Fixed local configuration plugins being able to approve assistant plugins

app/MindWork AI Studio/Plugins/configuration/plugin.lua

@@ -461,6 +461,12 @@ CONFIG["SETTINGS"] = {}
 -- You can generate the exact hash with the build-script command:
 --   dotnet run --project app/Build -- assistant-plugin-hash "<plugin-dir>" --lua-snippet
 --
+-- Only works in configurations your configuration server deploys. An approval marks an
+-- assistant plugin as safe without any audit, and AI Studio then tells users that their
+-- organization approved it. A configuration plugin that a user placed locally therefore
+-- cannot approve anything: AI Studio ignores its approvals and writes a warning to the
+-- log. This is decided by where the plugin is stored, not by DEPLOYED_USING_CONFIG_SERVER.
+--
 -- Adds up, does not replace: approvals of all your configurations are combined, so a
 -- department configuration can approve additional assistant plugins without repeating
 -- the approvals of the base configuration. Each configuration keeps its own approvals,

app/MindWork AI Studio/Tools/PluginSystem/PluginConfiguration.cs

@@ -355,6 +355,24 @@ public sealed class PluginConfiguration(bool isInternal, LuaState state, PluginT
         if (dryRun)
             return;
 
+        //
+        // Only the IT department of an organization may approve assistant plugins. An approval
+        // marks a plugin as safe without any security audit, and the user interface states that the
+        // organization approved it. No local configuration plugin may make that claim: it would
+        // disable the security audit for arbitrary assistant plugins while telling the user that
+        // their organization vouched for them.
+        //
+        // We decide by the plugin path. The self-declared DEPLOYED_USING_CONFIG_SERVER field would
+        // not do, because any plugin can set it to true.
+        //
+        if (!PluginFactory.IsEnterpriseConfigurationPath(this.PluginPath))
+        {
+            if (successful)
+                LOG.LogWarning("The configuration plugin '{ConfigPluginId}' at '{PluginPath}' declares enterprise approvals for assistant plugins, but your organization's IT did not deploy it. Ignoring these approvals: only configuration plugins from a configuration server may approve assistant plugins.", this.Id, this.PluginPath);
+
+            return;
+        }
+
         switch (successful)
         {
             case true:

app/MindWork AI Studio/Tools/PluginSystem/PluginFactory.cs

@@ -96,7 +96,7 @@ public static partial class PluginFactory
     /// </remarks>
     /// <param name="pluginPath">The directory of the plugin.</param>
     /// <returns>True when the directory is nested in the enterprise configuration directory.</returns>
-    private static bool IsEnterpriseConfigurationPath(string? pluginPath)
+    public static bool IsEnterpriseConfigurationPath(string? pluginPath)
     {
         if (string.IsNullOrWhiteSpace(pluginPath) || string.IsNullOrWhiteSpace(ENTERPRISE_CONFIGURATION_PLUGINS_ROOT))
             return false;

app/MindWork AI Studio/wwwroot/changelog/v26.8.1.md

@@ -14,6 +14,7 @@
 - Fixed configuration-managed settings remaining active after their configuration plugin was removed.
 - Fixed the integrated code editor to keep errors and other issues in plugin code visible in the footer while scrolling.
 - Fixed the trusted badge so you can now see at a glance which models are trusted. It is shown consistently for self-hosted models and models from trusted providers.
+- Fixed approvals for assistant plugins being accepted from any configuration plugin. An approval marks an assistant as safe without a security check, and the app states that your organization approved it. Only configurations your IT department deploys can do that now; approvals from a locally placed configuration plugin are ignored and reported in the log.
 - Fixed preview features contributed by several configuration plugins at once. Only the most recent contribution was recognized as coming from your organization, so features enabled by another configuration looked as if you had switched them on yourself. Each configuration is now tracked separately, which lets your organization enable one preview feature company-wide and another one for a single department.
 - Fixed which configuration wins when two configuration plugins collide, e.g. by claiming the same plugin ID, by managing the same setting, or by defining the same provider. Previously, this was down to chance, so a local configuration plugin could take over parts of the configuration your IT department deployed. Configurations from your organization now always win, and every ignored attempt is reported in the log.
 - Upgraded dependencies to their latest versions to improve security and stability.

documentation/Enterprise IT.md

@@ -369,6 +369,14 @@ AI Studio computes the approval hash as a SHA-256 digest over all `.lua` files i
 
 If any Lua file changes, the hash changes automatically and the enterprise approval no longer applies.
 
+### Only your configurations may approve
+
+Approvals are honored only in configuration plugins that a configuration server deployed, meaning plugins stored under the `.config` directory. AI Studio ignores the approvals of a locally placed configuration plugin and writes a warning to the log.
+
+The reason is what an approval does: it marks an assistant plugin as safe without any security audit, and AI Studio then tells the user that their organization approved it. Anyone who can drop a file into the plugin directory could otherwise disable the security audit for an assistant plugin of their choosing while the app vouches for it in your name.
+
+This is decided by where the plugin is stored, not by its `DEPLOYED_USING_CONFIG_SERVER` field. That field is part of the plugin itself, so any plugin could claim it.
+
 ### Configuration example
 
 Add the approval list to `CONFIG["SETTINGS"]` in your configuration plugin: