),
 ) -> FileResponse:
+    if settings.lnbits_extensions_builder_deactivate_non_admins and not user.admin:
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN,
+            "Extension Builder is disabled for non admin users.",
+        )
     stub_ext_id = "extension_builder_stub"  # todo: do not hardcode, fetch from manifest
     release, build_dir = await build_extension_from_data(data, stub_ext_id)
 
@@ -212,6 +217,11 @@ async def api_preview_extension(
     data: ExtensionData,
     user: User = Depends(check_user_exists),
 ) -> SimpleStatus:
+    if settings.lnbits_extensions_builder_deactivate_non_admins and not user.admin:
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN,
+            "Extension Builder is disabled for non admin users.",
+        )
     stub_ext_id = "extension_builder_stub"
     working_dir_name = "preview_" + sha256(user.id.encode("utf-8")).hexdigest()
     await build_extension_from_data(data, stub_ext_id, working_dir_name)

lnbits/core/views/generic.py

@@ -151,6 +151,8 @@ async def extensions(request: Request, user: User = Depends(check_user_exists)):
         {
             "user": user.json(),
             "extension_data": extension_data,
+            "extension_builder_enabled": user.admin
+            or not settings.lnbits_extensions_builder_deactivate_non_admins,
             "ajax": _is_ajax_request(request),
         },
     )
@@ -160,6 +162,11 @@ async def extensions(request: Request, user: User = Depends(check_user_exists)):
     "/extensions/builder", name="extensions builder", response_class=HTMLResponse
 )
 async def extensions_builder(request: Request, user: User = Depends(check_user_exists)):
+    if settings.lnbits_extensions_builder_deactivate_non_admins and not user.admin:
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN,
+            "Extension Builder is disabled for non admin users.",
+        )
     return template_renderer().TemplateResponse(
         request,
         "core/extensions_builder.html",
@@ -181,6 +188,11 @@ async def extensions_builder_preview(
     page_name: str | None = None,
     user: User = Depends(check_user_exists),
 ):
+    if settings.lnbits_extensions_builder_deactivate_non_admins and not user.admin:
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN,
+            "Extension Builder is disabled for non admin users.",
+        )
     working_dir_name = "preview_" + sha256(user.id.encode("utf-8")).hexdigest()
     html_file_name = "index.html"
     if page_name == "public_page":

lnbits/settings.py

@@ -51,6 +51,7 @@ class ExtensionsSettings(LNbitsSettings):
     lnbits_admin_extensions: list[str] = Field(default=[])
     lnbits_user_default_extensions: list[str] = Field(default=[])
     lnbits_extensions_deactivate_all: bool = Field(default=False)
+    lnbits_extensions_builder_deactivate_non_admins: bool = Field(default=False)
     lnbits_extensions_manifests: list[str] = Field(
         default=[
             "https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions.json"

lnbits/static/i18n/en.js

@@ -497,6 +497,9 @@ window.localisation.en = {
   miscellanous: 'Miscellanous',
   misc_disable_extensions: 'Disable Extensions',
   misc_disable_extensions_label: 'Disable all extensions',
+  misc_disable_extensions_builder: 'Disable Extensions Builder',
+  misc_disable_extensions_builder_label:
+    'Disable Extensions Builder for non admin users.',
   misc_hide_api: 'Hide API',
   misc_hide_api_label: 'Hides wallet api, extensions can choose to honor',
   wallets_management: 'Wallets Management',