Writing a plugin

suchi-plugin-pdftag/
├── go.mod
├── pdftag.go
└── pdftag_test.go

module github.com/YOUR-ORG/suchi-plugin-pdftag

go 1.26

require github.com/suchi-dms/suchi/plugin-api v0.0.0
require github.com/suchi-dms/suchi/core v0.0.0

package pdftag

import (
    "context"
    "database/sql"
    "log/slog"
    "strings"

    "github.com/suchi-dms/suchi/core/db"
    pluginapi "github.com/suchi-dms/suchi/plugin-api"
)

// Handler tags any ingested PDF with the "pdf" tag. Registered by the
// distro's main.go against core/jobs.Dispatcher.
type Handler struct {
    db  *db.DB
    log *slog.Logger
}

func New(d *db.DB, log *slog.Logger) *Handler {
    return &Handler{db: d, log: log.With("component", "pdftag")}
}

// Kinds implements pluginapi.Subscriber. Post-ingest fires after every
// upload; we filter on MIME inside Handle.
func (h *Handler) Kinds() []string {
    return []string{"post-ingest"}
}

// Handle implements pluginapi.Subscriber. Idempotent — the INSERT OR
// IGNORE on document_tags dedupes if we're retried.
func (h *Handler) Handle(ctx context.Context, e pluginapi.Event) error {
    mime, _ := e.Payload["mime"].(string)
    if !strings.HasPrefix(strings.ToLower(mime), "application/pdf") {
        return nil // not our concern
    }
    return h.db.WriteTx(ctx, func(tx *sql.Tx) error {
        var tagID int64
        err := tx.QueryRowContext(ctx,
            `SELECT id FROM tags WHERE name = 'pdf'`).Scan(&tagID)
        if err == sql.ErrNoRows {
            res, err := tx.ExecContext(ctx,
                `INSERT INTO tags(name, color) VALUES ('pdf', '#c44')`)
            if err != nil { return err }
            tagID, _ = res.LastInsertId()
        } else if err != nil {
            return err
        }
        _, err = tx.ExecContext(ctx, `
            INSERT OR IGNORE INTO document_tags(document_id, tag_id)
            VALUES (?, ?)
        `, e.DocID, tagID)
        return err
    })
}

import pdftag "github.com/YOUR-ORG/suchi-plugin-pdftag"

// ... after the dispatcher is constructed:
disp.Register(pdftag.New(d, log))

package internalauth

import (
    "context"
    "net/http"
    "strings"

    "github.com/suchi-dms/suchi/core/db"
    pluginapi "github.com/suchi-dms/suchi/plugin-api"
)

type Plugin struct {
    db     *db.DB
    verify func(token string) (email string, err error) // your JWT verifier
}

func (p *Plugin) Name() string { return "internal-jwt" }

func (p *Plugin) Authenticate(r *http.Request) (*pluginapi.Principal, error) {
    h := r.Header.Get("X-Internal-JWT")
    if h == "" {
        return nil, nil // not our request, try next authenticator
    }
    email, err := p.verify(h)
    if err != nil {
        return nil, err // JWT present but bad — abort the chain
    }
    var userID int64
    var role string
    if err := p.db.Read.QueryRowContext(context.Background(),
        `SELECT id, role FROM users WHERE email = ? AND trashed_at IS NULL`,
        strings.ToLower(email),
    ).Scan(&userID, &role); err != nil {
        return nil, err
    }
    return &pluginapi.Principal{
        Kind: "user", UserID: userID, Email: email, Role: role,
        AuthNBy: p.Name(),
    }, nil
}

authChain.Authenticators = append(
    []pluginapi.Authenticator{internalauth.New(d, verifyJWT)},
    authChain.Authenticators...,
)

package syslogaudit

import (
    "context"
    "encoding/json"
    "log/syslog"

    pluginapi "github.com/suchi-dms/suchi/plugin-api"
)

type Sink struct {
    w *syslog.Writer
}

func New(addr string) (*Sink, error) {
    w, err := syslog.Dial("tcp", addr, syslog.LOG_INFO|syslog.LOG_LOCAL0, "suchi")
    if err != nil {
        return nil, err
    }
    return &Sink{w: w}, nil
}

func (s *Sink) Kind() string { return "syslog" }

func (s *Sink) Emit(_ context.Context, e pluginapi.AuditEvent) error {
    b, err := json.Marshal(e)
    if err != nil {
        return err
    }
    return s.w.Info(string(b))
}

func setupDB(t *testing.T) *db.DB {
    t.Helper()
    ctx := context.Background()
    path := filepath.Join(t.TempDir(), "test.db")
    d, err := db.Open(ctx, path)
    if err != nil { t.Fatal(err) }
    t.Cleanup(func() { _ = d.Close() })
    migs, err := db.LoadMigrations(migrations.FS, ".")
    if err != nil { t.Fatal(err) }
    log := slog.New(slog.NewTextHandler(os.Stderr, nil))
    if err := db.Migrate(ctx, d, migs, log); err != nil { t.Fatal(err) }
    return d
}