feat: workflow foundation (#23621)

* feat: plugins * feat: table definition * feat: type and migration * feat: add repositories * feat: validate manifest with class-validator and load manifest info to database * feat: workflow/plugin controller/service layer * feat: implement workflow logic * feat: make trigger static * feat: dynamical instantiate plugin instances * fix: access control and helper script * feat: it works * chore: simplify * refactor: refactor and use queue for workflow execution * refactor: remove unsused property in plugin-schema * build wasm in prod * feat: plugin loader in transaction * fix: docker build arm64 * generated files * shell check * fix tests * fix: waiting for migration to finish before loading plugin * remove context reassignment * feat: use mise to manage extism tools (#23760) * pr feedback * refactor: create workflow now including create filters and actions * feat: workflow medium tests * fix: broken medium test * feat: medium tests * chore: unify workflow job * sign user id with jwt * chore: query plugin with filters and action * chore: read manifest in repository * chore: load manifest from server configs * merge main * feat: endpoint documentation * pr feedback * load plugin from absolute path * refactor:handle trigger * throw error and return early * pr feedback * unify plugin services * fix: plugins code * clean up * remove triggerConfig * clean up * displayName and methodName --------- Co-authored-by: Jason Rasmussen <jason@rasm.me> Co-authored-by: bo0tzz <git@bo0tzz.me>
2025-12-12 15:50:43 -08:00 · 2025-11-14 14:05:05 -06:00
parent d784d431d0
commit 4dcc049465
89 changed files with 7264 additions and 14 deletions
--- a/server/test/medium.factory.ts
+++ b/server/test/medium.factory.ts
@@ -36,6 +36,7 @@ import { NotificationRepository } from 'src/repositories/notification.repository
 import { OcrRepository } from 'src/repositories/ocr.repository';
 import { PartnerRepository } from 'src/repositories/partner.repository';
 import { PersonRepository } from 'src/repositories/person.repository';
+import { PluginRepository } from 'src/repositories/plugin.repository';
 import { SearchRepository } from 'src/repositories/search.repository';
 import { SessionRepository } from 'src/repositories/session.repository';
 import { SharedLinkAssetRepository } from 'src/repositories/shared-link-asset.repository';
@@ -49,6 +50,7 @@ import { TagRepository } from 'src/repositories/tag.repository';
 import { TelemetryRepository } from 'src/repositories/telemetry.repository';
 import { UserRepository } from 'src/repositories/user.repository';
 import { VersionHistoryRepository } from 'src/repositories/version-history.repository';
+import { WorkflowRepository } from 'src/repositories/workflow.repository';
 import { DB } from 'src/schema';
 import { AlbumTable } from 'src/schema/tables/album.table';
 import { AssetExifTable } from 'src/schema/tables/asset-exif.table';
@@ -380,6 +382,7 @@ const newRealRepository = <T>(key: ClassConstructor<T>, db: Kysely<DB>): T => {
    case OcrRepository:
    case PartnerRepository:
    case PersonRepository:
+    case PluginRepository:
    case SearchRepository:
    case SessionRepository:
    case SharedLinkRepository:
@@ -389,7 +392,8 @@ const newRealRepository = <T>(key: ClassConstructor<T>, db: Kysely<DB>): T => {
    case SyncCheckpointRepository:
    case SystemMetadataRepository:
    case UserRepository:
-    case VersionHistoryRepository: {
+    case VersionHistoryRepository:
+    case WorkflowRepository: {
      return new key(db);
    }

@@ -441,13 +445,15 @@ const newMockRepository = <T>(key: ClassConstructor<T>) => {
    case OcrRepository:
    case PartnerRepository:
    case PersonRepository:
+    case PluginRepository:
    case SessionRepository:
    case SyncRepository:
    case SyncCheckpointRepository:
    case SystemMetadataRepository:
    case UserRepository:
    case VersionHistoryRepository:
-    case TagRepository: {
+    case TagRepository:
+    case WorkflowRepository: {
      return automock(key);
    }

--- a/server/test/medium/specs/services/plugin.service.spec.ts
+++ b/server/test/medium/specs/services/plugin.service.spec.ts
@@ -0,0 +1,308 @@
+import { Kysely } from 'kysely';
+import { PluginContext } from 'src/enum';
+import { AccessRepository } from 'src/repositories/access.repository';
+import { LoggingRepository } from 'src/repositories/logging.repository';
+import { PluginRepository } from 'src/repositories/plugin.repository';
+import { DB } from 'src/schema';
+import { PluginService } from 'src/services/plugin.service';
+import { newMediumService } from 'test/medium.factory';
+import { getKyselyDB } from 'test/utils';
+
+let defaultDatabase: Kysely<DB>;
+let pluginRepo: PluginRepository;
+
+const setup = (db?: Kysely<DB>) => {
+  return newMediumService(PluginService, {
+    database: db || defaultDatabase,
+    real: [PluginRepository, AccessRepository],
+    mock: [LoggingRepository],
+  });
+};
+
+beforeAll(async () => {
+  defaultDatabase = await getKyselyDB();
+  pluginRepo = new PluginRepository(defaultDatabase);
+});
+
+afterEach(async () => {
+  await defaultDatabase.deleteFrom('plugin').execute();
+});
+
+describe(PluginService.name, () => {
+  describe('getAll', () => {
+    it('should return empty array when no plugins exist', async () => {
+      const { sut } = setup();
+
+      const plugins = await sut.getAll();
+
+      expect(plugins).toEqual([]);
+    });
+
+    it('should return plugin without filters and actions', async () => {
+      const { sut } = setup();
+
+      const result = await pluginRepo.loadPlugin(
+        {
+          name: 'test-plugin',
+          title: 'Test Plugin',
+          description: 'A test plugin',
+          author: 'Test Author',
+          version: '1.0.0',
+          wasm: { path: '/path/to/test.wasm' },
+        },
+        '/test/base/path',
+      );
+
+      const plugins = await sut.getAll();
+
+      expect(plugins).toHaveLength(1);
+      expect(plugins[0]).toMatchObject({
+        id: result.plugin.id,
+        name: 'test-plugin',
+        description: 'A test plugin',
+        author: 'Test Author',
+        version: '1.0.0',
+        filters: [],
+        actions: [],
+      });
+    });
+
+    it('should return plugin with filters and actions', async () => {
+      const { sut } = setup();
+
+      const result = await pluginRepo.loadPlugin(
+        {
+          name: 'full-plugin',
+          title: 'Full Plugin',
+          description: 'A plugin with filters and actions',
+          author: 'Test Author',
+          version: '1.0.0',
+          wasm: { path: '/path/to/full.wasm' },
+          filters: [
+            {
+              methodName: 'test-filter',
+              title: 'Test Filter',
+              description: 'A test filter',
+              supportedContexts: [PluginContext.Asset],
+              schema: { type: 'object', properties: {} },
+            },
+          ],
+          actions: [
+            {
+              methodName: 'test-action',
+              title: 'Test Action',
+              description: 'A test action',
+              supportedContexts: [PluginContext.Asset],
+              schema: { type: 'object', properties: {} },
+            },
+          ],
+        },
+        '/test/base/path',
+      );
+
+      const plugins = await sut.getAll();
+
+      expect(plugins).toHaveLength(1);
+      expect(plugins[0]).toMatchObject({
+        id: result.plugin.id,
+        name: 'full-plugin',
+        filters: [
+          {
+            id: result.filters[0].id,
+            pluginId: result.plugin.id,
+            methodName: 'test-filter',
+            title: 'Test Filter',
+            description: 'A test filter',
+            supportedContexts: [PluginContext.Asset],
+            schema: { type: 'object', properties: {} },
+          },
+        ],
+        actions: [
+          {
+            id: result.actions[0].id,
+            pluginId: result.plugin.id,
+            methodName: 'test-action',
+            title: 'Test Action',
+            description: 'A test action',
+            supportedContexts: [PluginContext.Asset],
+            schema: { type: 'object', properties: {} },
+          },
+        ],
+      });
+    });
+
+    it('should return multiple plugins with their respective filters and actions', async () => {
+      const { sut } = setup();
+
+      await pluginRepo.loadPlugin(
+        {
+          name: 'plugin-1',
+          title: 'Plugin 1',
+          description: 'First plugin',
+          author: 'Author 1',
+          version: '1.0.0',
+          wasm: { path: '/path/to/plugin1.wasm' },
+          filters: [
+            {
+              methodName: 'filter-1',
+              title: 'Filter 1',
+              description: 'Filter for plugin 1',
+              supportedContexts: [PluginContext.Asset],
+              schema: undefined,
+            },
+          ],
+        },
+        '/test/base/path',
+      );
+
+      await pluginRepo.loadPlugin(
+        {
+          name: 'plugin-2',
+          title: 'Plugin 2',
+          description: 'Second plugin',
+          author: 'Author 2',
+          version: '2.0.0',
+          wasm: { path: '/path/to/plugin2.wasm' },
+          actions: [
+            {
+              methodName: 'action-2',
+              title: 'Action 2',
+              description: 'Action for plugin 2',
+              supportedContexts: [PluginContext.Album],
+              schema: undefined,
+            },
+          ],
+        },
+        '/test/base/path',
+      );
+
+      const plugins = await sut.getAll();
+
+      expect(plugins).toHaveLength(2);
+      expect(plugins[0].name).toBe('plugin-1');
+      expect(plugins[0].filters).toHaveLength(1);
+      expect(plugins[0].actions).toHaveLength(0);
+
+      expect(plugins[1].name).toBe('plugin-2');
+      expect(plugins[1].filters).toHaveLength(0);
+      expect(plugins[1].actions).toHaveLength(1);
+    });
+
+    it('should handle plugin with multiple filters and actions', async () => {
+      const { sut } = setup();
+
+      await pluginRepo.loadPlugin(
+        {
+          name: 'multi-plugin',
+          title: 'Multi Plugin',
+          description: 'Plugin with multiple items',
+          author: 'Test Author',
+          version: '1.0.0',
+          wasm: { path: '/path/to/multi.wasm' },
+          filters: [
+            {
+              methodName: 'filter-a',
+              title: 'Filter A',
+              description: 'First filter',
+              supportedContexts: [PluginContext.Asset],
+              schema: undefined,
+            },
+            {
+              methodName: 'filter-b',
+              title: 'Filter B',
+              description: 'Second filter',
+              supportedContexts: [PluginContext.Album],
+              schema: undefined,
+            },
+          ],
+          actions: [
+            {
+              methodName: 'action-x',
+              title: 'Action X',
+              description: 'First action',
+              supportedContexts: [PluginContext.Asset],
+              schema: undefined,
+            },
+            {
+              methodName: 'action-y',
+              title: 'Action Y',
+              description: 'Second action',
+              supportedContexts: [PluginContext.Person],
+              schema: undefined,
+            },
+          ],
+        },
+        '/test/base/path',
+      );
+
+      const plugins = await sut.getAll();
+
+      expect(plugins).toHaveLength(1);
+      expect(plugins[0].filters).toHaveLength(2);
+      expect(plugins[0].actions).toHaveLength(2);
+    });
+  });
+
+  describe('get', () => {
+    it('should throw error when plugin does not exist', async () => {
+      const { sut } = setup();
+
+      await expect(sut.get('00000000-0000-0000-0000-000000000000')).rejects.toThrow('Plugin not found');
+    });
+
+    it('should return single plugin with filters and actions', async () => {
+      const { sut } = setup();
+
+      const result = await pluginRepo.loadPlugin(
+        {
+          name: 'single-plugin',
+          title: 'Single Plugin',
+          description: 'A single plugin',
+          author: 'Test Author',
+          version: '1.0.0',
+          wasm: { path: '/path/to/single.wasm' },
+          filters: [
+            {
+              methodName: 'single-filter',
+              title: 'Single Filter',
+              description: 'A single filter',
+              supportedContexts: [PluginContext.Asset],
+              schema: undefined,
+            },
+          ],
+          actions: [
+            {
+              methodName: 'single-action',
+              title: 'Single Action',
+              description: 'A single action',
+              supportedContexts: [PluginContext.Asset],
+              schema: undefined,
+            },
+          ],
+        },
+        '/test/base/path',
+      );
+
+      const pluginResult = await sut.get(result.plugin.id);
+
+      expect(pluginResult).toMatchObject({
+        id: result.plugin.id,
+        name: 'single-plugin',
+        filters: [
+          {
+            id: result.filters[0].id,
+            methodName: 'single-filter',
+            title: 'Single Filter',
+          },
+        ],
+        actions: [
+          {
+            id: result.actions[0].id,
+            methodName: 'single-action',
+            title: 'Single Action',
+          },
+        ],
+      });
+    });
+  });
+});
--- a/server/test/medium/specs/services/workflow.service.spec.ts
+++ b/server/test/medium/specs/services/workflow.service.spec.ts
@@ -0,0 +1,697 @@
+import { Kysely } from 'kysely';
+import { PluginContext, PluginTriggerType } from 'src/enum';
+import { AccessRepository } from 'src/repositories/access.repository';
+import { LoggingRepository } from 'src/repositories/logging.repository';
+import { PluginRepository } from 'src/repositories/plugin.repository';
+import { WorkflowRepository } from 'src/repositories/workflow.repository';
+import { DB } from 'src/schema';
+import { WorkflowService } from 'src/services/workflow.service';
+import { newMediumService } from 'test/medium.factory';
+import { getKyselyDB } from 'test/utils';
+
+let defaultDatabase: Kysely<DB>;
+
+const setup = (db?: Kysely<DB>) => {
+  return newMediumService(WorkflowService, {
+    database: db || defaultDatabase,
+    real: [WorkflowRepository, PluginRepository, AccessRepository],
+    mock: [LoggingRepository],
+  });
+};
+
+beforeAll(async () => {
+  defaultDatabase = await getKyselyDB();
+});
+
+describe(WorkflowService.name, () => {
+  let testPluginId: string;
+  let testFilterId: string;
+  let testActionId: string;
+
+  beforeAll(async () => {
+    // Create a test plugin with filters and actions once for all tests
+    const pluginRepo = new PluginRepository(defaultDatabase);
+    const result = await pluginRepo.loadPlugin(
+      {
+        name: 'test-core-plugin',
+        title: 'Test Core Plugin',
+        description: 'A test core plugin for workflow tests',
+        author: 'Test Author',
+        version: '1.0.0',
+        wasm: {
+          path: '/test/path.wasm',
+        },
+        filters: [
+          {
+            methodName: 'test-filter',
+            title: 'Test Filter',
+            description: 'A test filter',
+            supportedContexts: [PluginContext.Asset],
+            schema: undefined,
+          },
+        ],
+        actions: [
+          {
+            methodName: 'test-action',
+            title: 'Test Action',
+            description: 'A test action',
+            supportedContexts: [PluginContext.Asset],
+            schema: undefined,
+          },
+        ],
+      },
+      '/plugins/test-core-plugin',
+    );
+
+    testPluginId = result.plugin.id;
+    testFilterId = result.filters[0].id;
+    testActionId = result.actions[0].id;
+  });
+
+  afterAll(async () => {
+    await defaultDatabase.deleteFrom('plugin').where('id', '=', testPluginId).execute();
+  });
+
+  describe('create', () => {
+    it('should create a workflow without filters or actions', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+
+      const auth = { user: { id: user.id } } as any;
+
+      const workflow = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'A test workflow',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      expect(workflow).toMatchObject({
+        id: expect.any(String),
+        ownerId: user.id,
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'A test workflow',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+    });
+
+    it('should create a workflow with filters and actions', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const workflow = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow-with-relations',
+        description: 'A test workflow with filters and actions',
+        enabled: true,
+        filters: [
+          {
+            filterId: testFilterId,
+            filterConfig: { key: 'value' },
+          },
+        ],
+        actions: [
+          {
+            actionId: testActionId,
+            actionConfig: { action: 'test' },
+          },
+        ],
+      });
+
+      expect(workflow).toMatchObject({
+        id: expect.any(String),
+        ownerId: user.id,
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow-with-relations',
+        enabled: true,
+      });
+
+      expect(workflow.filters).toHaveLength(1);
+      expect(workflow.filters[0]).toMatchObject({
+        id: expect.any(String),
+        workflowId: workflow.id,
+        filterId: testFilterId,
+        filterConfig: { key: 'value' },
+        order: 0,
+      });
+
+      expect(workflow.actions).toHaveLength(1);
+      expect(workflow.actions[0]).toMatchObject({
+        id: expect.any(String),
+        workflowId: workflow.id,
+        actionId: testActionId,
+        actionConfig: { action: 'test' },
+        order: 0,
+      });
+    });
+
+    it('should throw error when creating workflow with invalid filter', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      await expect(
+        sut.create(auth, {
+          triggerType: PluginTriggerType.AssetCreate,
+          name: 'invalid-workflow',
+          description: 'A workflow with invalid filter',
+          enabled: true,
+          filters: [
+            {
+              filterId: '66da82df-e424-4bf4-b6f3-5d8e71620dae',
+              filterConfig: { key: 'value' },
+            },
+          ],
+          actions: [],
+        }),
+      ).rejects.toThrow('Invalid filter ID');
+    });
+
+    it('should throw error when creating workflow with invalid action', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      await expect(
+        sut.create(auth, {
+          triggerType: PluginTriggerType.AssetCreate,
+          name: 'invalid-workflow',
+          description: 'A workflow with invalid action',
+          enabled: true,
+          filters: [],
+          actions: [
+            {
+              actionId: '66da82df-e424-4bf4-b6f3-5d8e71620dae',
+              actionConfig: { action: 'test' },
+            },
+          ],
+        }),
+      ).rejects.toThrow('Invalid action ID');
+    });
+
+    it('should throw error when filter does not support trigger context', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      // Create a plugin with a filter that only supports Album context
+      const pluginRepo = new PluginRepository(defaultDatabase);
+      const result = await pluginRepo.loadPlugin(
+        {
+          name: 'album-only-plugin',
+          title: 'Album Only Plugin',
+          description: 'Plugin with album-only filter',
+          author: 'Test Author',
+          version: '1.0.0',
+          wasm: { path: '/test/album-plugin.wasm' },
+          filters: [
+            {
+              methodName: 'album-filter',
+              title: 'Album Filter',
+              description: 'A filter that only works with albums',
+              supportedContexts: [PluginContext.Album],
+              schema: undefined,
+            },
+          ],
+        },
+        '/plugins/test-core-plugin',
+      );
+
+      await expect(
+        sut.create(auth, {
+          triggerType: PluginTriggerType.AssetCreate,
+          name: 'invalid-context-workflow',
+          description: 'A workflow with context mismatch',
+          enabled: true,
+          filters: [{ filterId: result.filters[0].id }],
+          actions: [],
+        }),
+      ).rejects.toThrow('does not support asset context');
+    });
+
+    it('should throw error when action does not support trigger context', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      // Create a plugin with an action that only supports Person context
+      const pluginRepo = new PluginRepository(defaultDatabase);
+      const result = await pluginRepo.loadPlugin(
+        {
+          name: 'person-only-plugin',
+          title: 'Person Only Plugin',
+          description: 'Plugin with person-only action',
+          author: 'Test Author',
+          version: '1.0.0',
+          wasm: { path: '/test/person-plugin.wasm' },
+          actions: [
+            {
+              methodName: 'person-action',
+              title: 'Person Action',
+              description: 'An action that only works with persons',
+              supportedContexts: [PluginContext.Person],
+              schema: undefined,
+            },
+          ],
+        },
+        '/plugins/test-core-plugin',
+      );
+
+      await expect(
+        sut.create(auth, {
+          triggerType: PluginTriggerType.AssetCreate,
+          name: 'invalid-context-workflow',
+          description: 'A workflow with context mismatch',
+          enabled: true,
+          filters: [],
+          actions: [{ actionId: result.actions[0].id }],
+        }),
+      ).rejects.toThrow('does not support asset context');
+    });
+
+    it('should create workflow with multiple filters and actions in correct order', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const workflow = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'multi-step-workflow',
+        description: 'A workflow with multiple filters and actions',
+        enabled: true,
+        filters: [
+          { filterId: testFilterId, filterConfig: { step: 1 } },
+          { filterId: testFilterId, filterConfig: { step: 2 } },
+        ],
+        actions: [
+          { actionId: testActionId, actionConfig: { step: 1 } },
+          { actionId: testActionId, actionConfig: { step: 2 } },
+          { actionId: testActionId, actionConfig: { step: 3 } },
+        ],
+      });
+
+      expect(workflow.filters).toHaveLength(2);
+      expect(workflow.filters[0].order).toBe(0);
+      expect(workflow.filters[0].filterConfig).toEqual({ step: 1 });
+      expect(workflow.filters[1].order).toBe(1);
+      expect(workflow.filters[1].filterConfig).toEqual({ step: 2 });
+
+      expect(workflow.actions).toHaveLength(3);
+      expect(workflow.actions[0].order).toBe(0);
+      expect(workflow.actions[1].order).toBe(1);
+      expect(workflow.actions[2].order).toBe(2);
+    });
+  });
+
+  describe('getAll', () => {
+    it('should return all workflows for a user', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const workflow1 = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'workflow-1',
+        description: 'First workflow',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      const workflow2 = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'workflow-2',
+        description: 'Second workflow',
+        enabled: false,
+        filters: [],
+        actions: [],
+      });
+
+      const workflows = await sut.getAll(auth);
+
+      expect(workflows).toHaveLength(2);
+      expect(workflows).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ id: workflow1.id, name: 'workflow-1' }),
+          expect.objectContaining({ id: workflow2.id, name: 'workflow-2' }),
+        ]),
+      );
+    });
+
+    it('should return empty array when user has no workflows', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const workflows = await sut.getAll(auth);
+
+      expect(workflows).toEqual([]);
+    });
+
+    it('should not return workflows from other users', async () => {
+      const { sut, ctx } = setup();
+      const { user: user1 } = await ctx.newUser();
+      const { user: user2 } = await ctx.newUser();
+      const auth1 = { user: { id: user1.id } } as any;
+      const auth2 = { user: { id: user2.id } } as any;
+
+      await sut.create(auth1, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'user1-workflow',
+        description: 'User 1 workflow',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      const user2Workflows = await sut.getAll(auth2);
+
+      expect(user2Workflows).toEqual([]);
+    });
+  });
+
+  describe('get', () => {
+    it('should return a specific workflow by id', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const created = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'A test workflow',
+        enabled: true,
+        filters: [{ filterId: testFilterId, filterConfig: { key: 'value' } }],
+        actions: [{ actionId: testActionId, actionConfig: { action: 'test' } }],
+      });
+
+      const workflow = await sut.get(auth, created.id);
+
+      expect(workflow).toMatchObject({
+        id: created.id,
+        name: 'test-workflow',
+        description: 'A test workflow',
+        enabled: true,
+      });
+      expect(workflow.filters).toHaveLength(1);
+      expect(workflow.actions).toHaveLength(1);
+    });
+
+    it('should throw error when workflow does not exist', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      await expect(sut.get(auth, '66da82df-e424-4bf4-b6f3-5d8e71620dae')).rejects.toThrow();
+    });
+
+    it('should throw error when user does not have access to workflow', async () => {
+      const { sut, ctx } = setup();
+      const { user: user1 } = await ctx.newUser();
+      const { user: user2 } = await ctx.newUser();
+      const auth1 = { user: { id: user1.id } } as any;
+      const auth2 = { user: { id: user2.id } } as any;
+
+      const workflow = await sut.create(auth1, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'private-workflow',
+        description: 'Private workflow',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      await expect(sut.get(auth2, workflow.id)).rejects.toThrow();
+    });
+  });
+
+  describe('update', () => {
+    it('should update workflow basic fields', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const created = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'original-workflow',
+        description: 'Original description',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      const updated = await sut.update(auth, created.id, {
+        name: 'updated-workflow',
+        description: 'Updated description',
+        enabled: false,
+      });
+
+      expect(updated).toMatchObject({
+        id: created.id,
+        name: 'updated-workflow',
+        description: 'Updated description',
+        enabled: false,
+      });
+    });
+
+    it('should update workflow filters', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const created = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'Test',
+        enabled: true,
+        filters: [{ filterId: testFilterId, filterConfig: { old: 'config' } }],
+        actions: [],
+      });
+
+      const updated = await sut.update(auth, created.id, {
+        filters: [
+          { filterId: testFilterId, filterConfig: { new: 'config' } },
+          { filterId: testFilterId, filterConfig: { second: 'filter' } },
+        ],
+      });
+
+      expect(updated.filters).toHaveLength(2);
+      expect(updated.filters[0].filterConfig).toEqual({ new: 'config' });
+      expect(updated.filters[1].filterConfig).toEqual({ second: 'filter' });
+    });
+
+    it('should update workflow actions', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const created = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'Test',
+        enabled: true,
+        filters: [],
+        actions: [{ actionId: testActionId, actionConfig: { old: 'config' } }],
+      });
+
+      const updated = await sut.update(auth, created.id, {
+        actions: [
+          { actionId: testActionId, actionConfig: { new: 'config' } },
+          { actionId: testActionId, actionConfig: { second: 'action' } },
+        ],
+      });
+
+      expect(updated.actions).toHaveLength(2);
+      expect(updated.actions[0].actionConfig).toEqual({ new: 'config' });
+      expect(updated.actions[1].actionConfig).toEqual({ second: 'action' });
+    });
+
+    it('should clear filters when updated with empty array', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const created = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'Test',
+        enabled: true,
+        filters: [{ filterId: testFilterId, filterConfig: { key: 'value' } }],
+        actions: [],
+      });
+
+      const updated = await sut.update(auth, created.id, {
+        filters: [],
+      });
+
+      expect(updated.filters).toHaveLength(0);
+    });
+
+    it('should throw error when no fields to update', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const created = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'Test',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      await expect(sut.update(auth, created.id, {})).rejects.toThrow('No fields to update');
+    });
+
+    it('should throw error when updating non-existent workflow', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      await expect(
+        sut.update(auth, 'non-existent-id', {
+          name: 'updated-name',
+        }),
+      ).rejects.toThrow();
+    });
+
+    it('should throw error when user does not have access to update workflow', async () => {
+      const { sut, ctx } = setup();
+      const { user: user1 } = await ctx.newUser();
+      const { user: user2 } = await ctx.newUser();
+      const auth1 = { user: { id: user1.id } } as any;
+      const auth2 = { user: { id: user2.id } } as any;
+
+      const workflow = await sut.create(auth1, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'private-workflow',
+        description: 'Private',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      await expect(
+        sut.update(auth2, workflow.id, {
+          name: 'hacked-workflow',
+        }),
+      ).rejects.toThrow();
+    });
+
+    it('should throw error when updating with invalid filter', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const created = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'Test',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      await expect(
+        sut.update(auth, created.id, {
+          filters: [{ filterId: 'invalid-filter-id', filterConfig: {} }],
+        }),
+      ).rejects.toThrow();
+    });
+
+    it('should throw error when updating with invalid action', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const created = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'Test',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      await expect(
+        sut.update(auth, created.id, {
+          actions: [{ actionId: 'invalid-action-id', actionConfig: {} }],
+        }),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe('delete', () => {
+    it('should delete a workflow', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const workflow = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'Test',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      await sut.delete(auth, workflow.id);
+
+      await expect(sut.get(auth, workflow.id)).rejects.toThrow('Not found or no workflow.read access');
+    });
+
+    it('should delete workflow with filters and actions', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      const workflow = await sut.create(auth, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'test-workflow',
+        description: 'Test',
+        enabled: true,
+        filters: [{ filterId: testFilterId, filterConfig: {} }],
+        actions: [{ actionId: testActionId, actionConfig: {} }],
+      });
+
+      await sut.delete(auth, workflow.id);
+
+      await expect(sut.get(auth, workflow.id)).rejects.toThrow('Not found or no workflow.read access');
+    });
+
+    it('should throw error when deleting non-existent workflow', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+      const auth = { user: { id: user.id } } as any;
+
+      await expect(sut.delete(auth, 'non-existent-id')).rejects.toThrow();
+    });
+
+    it('should throw error when user does not have access to delete workflow', async () => {
+      const { sut, ctx } = setup();
+      const { user: user1 } = await ctx.newUser();
+      const { user: user2 } = await ctx.newUser();
+      const auth1 = { user: { id: user1.id } } as any;
+      const auth2 = { user: { id: user2.id } } as any;
+
+      const workflow = await sut.create(auth1, {
+        triggerType: PluginTriggerType.AssetCreate,
+        name: 'private-workflow',
+        description: 'Private',
+        enabled: true,
+        filters: [],
+        actions: [],
+      });
+
+      await expect(sut.delete(auth2, workflow.id)).rejects.toThrow();
+    });
+  });
+});
--- a/server/test/repositories/access.repository.mock.ts
+++ b/server/test/repositories/access.repository.mock.ts
@@ -65,5 +65,9 @@ export const newAccessRepositoryMock = (): IAccessRepositoryMock => {
    tag: {
      checkOwnerAccess: vitest.fn().mockResolvedValue(new Set()),
    },
+
+    workflow: {
+      checkOwnerAccess: vitest.fn().mockResolvedValue(new Set()),
+    },
  };
 };
--- a/server/test/repositories/config.repository.mock.ts
+++ b/server/test/repositories/config.repository.mock.ts
@@ -72,6 +72,7 @@ const envData: EnvData = {
      root: '/build/www',
      indexHtml: '/build/www/index.html',
    },
+    corePlugin: '/build/corePlugin',
  },

  storage: {
@@ -86,6 +87,11 @@ const envData: EnvData = {

  workers: [ImmichWorker.Api, ImmichWorker.Microservices],

+  plugins: {
+    enabled: true,
+    installFolder: '/app/data/plugins',
+  },
+
  noColor: false,
 };

--- a/server/test/repositories/crypto.repository.mock.ts
+++ b/server/test/repositories/crypto.repository.mock.ts
@@ -13,5 +13,7 @@ export const newCryptoRepositoryMock = (): Mocked<RepositoryInterface<CryptoRepo
    hashSha1: vitest.fn().mockImplementation((input) => Buffer.from(`${input.toString()} (hashed)`)),
    hashFile: vitest.fn().mockImplementation((input) => `${input} (file-hashed)`),
    randomBytesAsText: vitest.fn().mockReturnValue(Buffer.from('random-bytes').toString('base64')),
+    signJwt: vitest.fn().mockReturnValue('mock-jwt-token'),
+    verifyJwt: vitest.fn().mockImplementation((token) => ({ verified: true, token })),
  };
 };
--- a/server/test/repositories/storage.repository.mock.ts
+++ b/server/test/repositories/storage.repository.mock.ts
@@ -49,6 +49,7 @@ export const newStorageRepositoryMock = (): Mocked<RepositoryInterface<StorageRe
    createZipStream: vitest.fn(),
    createReadStream: vitest.fn(),
    readFile: vitest.fn(),
+    readTextFile: vitest.fn(),
    createFile: vitest.fn(),
    createWriteStream: vitest.fn(),
    createOrOverwriteFile: vitest.fn(),
--- a/server/test/utils.ts
+++ b/server/test/utils.ts
@@ -44,6 +44,7 @@ import { OAuthRepository } from 'src/repositories/oauth.repository';
 import { OcrRepository } from 'src/repositories/ocr.repository';
 import { PartnerRepository } from 'src/repositories/partner.repository';
 import { PersonRepository } from 'src/repositories/person.repository';
+import { PluginRepository } from 'src/repositories/plugin.repository';
 import { ProcessRepository } from 'src/repositories/process.repository';
 import { SearchRepository } from 'src/repositories/search.repository';
 import { ServerInfoRepository } from 'src/repositories/server-info.repository';
@@ -62,6 +63,7 @@ import { UserRepository } from 'src/repositories/user.repository';
 import { VersionHistoryRepository } from 'src/repositories/version-history.repository';
 import { ViewRepository } from 'src/repositories/view-repository';
 import { WebsocketRepository } from 'src/repositories/websocket.repository';
+import { WorkflowRepository } from 'src/repositories/workflow.repository';
 import { DB } from 'src/schema';
 import { AuthService } from 'src/services/auth.service';
 import { BaseService } from 'src/services/base.service';
@@ -235,6 +237,7 @@ export type ServiceOverrides = {
  oauth: OAuthRepository;
  partner: PartnerRepository;
  person: PersonRepository;
+  plugin: PluginRepository;
  process: ProcessRepository;
  search: SearchRepository;
  serverInfo: ServerInfoRepository;
@@ -253,6 +256,7 @@ export type ServiceOverrides = {
  versionHistory: VersionHistoryRepository;
  view: ViewRepository;
  websocket: WebsocketRepository;
+  workflow: WorkflowRepository;
 };

 type As<T> = T extends RepositoryInterface<infer U> ? U : never;
@@ -308,6 +312,7 @@ export const newTestService = <T extends BaseService>(
    oauth: automock(OAuthRepository, { args: [loggerMock] }),
    partner: automock(PartnerRepository, { strict: false }),
    person: automock(PersonRepository, { strict: false }),
+    plugin: automock(PluginRepository, { strict: true }),
    process: automock(ProcessRepository),
    search: automock(SearchRepository, { strict: false }),
    // eslint-disable-next-line no-sparse-arrays
@@ -330,6 +335,7 @@ export const newTestService = <T extends BaseService>(
    view: automock(ViewRepository),
    // eslint-disable-next-line no-sparse-arrays
    websocket: automock(WebsocketRepository, { args: [, loggerMock], strict: false }),
+    workflow: automock(WorkflowRepository, { strict: true }),
  };

  const sut = new Service(
@@ -363,6 +369,7 @@ export const newTestService = <T extends BaseService>(
    overrides.ocr || (mocks.ocr as As<OcrRepository>),
    overrides.partner || (mocks.partner as As<PartnerRepository>),
    overrides.person || (mocks.person as As<PersonRepository>),
+    overrides.plugin || (mocks.plugin as As<PluginRepository>),
    overrides.process || (mocks.process as As<ProcessRepository>),
    overrides.search || (mocks.search as As<SearchRepository>),
    overrides.serverInfo || (mocks.serverInfo as As<ServerInfoRepository>),
@@ -381,6 +388,7 @@ export const newTestService = <T extends BaseService>(
    overrides.versionHistory || (mocks.versionHistory as As<VersionHistoryRepository>),
    overrides.view || (mocks.view as As<ViewRepository>),
    overrides.websocket || (mocks.websocket as As<WebsocketRepository>),
+    overrides.workflow || (mocks.workflow as As<WorkflowRepository>),
  );

  return {