chore: initial commit for phase06

apps/api/src/lib/config-parsers.ts

@@ -0,0 +1,234 @@
+import type { ConfigParser, ConfigEntry } from '@source/shared';
+
+/**
+ * Parse a config file content into key-value entries based on the parser type.
+ */
+export function parseConfig(content: string, parser: ConfigParser): ConfigEntry[] {
+  switch (parser) {
+    case 'properties':
+      return parseProperties(content);
+    case 'json':
+      return parseJson(content);
+    case 'yaml':
+      return parseYaml(content);
+    case 'keyvalue':
+      return parseKeyValue(content);
+    default:
+      return [];
+  }
+}
+
+/**
+ * Serialize key-value entries back into a config file content.
+ */
+export function serializeConfig(
+  entries: ConfigEntry[],
+  parser: ConfigParser,
+  originalContent?: string,
+): string {
+  switch (parser) {
+    case 'properties':
+      return serializeProperties(entries, originalContent);
+    case 'json':
+      return serializeJson(entries);
+    case 'yaml':
+      return serializeYaml(entries, originalContent);
+    case 'keyvalue':
+      return serializeKeyValue(entries, originalContent);
+    default:
+      return '';
+  }
+}
+
+// === Properties (Java .properties format) ===
+
+function parseProperties(content: string): ConfigEntry[] {
+  const entries: ConfigEntry[] = [];
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('!')) continue;
+    const eqIndex = trimmed.indexOf('=');
+    if (eqIndex === -1) continue;
+    entries.push({
+      key: trimmed.substring(0, eqIndex).trim(),
+      value: trimmed.substring(eqIndex + 1).trim(),
+    });
+  }
+  return entries;
+}
+
+function serializeProperties(entries: ConfigEntry[], originalContent?: string): string {
+  if (!originalContent) {
+    return entries.map((e) => `${e.key}=${e.value}`).join('\n') + '\n';
+  }
+
+  const entryMap = new Map(entries.map((e) => [e.key, e.value]));
+  const lines = originalContent.split('\n');
+  const result: string[] = [];
+  const written = new Set<string>();
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('!')) {
+      result.push(line);
+      continue;
+    }
+    const eqIndex = trimmed.indexOf('=');
+    if (eqIndex === -1) {
+      result.push(line);
+      continue;
+    }
+    const key = trimmed.substring(0, eqIndex).trim();
+    if (entryMap.has(key)) {
+      result.push(`${key}=${entryMap.get(key)}`);
+      written.add(key);
+    } else {
+      result.push(line);
+    }
+  }
+
+  // Append new keys
+  for (const entry of entries) {
+    if (!written.has(entry.key)) {
+      result.push(`${entry.key}=${entry.value}`);
+    }
+  }
+
+  return result.join('\n');
+}
+
+// === JSON ===
+
+function parseJson(content: string): ConfigEntry[] {
+  try {
+    const obj = JSON.parse(content);
+    if (typeof obj !== 'object' || Array.isArray(obj)) return [];
+    return Object.entries(obj).map(([key, value]) => ({
+      key,
+      value: typeof value === 'string' ? value : JSON.stringify(value),
+    }));
+  } catch {
+    return [];
+  }
+}
+
+function serializeJson(entries: ConfigEntry[]): string {
+  const obj: Record<string, unknown> = {};
+  for (const entry of entries) {
+    try {
+      obj[entry.key] = JSON.parse(entry.value);
+    } catch {
+      obj[entry.key] = entry.value;
+    }
+  }
+  return JSON.stringify(obj, null, 2) + '\n';
+}
+
+// === YAML (simplified — only top-level key: value) ===
+
+function parseYaml(content: string): ConfigEntry[] {
+  const entries: ConfigEntry[] = [];
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    // Only handle top-level keys (no indentation)
+    if (line.startsWith(' ') || line.startsWith('\t')) continue;
+    const colonIndex = trimmed.indexOf(':');
+    if (colonIndex === -1) continue;
+    const key = trimmed.substring(0, colonIndex).trim();
+    const value = trimmed.substring(colonIndex + 1).trim();
+    if (key) entries.push({ key, value });
+  }
+  return entries;
+}
+
+function serializeYaml(entries: ConfigEntry[], originalContent?: string): string {
+  if (!originalContent) {
+    return entries.map((e) => `${e.key}: ${e.value}`).join('\n') + '\n';
+  }
+
+  const entryMap = new Map(entries.map((e) => [e.key, e.value]));
+  const lines = originalContent.split('\n');
+  const result: string[] = [];
+  const written = new Set<string>();
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#') || line.startsWith(' ') || line.startsWith('\t')) {
+      result.push(line);
+      continue;
+    }
+    const colonIndex = trimmed.indexOf(':');
+    if (colonIndex === -1) {
+      result.push(line);
+      continue;
+    }
+    const key = trimmed.substring(0, colonIndex).trim();
+    if (entryMap.has(key)) {
+      result.push(`${key}: ${entryMap.get(key)}`);
+      written.add(key);
+    } else {
+      result.push(line);
+    }
+  }
+
+  for (const entry of entries) {
+    if (!written.has(entry.key)) {
+      result.push(`${entry.key}: ${entry.value}`);
+    }
+  }
+
+  return result.join('\n');
+}
+
+// === KeyValue (Source engine cfg: `key "value"` or `key value`) ===
+
+function parseKeyValue(content: string): ConfigEntry[] {
+  const entries: ConfigEntry[] = [];
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('//')) continue;
+
+    // Match: key "value" or key value
+    const match = trimmed.match(/^(\S+)\s+"([^"]*)"/) || trimmed.match(/^(\S+)\s+(.*)/);
+    if (match && match[1] && match[2] !== undefined) {
+      entries.push({ key: match[1], value: match[2] });
+    }
+  }
+  return entries;
+}
+
+function serializeKeyValue(entries: ConfigEntry[], originalContent?: string): string {
+  if (!originalContent) {
+    return entries.map((e) => `${e.key} "${e.value}"`).join('\n') + '\n';
+  }
+
+  const entryMap = new Map(entries.map((e) => [e.key, e.value]));
+  const lines = originalContent.split('\n');
+  const result: string[] = [];
+  const written = new Set<string>();
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('//')) {
+      result.push(line);
+      continue;
+    }
+    const match = trimmed.match(/^(\S+)\s+/);
+    const matchKey = match?.[1];
+    if (matchKey && entryMap.has(matchKey)) {
+      result.push(`${matchKey} "${entryMap.get(matchKey)}"`);
+      written.add(matchKey);
+    } else {
+      result.push(line);
+    }
+  }
+
+  for (const entry of entries) {
+    if (!written.has(entry.key)) {
+      result.push(`${entry.key} "${entry.value}"`);
+    }
+  }
+
+  return result.join('\n');
+}

apps/api/src/lib/spiget.ts

@@ -0,0 +1,56 @@
+const SPIGET_BASE = 'https://api.spiget.org/v2';
+
+export interface SpigetResource {
+  id: number;
+  name: string;
+  tag: string;
+  icon: { url: string; data: string };
+  releaseDate: number;
+  updateDate: number;
+  downloads: number;
+  rating: { average: number; count: number };
+  file: { type: string; size: number; url: string };
+  version: { id: number };
+  external: boolean;
+}
+
+export interface SpigetVersion {
+  id: number;
+  name: string;
+  releaseDate: number;
+  downloads: number;
+  url: string;
+}
+
+export async function searchSpigetPlugins(
+  query: string,
+  page = 1,
+  size = 20,
+): Promise<SpigetResource[]> {
+  const res = await fetch(
+    `${SPIGET_BASE}/search/resources/${encodeURIComponent(query)}?size=${size}&page=${page}&sort=-downloads`,
+    { headers: { 'User-Agent': 'GamePanel/1.0' } },
+  );
+  if (!res.ok) return [];
+  return res.json() as Promise<SpigetResource[]>;
+}
+
+export async function getSpigetResource(id: number): Promise<SpigetResource | null> {
+  const res = await fetch(`${SPIGET_BASE}/resources/${id}`, {
+    headers: { 'User-Agent': 'GamePanel/1.0' },
+  });
+  if (!res.ok) return null;
+  return res.json() as Promise<SpigetResource>;
+}
+
+export async function getSpigetVersions(resourceId: number): Promise<SpigetVersion[]> {
+  const res = await fetch(`${SPIGET_BASE}/resources/${resourceId}/versions?sort=-releaseDate`, {
+    headers: { 'User-Agent': 'GamePanel/1.0' },
+  });
+  if (!res.ok) return [];
+  return res.json() as Promise<SpigetVersion[]>;
+}
+
+export function getSpigetDownloadUrl(resourceId: number): string {
+  return `${SPIGET_BASE}/resources/${resourceId}/download`;
+}

apps/api/src/routes/servers/config.ts

@@ -0,0 +1,145 @@
+import type { FastifyInstance } from 'fastify';
+import { eq, and } from 'drizzle-orm';
+import { Type } from '@sinclair/typebox';
+import { servers, games } from '@source/database';
+import type { GameConfigFile, ConfigParser } from '@source/shared';
+import { AppError } from '../../lib/errors.js';
+import { requirePermission } from '../../lib/permissions.js';
+import { parseConfig, serializeConfig } from '../../lib/config-parsers.js';
+
+const ParamSchema = {
+  params: Type.Object({
+    orgId: Type.String({ format: 'uuid' }),
+    serverId: Type.String({ format: 'uuid' }),
+  }),
+};
+
+const ConfigFileParamSchema = {
+  params: Type.Object({
+    orgId: Type.String({ format: 'uuid' }),
+    serverId: Type.String({ format: 'uuid' }),
+    configIndex: Type.Number({ minimum: 0 }),
+  }),
+};
+
+export default async function configRoutes(app: FastifyInstance) {
+  app.addHook('onRequest', app.authenticate);
+
+  // GET /config — list available config files for this server's game
+  app.get('/', { schema: ParamSchema }, async (request) => {
+    const { orgId, serverId } = request.params as { orgId: string; serverId: string };
+    await requirePermission(request, orgId, 'config.read');
+
+    const server = await app.db.query.servers.findFirst({
+      where: and(eq(servers.id, serverId), eq(servers.organizationId, orgId)),
+    });
+    if (!server) throw AppError.notFound('Server not found');
+
+    const game = await app.db.query.games.findFirst({
+      where: eq(games.id, server.gameId),
+    });
+    if (!game) throw AppError.notFound('Game not found');
+
+    const configFiles = (game.configFiles as GameConfigFile[]) || [];
+    return {
+      configs: configFiles.map((cf, index) => ({
+        index,
+        path: cf.path,
+        parser: cf.parser,
+        editableKeys: cf.editableKeys ?? null,
+      })),
+    };
+  });
+
+  // GET /config/:configIndex — read & parse a specific config file
+  app.get('/:configIndex', { schema: ConfigFileParamSchema }, async (request) => {
+    const { orgId, serverId, configIndex } = request.params as {
+      orgId: string;
+      serverId: string;
+      configIndex: number;
+    };
+    await requirePermission(request, orgId, 'config.read');
+
+    const { game, server, configFile } = await getServerConfig(app, orgId, serverId, configIndex);
+
+    // TODO: Read file from daemon via gRPC
+    // For now, return empty parsed result (will be connected in Phase 4 integration)
+    return {
+      path: configFile.path,
+      parser: configFile.parser,
+      editableKeys: configFile.editableKeys ?? null,
+      entries: [],
+      raw: '',
+    };
+  });
+
+  // PUT /config/:configIndex — update a config file
+  app.put(
+    '/:configIndex',
+    {
+      schema: {
+        ...ConfigFileParamSchema,
+        body: Type.Object({
+          entries: Type.Array(
+            Type.Object({
+              key: Type.String(),
+              value: Type.String(),
+            }),
+          ),
+        }),
+      },
+    },
+    async (request) => {
+      const { orgId, serverId, configIndex } = request.params as {
+        orgId: string;
+        serverId: string;
+        configIndex: number;
+      };
+      const { entries } = request.body as { entries: { key: string; value: string }[] };
+      await requirePermission(request, orgId, 'config.write');
+
+      const { configFile } = await getServerConfig(app, orgId, serverId, configIndex);
+
+      // If editableKeys is set, only allow those keys
+      if (configFile.editableKeys && configFile.editableKeys.length > 0) {
+        const allowedKeys = new Set(configFile.editableKeys);
+        const invalidKeys = entries.filter((e) => !allowedKeys.has(e.key));
+        if (invalidKeys.length > 0) {
+          throw AppError.badRequest(
+            `Keys not allowed: ${invalidKeys.map((k) => k.key).join(', ')}`,
+          );
+        }
+      }
+
+      // Serialize the entries
+      const content = serializeConfig(entries, configFile.parser as ConfigParser);
+
+      // TODO: Write file to daemon via gRPC
+      // For now, just return success
+      return { success: true, path: configFile.path, content };
+    },
+  );
+}
+
+async function getServerConfig(
+  app: FastifyInstance,
+  orgId: string,
+  serverId: string,
+  configIndex: number,
+) {
+  const server = await app.db.query.servers.findFirst({
+    where: and(eq(servers.id, serverId), eq(servers.organizationId, orgId)),
+  });
+  if (!server) throw AppError.notFound('Server not found');
+
+  const game = await app.db.query.games.findFirst({
+    where: eq(games.id, server.gameId),
+  });
+  if (!game) throw AppError.notFound('Game not found');
+
+  const configFiles = (game.configFiles as GameConfigFile[]) || [];
+  const configFile = configFiles[configIndex];
+  if (!configFile) throw AppError.notFound('Config file not found');
+
+  return { game, server, configFile };
+}

apps/api/src/routes/servers/index.ts

@@ -13,10 +13,16 @@ import {
   UpdateServerSchema,
   PowerActionSchema,
 } from './schemas.js';
+import configRoutes from './config.js';
+import pluginRoutes from './plugins.js';
 
 export default async function serverRoutes(app: FastifyInstance) {
   app.addHook('onRequest', app.authenticate);
 
+  // Register sub-routes for config and plugins
+  await app.register(configRoutes, { prefix: '/:serverId/config' });
+  await app.register(pluginRoutes, { prefix: '/:serverId/plugins' });
+
   // GET /api/organizations/:orgId/servers
   app.get('/', { schema: { querystring: PaginationQuerySchema } }, async (request) => {
     const { orgId } = request.params as { orgId: string };

apps/api/src/routes/servers/plugins.ts

@@ -0,0 +1,336 @@
+import type { FastifyInstance } from 'fastify';
+import { eq, and } from 'drizzle-orm';
+import { Type } from '@sinclair/typebox';
+import { servers, plugins, serverPlugins, games } from '@source/database';
+import { AppError } from '../../lib/errors.js';
+import { requirePermission } from '../../lib/permissions.js';
+import { createAuditLog } from '../../lib/audit.js';
+import {
+  searchSpigetPlugins,
+  getSpigetResource,
+  getSpigetDownloadUrl,
+} from '../../lib/spiget.js';
+
+const ParamSchema = {
+  params: Type.Object({
+    orgId: Type.String({ format: 'uuid' }),
+    serverId: Type.String({ format: 'uuid' }),
+  }),
+};
+
+export default async function pluginRoutes(app: FastifyInstance) {
+  app.addHook('onRequest', app.authenticate);
+
+  // GET /plugins — list installed plugins for this server
+  app.get('/', { schema: ParamSchema }, async (request) => {
+    const { orgId, serverId } = request.params as { orgId: string; serverId: string };
+    await requirePermission(request, orgId, 'plugin.read');
+
+    const server = await app.db.query.servers.findFirst({
+      where: and(eq(servers.id, serverId), eq(servers.organizationId, orgId)),
+    });
+    if (!server) throw AppError.notFound('Server not found');
+
+    const installed = await app.db
+      .select({
+        id: serverPlugins.id,
+        pluginId: serverPlugins.pluginId,
+        installedVersion: serverPlugins.installedVersion,
+        isActive: serverPlugins.isActive,
+        installedAt: serverPlugins.installedAt,
+        name: plugins.name,
+        slug: plugins.slug,
+        description: plugins.description,
+        source: plugins.source,
+        externalId: plugins.externalId,
+      })
+      .from(serverPlugins)
+      .innerJoin(plugins, eq(serverPlugins.pluginId, plugins.id))
+      .where(eq(serverPlugins.serverId, serverId));
+
+    return { plugins: installed };
+  });
+
+  // GET /plugins/search — search Spiget for Minecraft plugins
+  app.get(
+    '/search',
+    {
+      schema: {
+        ...ParamSchema,
+        querystring: Type.Object({
+          q: Type.String({ minLength: 2 }),
+          page: Type.Optional(Type.Number({ minimum: 1, default: 1 })),
+        }),
+      },
+    },
+    async (request) => {
+      const { orgId, serverId } = request.params as { orgId: string; serverId: string };
+      const { q, page } = request.query as { q: string; page?: number };
+      await requirePermission(request, orgId, 'plugin.manage');
+
+      // Verify server exists and is Minecraft
+      const server = await app.db.query.servers.findFirst({
+        where: and(eq(servers.id, serverId), eq(servers.organizationId, orgId)),
+      });
+      if (!server) throw AppError.notFound('Server not found');
+
+      const game = await app.db.query.games.findFirst({
+        where: eq(games.id, server.gameId),
+      });
+      if (!game) throw AppError.notFound('Game not found');
+
+      if (game.slug !== 'minecraft-java') {
+        throw AppError.badRequest('Spiget search is only available for Minecraft: Java Edition');
+      }
+
+      const results = await searchSpigetPlugins(q, page ?? 1);
+      return {
+        results: results.map((r) => ({
+          id: r.id,
+          name: r.name,
+          tag: r.tag,
+          downloads: r.downloads,
+          rating: r.rating,
+          updateDate: r.updateDate,
+          external: r.external,
+        })),
+      };
+    },
+  );
+
+  // POST /plugins/install/spiget — install a plugin from Spiget
+  app.post(
+    '/install/spiget',
+    {
+      schema: {
+        ...ParamSchema,
+        body: Type.Object({
+          resourceId: Type.Number(),
+        }),
+      },
+    },
+    async (request) => {
+      const { orgId, serverId } = request.params as { orgId: string; serverId: string };
+      const { resourceId } = request.body as { resourceId: number };
+      await requirePermission(request, orgId, 'plugin.manage');
+
+      const server = await app.db.query.servers.findFirst({
+        where: and(eq(servers.id, serverId), eq(servers.organizationId, orgId)),
+      });
+      if (!server) throw AppError.notFound('Server not found');
+
+      const game = await app.db.query.games.findFirst({
+        where: eq(games.id, server.gameId),
+      });
+      if (!game) throw AppError.notFound('Game not found');
+
+      // Fetch resource info from Spiget
+      const resource = await getSpigetResource(resourceId);
+      if (!resource) throw AppError.notFound('Spiget resource not found');
+
+      // Create or find plugin entry
+      let plugin = await app.db.query.plugins.findFirst({
+        where: and(
+          eq(plugins.gameId, game.id),
+          eq(plugins.externalId, String(resourceId)),
+          eq(plugins.source, 'spiget'),
+        ),
+      });
+
+      if (!plugin) {
+        const [created] = await app.db
+          .insert(plugins)
+          .values({
+            gameId: game.id,
+            name: resource.name,
+            slug: resource.name
+              .toLowerCase()
+              .replace(/[^a-z0-9]+/g, '-')
+              .slice(0, 200),
+            description: resource.tag || null,
+            source: 'spiget',
+            externalId: String(resourceId),
+            downloadUrl: getSpigetDownloadUrl(resourceId),
+            version: null,
+          })
+          .returning();
+        plugin = created!;
+      }
+
+      // Check if already installed
+      const existing = await app.db.query.serverPlugins.findFirst({
+        where: and(
+          eq(serverPlugins.serverId, serverId),
+          eq(serverPlugins.pluginId, plugin.id),
+        ),
+      });
+      if (existing) throw AppError.conflict('Plugin is already installed');
+
+      // Install
+      const [installed] = await app.db
+        .insert(serverPlugins)
+        .values({
+          serverId,
+          pluginId: plugin.id,
+          installedVersion: resource.version ? String(resource.version.id) : null,
+          isActive: true,
+        })
+        .returning();
+
+      // TODO: Send gRPC command to daemon to download the plugin file to /data/plugins/
+      // downloadUrl: getSpigetDownloadUrl(resourceId)
+
+      await createAuditLog(app.db, request, {
+        organizationId: orgId,
+        serverId,
+        action: 'plugin.install',
+        metadata: { name: resource.name, source: 'spiget', resourceId },
+      });
+
+      return installed;
+    },
+  );
+
+  // POST /plugins/install/manual — install a plugin manually (upload)
+  app.post(
+    '/install/manual',
+    {
+      schema: {
+        ...ParamSchema,
+        body: Type.Object({
+          name: Type.String({ minLength: 1 }),
+          fileName: Type.String({ minLength: 1 }),
+          version: Type.Optional(Type.String()),
+        }),
+      },
+    },
+    async (request) => {
+      const { orgId, serverId } = request.params as { orgId: string; serverId: string };
+      const { name, fileName, version } = request.body as {
+        name: string;
+        fileName: string;
+        version?: string;
+      };
+      await requirePermission(request, orgId, 'plugin.manage');
+
+      const server = await app.db.query.servers.findFirst({
+        where: and(eq(servers.id, serverId), eq(servers.organizationId, orgId)),
+      });
+      if (!server) throw AppError.notFound('Server not found');
+
+      const [plugin] = await app.db
+        .insert(plugins)
+        .values({
+          gameId: server.gameId,
+          name,
+          slug: name
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, '-')
+            .slice(0, 200),
+          source: 'manual',
+          version: version ?? null,
+        })
+        .returning();
+
+      const [installed] = await app.db
+        .insert(serverPlugins)
+        .values({
+          serverId,
+          pluginId: plugin!.id,
+          installedVersion: version ?? null,
+          isActive: true,
+        })
+        .returning();
+
+      await createAuditLog(app.db, request, {
+        organizationId: orgId,
+        serverId,
+        action: 'plugin.install',
+        metadata: { name, source: 'manual', fileName },
+      });
+
+      return installed;
+    },
+  );
+
+  // DELETE /plugins/:pluginInstallId — uninstall a plugin
+  app.delete(
+    '/:pluginInstallId',
+    {
+      schema: {
+        params: Type.Object({
+          orgId: Type.String({ format: 'uuid' }),
+          serverId: Type.String({ format: 'uuid' }),
+          pluginInstallId: Type.String({ format: 'uuid' }),
+        }),
+      },
+    },
+    async (request, reply) => {
+      const { orgId, serverId, pluginInstallId } = request.params as {
+        orgId: string;
+        serverId: string;
+        pluginInstallId: string;
+      };
+      await requirePermission(request, orgId, 'plugin.manage');
+
+      const installed = await app.db.query.serverPlugins.findFirst({
+        where: and(
+          eq(serverPlugins.id, pluginInstallId),
+          eq(serverPlugins.serverId, serverId),
+        ),
+      });
+      if (!installed) throw AppError.notFound('Plugin installation not found');
+
+      await app.db.delete(serverPlugins).where(eq(serverPlugins.id, pluginInstallId));
+
+      // TODO: Send gRPC to daemon to delete the plugin file from /data/plugins/
+
+      await createAuditLog(app.db, request, {
+        organizationId: orgId,
+        serverId,
+        action: 'plugin.uninstall',
+        metadata: { pluginInstallId },
+      });
+
+      return reply.code(204).send();
+    },
+  );
+
+  // PATCH /plugins/:pluginInstallId/toggle — enable/disable a plugin
+  app.patch(
+    '/:pluginInstallId/toggle',
+    {
+      schema: {
+        params: Type.Object({
+          orgId: Type.String({ format: 'uuid' }),
+          serverId: Type.String({ format: 'uuid' }),
+          pluginInstallId: Type.String({ format: 'uuid' }),
+        }),
+      },
+    },
+    async (request) => {
+      const { orgId, serverId, pluginInstallId } = request.params as {
+        orgId: string;
+        serverId: string;
+        pluginInstallId: string;
+      };
+      await requirePermission(request, orgId, 'plugin.manage');
+
+      const installed = await app.db.query.serverPlugins.findFirst({
+        where: and(
+          eq(serverPlugins.id, pluginInstallId),
+          eq(serverPlugins.serverId, serverId),
+        ),
+      });
+      if (!installed) throw AppError.notFound('Plugin installation not found');
+
+      const [updated] = await app.db
+        .update(serverPlugins)
+        .set({ isActive: !installed.isActive })
+        .where(eq(serverPlugins.id, pluginInstallId))
+        .returning();
+
+      return updated;
+    },
+  );
+}