feat: instead of exposing auth headers, offer a http proxy api for plugins

lib/plugin-api.ts

@@ -129,8 +129,8 @@ export interface PluginAPI {
     info: (message: string) => void;
     warning: (message: string) => void;
   };
-  auth: {
+  http: {
-    getHeaders: () => Record<string, string>;
+    post: (path: string, body: Record<string, unknown>) => Promise<{ ok: boolean; status: number; data: unknown }>;
   };
   storage: ReturnType<typeof createPluginStorage>;
   log: ReturnType<typeof createPluginLogger>;
@@ -644,15 +644,25 @@ export function createPluginAPI(plugin: InstalledPlugin): PluginAPI {
       warning: (message: string) => appToast.warning(message),
     },
 
-    auth: {
+    http: {
-      getHeaders: (): Record<string, string> => {
+      post: async (path: string, body: Record<string, unknown>) => {
-        requirePermission(plugin, 'auth:read');
+        requirePermission(plugin, 'http:post');
+        if (typeof path !== 'string' || !path.startsWith('/')) {
+          throw new Error('path must be an absolute path starting with /');
+        }
         const { client } = useAuthStore.getState();
-        if (!client) return {};
+        const headers: Record<string, string> = { 'Content-Type': 'application/json' };
-        return {
+        if (client) {
-          'Authorization': client.getAuthHeader(),
+          headers['Authorization'] = client.getAuthHeader();
-          'X-JMAP-Username': client.getUsername(),
+          headers['X-JMAP-Username'] = client.getUsername();
-        };
+        }
+        const res = await fetch(path, {
+          method: 'POST',
+          headers,
+          body: JSON.stringify(body),
+        });
+        const data = await res.json().catch(() => null);
+        return { ok: res.ok, status: res.status, data };
       },
     },
 

lib/plugin-types.ts

@@ -401,7 +401,8 @@ export const ALL_PERMISSIONS = [
   'vacation:read', 'vacation:write',
   'settings:read', 'settings:write',
   'security:read',
-  'auth:observe', 'auth:read',
+  'auth:observe',
+  'http:post',
   'ui:observe', 'ui:toolbar', 'ui:email-banner', 'ui:email-footer',
   'ui:composer-toolbar', 'ui:sidebar-widget', 'ui:settings-section',
   'ui:context-menu', 'ui:navigation-rail', 'ui:keyboard',