fix(plugin): enforce the catalog allow-list continuously and scope GitHub by owner

An organization's plugin catalog allow-list was only checked when a catalog
was first added, so a catalog added before a policy was published kept
working forever. The allow-list is now applied every time the catalog
registry loads: a catalog whose source is no longer permitted is disabled
and excluded from search, browse, install, and resolution, with a clear
warning explaining why. Disabled catalogs are still listed (marked
disabled) and can still be removed, and the official and organization-
managed catalogs are never disabled. With no allow-list configured nothing
changes.

Allow-list entries can now scope GitHub sources by owner or repository
(github.com/<owner>/*, github.com/<owner>, or github.com/<owner>/<repo>)
instead of authorizing every GitHub repository at once. A plain
raw.githubusercontent.com host entry no longer blanket-authorizes GitHub,
so the scoping is meaningful; local-only and non-GitHub host rules are
unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: scotwells

internal/cmd/plugin/browse.go

@@ -58,12 +58,16 @@ func browseCmd() *cobra.Command {
 				return fmt.Errorf("load catalog registry: %w", err)
 			}
 
-			catalogs := reg.Catalogs
+			warnDisabledCatalogs(cmd.ErrOrStderr(), reg)
+			catalogs := reg.Active()
 			if indexName != "" {
 				cat := reg.Find(indexName)
 				if cat == nil {
 					return customerrors.NewUserError(fmt.Sprintf("catalog %q is not registered", indexName))
 				}
+				if cat.Disabled {
+					return customerrors.NewUserError(fmt.Sprintf("catalog %q is disabled: %s", indexName, cat.DisabledReason))
+				}
 				catalogs = []pluginstore.Catalog{*cat}
 			}
 

internal/cmd/plugin/catalog_resolve.go

@@ -2,6 +2,7 @@ package plugin
 
 import (
 	"fmt"
+	"io"
 	"runtime"
 	"strings"
 
@@ -10,6 +11,18 @@ import (
 	"go.datum.net/datumctl/internal/pluginstore"
 )
 
+// warnDisabledCatalogs prints a one-line warning for each catalog an active
+// enterprise allow-list has disabled, so a catalog that silently stops being
+// used is explained rather than appearing to vanish. Each disabled catalog is
+// named once. It is the single user-facing chokepoint for this notice; the
+// commands that resolve/search/install/browse call it after loading the
+// registry, then operate on reg.Active().
+func warnDisabledCatalogs(w io.Writer, reg *pluginstore.Registry) {
+	for _, c := range reg.DisabledCatalogs() {
+		fmt.Fprintf(w, "warning: catalog %q is disabled — %s\n", c.Name, c.DisabledReason)
+	}
+}
+
 // pluginBinaryPrefixes are the recognized datumctl plugin binary prefixes, in
 // preference order. "milo-" identifies portable milo-os platform plugins;
 // "datumctl-" identifies datumctl-native plugins.
@@ -63,8 +76,9 @@ func loadOrRefreshCatalog(cmd *cobra.Command, pluginsDir string, cat pluginstore
 // is skipped with a warning rather than failing the whole resolution.
 func resolveBareName(cmd *cobra.Command, pluginsDir string, reg *pluginstore.Registry, name string) []catalogMatch {
 	var matches []catalogMatch
-	for i := range reg.Catalogs {
-		cat := reg.Catalogs[i]
+	active := reg.Active()
+	for i := range active {
+		cat := active[i]
 		idx, err := loadOrRefreshCatalog(cmd, pluginsDir, cat)
 		if err != nil {
 			fmt.Fprintf(cmd.ErrOrStderr(), "warning: skipping catalog %q: %v\n", cat.Name, err)

internal/cmd/plugin/index.go

@@ -206,6 +206,11 @@ func indexListCmd() *cobra.Command {
 			var wg sync.WaitGroup
 			for i := range reg.Catalogs {
 				cat := reg.Catalogs[i]
+				if cat.Disabled {
+					// A disabled catalog is excluded from use; don't fetch it. It is
+					// still listed below, marked disabled, so the state is visible.
+					continue
+				}
 				cached, _ := pluginstore.LoadCatalogIndex(pluginsDir, cat.Name)
 				if !pluginstore.IsStale(cached) {
 					indexes[i] = cached
@@ -237,6 +242,17 @@ func indexListCmd() *cobra.Command {
 						desc = idx.Header.Description
 					}
 				}
+				if cat.Disabled {
+					// Mark a disabled catalog inline so the user understands why it no
+					// longer participates in search/install rather than seeing it vanish.
+					count = "—"
+					marker := "(disabled: not in allow-list)"
+					if desc != "" {
+						desc = marker + " " + desc
+					} else {
+						desc = marker
+					}
+				}
 				fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", cat.Name, cat.Type, count, cat.Trust(), desc)
 			}
 			return w.Flush()
@@ -329,15 +345,21 @@ func indexUpdateCmd() *cobra.Command {
 				return fmt.Errorf("load catalog registry: %w", err)
 			}
 
+			warnDisabledCatalogs(cmd.ErrOrStderr(), reg)
+
 			var targets []pluginstore.Catalog
 			if len(args) == 1 {
 				cat := reg.Find(args[0])
 				if cat == nil {
 					return customerrors.NewUserError(fmt.Sprintf("catalog %q is not registered", args[0]))
 				}
+				if cat.Disabled {
+					return customerrors.NewUserError(fmt.Sprintf("catalog %q is disabled: %s", args[0], cat.DisabledReason))
+				}
 				targets = []pluginstore.Catalog{*cat}
 			} else {
-				targets = reg.Catalogs
+				// Disabled catalogs are excluded from use, so don't refresh them.
+				targets = reg.Active()
 			}
 
 			var failures int

internal/cmd/plugin/index_test.go

@@ -317,6 +317,82 @@ func TestIndexRemove_managedRejected(t *testing.T) {
 	}
 }
 
+// registerLocalCatalog persists a single user catalog pointing at a local
+// manifest, bypassing the `add` allow-list gate, so load-time enforcement can be
+// exercised on its own.
+func registerLocalCatalog(t *testing.T, pluginsDir, name string) {
+	t.Helper()
+	src := writeLocalCatalog(t, testCatalogManifest)
+	if err := pluginstore.SaveRegistry(pluginsDir, &pluginstore.Registry{Catalogs: []pluginstore.Catalog{
+		{Name: name, Source: src, Type: pluginstore.CatalogTypeCustom},
+	}}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestIndexList_showsDisabledCatalog(t *testing.T) {
+	pluginsDir := t.TempDir()
+	seedFreshCache(t, pluginsDir, "datum", testPlugin("dns", "v1.2.3", "Manage DNS zones"))
+	registerLocalCatalog(t, pluginsDir, "acme")
+
+	// An allow-list that does not cover acme disables it at load time.
+	t.Setenv("DATUMCTL_PLUGIN_ALLOWED_INDEXES", "approved-only")
+	out, err := runIndex(t, pluginsDir, "", "list")
+	if err != nil {
+		t.Fatalf("list must not fail with a disabled catalog: %v", err)
+	}
+	if !strings.Contains(out, "acme") {
+		t.Fatalf("disabled catalog must still be listed: %s", out)
+	}
+	for _, line := range strings.Split(out, "\n") {
+		if strings.HasPrefix(line, "acme") && !strings.Contains(line, "disabled") {
+			t.Fatalf("acme row should be marked disabled, got: %q", line)
+		}
+	}
+}
+
+func TestIndexRemove_removesDisabledCatalog(t *testing.T) {
+	pluginsDir := t.TempDir()
+	registerLocalCatalog(t, pluginsDir, "acme")
+	t.Setenv("DATUMCTL_PLUGIN_ALLOWED_INDEXES", "approved-only")
+
+	// A disabled catalog can still be cleaned up.
+	out, err := runIndex(t, pluginsDir, "", "remove", "acme")
+	if err != nil {
+		t.Fatalf("removing a disabled catalog should succeed: %v", err)
+	}
+	if !strings.Contains(out, "Removed catalog acme") {
+		t.Fatalf("unexpected output: %s", out)
+	}
+	if reg, _ := pluginstore.LoadRegistry(pluginsDir); reg.Find("acme") != nil {
+		t.Fatal("acme should be gone after remove")
+	}
+}
+
+func TestSearch_excludesDisabledCatalogAndWarns(t *testing.T) {
+	pluginsDir := t.TempDir()
+	seedFreshCache(t, pluginsDir, "datum", testPlugin("dns", "v1.2.3", "Manage DNS zones"))
+	registerLocalCatalog(t, pluginsDir, "acme")
+	// Pre-seed acme's cache with its "deploy" plugin so a network fetch isn't
+	// needed to prove it would otherwise appear.
+	seedFreshCache(t, pluginsDir, "acme", testPlugin("deploy", "v2.1.0", "ACME guided deploy"))
+	t.Setenv("DATUMCTL_PLUGIN_ALLOWED_INDEXES", "approved-only")
+
+	out, err := execPluginCmd(t, pluginsDir, searchCmd())
+	if err != nil {
+		t.Fatalf("search must not fail: %v", err)
+	}
+	if !strings.Contains(out, "dns") {
+		t.Fatalf("the permitted datum catalog's plugin should appear: %s", out)
+	}
+	if strings.Contains(out, "deploy") {
+		t.Fatalf("a disabled catalog's plugin must not appear in search: %s", out)
+	}
+	if !strings.Contains(out, "disabled") || !strings.Contains(out, "acme") {
+		t.Fatalf("search should warn that acme is disabled: %s", out)
+	}
+}
+
 func TestIndexValidate_goodAndBad(t *testing.T) {
 	pluginsDir := t.TempDir()
 

internal/cmd/plugin/install.go

@@ -74,6 +74,7 @@ The plugin binary is written to the managed plugins directory
 			if err != nil {
 				return fmt.Errorf("load catalog registry: %w", err)
 			}
+			warnDisabledCatalogs(cmd.ErrOrStderr(), reg)
 			return installArg(cmd, pluginsDir, reg, args[0], currentVersion)
 		},
 	}
@@ -182,6 +183,9 @@ func installFromCatalog(cmd *cobra.Command, pluginsDir string, reg *pluginstore.
 	if cat == nil {
 		return customerrors.NewUserError(fmt.Sprintf("catalog %q is not registered; run 'datumctl plugin index add %s <source>' first", catalogName, catalogName))
 	}
+	if cat.Disabled {
+		return customerrors.NewUserError(fmt.Sprintf("catalog %q is disabled: %s", catalogName, cat.DisabledReason))
+	}
 	idx, err := loadOrRefreshCatalog(cmd, pluginsDir, *cat)
 	if err != nil {
 		return indexFetchUserError(err)
@@ -262,6 +266,7 @@ func installAllFromManifest(cmd *cobra.Command, pluginsDir, currentVersion strin
 	if err != nil {
 		return fmt.Errorf("load catalog registry: %w", err)
 	}
+	warnDisabledCatalogs(cmd.ErrOrStderr(), reg)
 
 	// Lazily load+refresh each catalog index, memoized by catalog name.
 	indexCache := map[string]*pluginstore.CachedIndex{}
@@ -273,6 +278,9 @@ func installAllFromManifest(cmd *cobra.Command, pluginsDir, currentVersion strin
 		if cat == nil {
 			return nil, fmt.Errorf("catalog %q is no longer registered", catalogName)
 		}
+		if cat.Disabled {
+			return nil, fmt.Errorf("catalog %q is disabled: %s", catalogName, cat.DisabledReason)
+		}
 		idx, loadErr := loadOrRefreshCatalog(cmd, pluginsDir, *cat)
 		if loadErr != nil {
 			return nil, loadErr

internal/cmd/plugin/search.go

@@ -47,12 +47,16 @@ func searchCmd() *cobra.Command {
 				return fmt.Errorf("load catalog registry: %w", err)
 			}
 
-			catalogs := reg.Catalogs
+			warnDisabledCatalogs(cmd.ErrOrStderr(), reg)
+			catalogs := reg.Active()
 			if indexName != "" {
 				cat := reg.Find(indexName)
 				if cat == nil {
 					return customerrors.NewUserError(fmt.Sprintf("catalog %q is not registered", indexName))
 				}
+				if cat.Disabled {
+					return customerrors.NewUserError(fmt.Sprintf("catalog %q is disabled: %s", indexName, cat.DisabledReason))
+				}
 				catalogs = []pluginstore.Catalog{*cat}
 			}
 

internal/pluginstore/catalog.go

@@ -84,6 +84,15 @@ type Catalog struct {
 	// Managed catalogs are not persisted to indexes.json and cannot be removed
 	// by the user. Not serialized.
 	Managed bool `json:"-"`
+
+	// Disabled marks a catalog whose source is no longer permitted by an active
+	// enterprise allow-list. A disabled catalog is still shown by `index list`
+	// and can be removed, but is excluded from resolve, search, install, and
+	// browse. Set at load time by ApplyAllowList. Not serialized.
+	Disabled bool `json:"-"`
+	// DisabledReason is the human-readable reason a catalog is disabled. Not
+	// serialized.
+	DisabledReason string `json:"-"`
 }
 
 // IsOfficial reports whether this is the reserved official catalog.
@@ -130,6 +139,31 @@ func (r *Registry) Find(name string) *Catalog {
 	return nil
 }
 
+// Active returns the catalogs available for resolve, search, install, and
+// browse — every registered catalog except those an active allow-list has
+// disabled.
+func (r *Registry) Active() []Catalog {
+	out := make([]Catalog, 0, len(r.Catalogs))
+	for _, c := range r.Catalogs {
+		if !c.Disabled {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+// DisabledCatalogs returns the catalogs an active allow-list has disabled, each
+// listed once. Used to explain to the user why a catalog stopped being used.
+func (r *Registry) DisabledCatalogs() []Catalog {
+	var out []Catalog
+	for _, c := range r.Catalogs {
+		if c.Disabled {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
 // Custom returns the user-registered catalogs (excludes default and managed).
 // These are the entries persisted to indexes.json.
 func (r *Registry) Custom() []Catalog {
@@ -240,9 +274,42 @@ func LoadRegistry(pluginsDir string) (*Registry, error) {
 		add(c)
 	}
 
+	// Enforce the allow-list as an ongoing guardrail, not just an onboarding
+	// gate: a user-registered catalog whose source is no longer permitted is
+	// marked disabled so it is excluded from use.
+	reg.ApplyAllowList(managed)
+
 	return reg, nil
 }
 
+// allowListDisabledReason explains why a catalog was disabled by ApplyAllowList.
+const allowListDisabledReason = "its source is no longer permitted by your organization's plugin catalog allow-list"
+
+// ApplyAllowList marks every user-registered catalog whose source is not
+// permitted by an active allow-list as disabled and returns the disabled
+// catalogs. The official catalog and managed pre-seeds are admin-controlled and
+// are never disabled. When no allow-list is configured nothing is disabled, so
+// the common default case is unchanged. LoadRegistry calls this so enforcement
+// is centralized at load time rather than only at `index add`.
+func (r *Registry) ApplyAllowList(m *ManagedConfig) []Catalog {
+	if m == nil || !m.Enforced() {
+		return nil
+	}
+	var disabled []Catalog
+	for i := range r.Catalogs {
+		c := &r.Catalogs[i]
+		if c.Managed || CanonicalCatalogName(c.Name) == OfficialCatalogName {
+			continue
+		}
+		if !m.IsAllowed(c.Name, c.Source) {
+			c.Disabled = true
+			c.DisabledReason = allowListDisabledReason
+			disabled = append(disabled, *c)
+		}
+	}
+	return disabled
+}
+
 // SaveRegistry persists only the user-registered catalogs (default and managed
 // entries are never written to disk).
 func SaveRegistry(pluginsDir string, reg *Registry) error {
@@ -382,3 +449,31 @@ func SourceHost(source string) string {
 	}
 	return u.Hostname()
 }
+
+// SourceGitHubOwnerRepo returns the GitHub "owner/repo" a catalog source
+// targets, for any of the forms that resolve to GitHub: the "owner/repo" (and
+// "github.com/owner/repo") shorthand, and a full raw.githubusercontent.com
+// manifest URL. ok is false for non-GitHub sources. Used to scope GitHub
+// allow-list entries by owner/repo.
+func SourceGitHubOwnerRepo(source string) (ownerRepo string, ok bool) {
+	resolved, err := ResolveCatalogSource(source)
+	if err != nil || resolved.IsLocal {
+		return "", false
+	}
+	if resolved.GitHubOwnerRepo != "" {
+		return resolved.GitHubOwnerRepo, true
+	}
+	u, err := url.Parse(resolved.FetchURL)
+	if err != nil {
+		return "", false
+	}
+	host := strings.ToLower(u.Hostname())
+	if host != "raw.githubusercontent.com" && host != "github.com" {
+		return "", false
+	}
+	parts := strings.SplitN(strings.TrimPrefix(u.Path, "/"), "/", 3)
+	if len(parts) >= 2 && parts[0] != "" && parts[1] != "" {
+		return parts[0] + "/" + parts[1], true
+	}
+	return "", false
+}