@spinnaker/core 2026.2.2 → 2026.3.0

package/src/plugins/plugin.registry.spec.ts

@@ -1,13 +1,13 @@
-import { mock } from 'angular';
-
 import { RequestBuilder } from '../api';
 import type { IDeckPlugin } from './deck.plugin';
 import type { IStageTypeConfig } from '../domain';
+import { HelpContentsRegistry } from '../help';
 import type { IPluginMetaData } from './plugin.registry';
 import { PluginRegistry } from './plugin.registry';
 import { Registry } from '../registry';
 
 const fakePromise = (result: any = undefined) => () => new Promise((resolve) => resolve(result));
+const fakeFetchResponse = (data: any = []) => ({ ok: true, json: () => Promise.resolve(data) } as Response);
 
 describe('PluginRegistry', () => {
   let pluginRegistry: PluginRegistry;
@@ -34,14 +34,11 @@ describe('PluginRegistry', () => {
     });
   });
 
-  it(
-    'loadPluginManifestFromDeck() should fetch /plugin-manifest.json from deck assets',
-    mock.inject(async ($http: any) => {
-      const spy = spyOn($http, 'get').and.callFake(() => Promise.resolve({ data: [] }));
-      await pluginRegistry.loadPluginManifestFromDeck();
-      expect(spy).toHaveBeenCalledWith('/plugin-manifest.json');
-    }),
-  );
+  it('loadPluginManifestFromDeck() should fetch /plugin-manifest.json from deck assets', async () => {
+    const spy = spyOn(window, 'fetch').and.callFake(() => Promise.resolve(fakeFetchResponse()));
+    await pluginRegistry.loadPluginManifestFromDeck();
+    expect(spy).toHaveBeenCalledWith('/plugin-manifest.json', { credentials: 'include' });
+  });
 
   it('loadPluginManifestFromGate() should fetch from gate /plugins/deck/plugin-manifest.json', async () => {
     const spy = spyOn(RequestBuilder.defaultHttpClient, 'get').and.callFake(() => Promise.resolve([] as any));
@@ -49,6 +46,20 @@ describe('PluginRegistry', () => {
     expect(spy).toHaveBeenCalled();
   });
 
+  it('loadPluginManifestFromDeck() should return empty array on error', async () => {
+    spyOn(window, 'fetch').and.callFake(() => Promise.reject({ data: null }));
+    spyOn(console, 'error').and.stub();
+    const result = await pluginRegistry.loadPluginManifestFromDeck();
+    expect(result).toEqual([]);
+  });
+
+  it('loadPluginManifestFromGate() should return empty array on error', async () => {
+    spyOn(RequestBuilder.defaultHttpClient, 'get').and.callFake(() => Promise.reject({ data: null }));
+    spyOn(console, 'error').and.stub();
+    const result = await pluginRegistry.loadPluginManifestFromGate();
+    expect(result).toEqual([]);
+  });
+
   describe('loadPlugins()', () => {
     let pluginModule: { plugin: IDeckPlugin };
     beforeEach(() => {
@@ -60,7 +71,7 @@ describe('PluginRegistry', () => {
       };
     });
 
-    it('should load all registered plugins', () => {
+    it('should load all registered plugins', async () => {
       // @ts-ignore
       const loadSpy = spyOn(pluginRegistry, 'load').and.callFake(fakePromise());
       const plugin1 = { id: 'foo', version: '1.0.0' };
@@ -70,20 +81,216 @@ describe('PluginRegistry', () => {
 
       expect(loadSpy.calls.count()).toBe(0);
 
-      pluginRegistry.loadPlugins();
+      await pluginRegistry.loadPlugins();
 
       expect(loadSpy.calls.count()).toBe(2);
       expect(loadSpy.calls.first().args[0]).toEqual(jasmine.objectContaining(plugin1));
       expect(loadSpy.calls.mostRecent().args[0]).toEqual(jasmine.objectContaining(plugin2));
     });
 
-    it('should return a rejected promise if a loaded module doesnt contain an export named plugin', async () => {
+    it('should represent a failed plugin load as undefined and log sanitized context', async () => {
       loadModuleFromUrlSpy.and.callFake(fakePromise({}));
-      spyOn(console, 'error').and.stub();
-      const plugin1 = { id: 'foo', version: '1.0.0' };
+      const errorSpy = spyOn(console, 'error').and.stub();
+      const plugin1 = {
+        id: 'foo',
+        version: '1.0.0',
+        url: 'https://user:password@example.com/plugins/foo.js?token=secret#fragment',
+      };
       pluginRegistry.registerPluginMetaData('deck', plugin1);
 
-      await expectAsync(pluginRegistry.loadPlugins()).toBeRejected();
+      await expectAsync(pluginRegistry.loadPlugins()).toBeResolvedTo([undefined]);
+      expect(errorSpy).toHaveBeenCalledOnceWith(
+        'Failed to load plugin foo code from https://example.com/plugins/foo.js',
+      );
+    });
+
+    it('waits for every plugin attempt when one fails and another extension registration is deferred', async () => {
+      let rejectFailedModule!: (reason?: any) => void;
+      let resolveExtensionRegistration!: (stage: IStageTypeConfig) => void;
+      let resolveFailureLogged!: () => void;
+      const failedModulePromise = new Promise<never>((_, reject) => (rejectFailedModule = reject));
+      const extensionRegistrationPromise = new Promise<IStageTypeConfig>(
+        (resolve) => (resolveExtensionRegistration = resolve),
+      );
+      const failureLoggedPromise = new Promise<void>((resolve) => (resolveFailureLogged = resolve));
+      const stage = { key: 'deferred-stage' } as IStageTypeConfig;
+      const successfulModule = {
+        plugin: {
+          preconfiguredJobStages: [stage],
+        },
+      };
+      const failedPlugin = { id: 'failed-plugin', version: '1.0.0', url: '/plugins/failed.js' };
+      const deferredPlugin = { id: 'deferred-plugin', version: '1.0.0', url: '/plugins/deferred.js' };
+      const errorSpy = spyOn(console, 'error').and.callFake(() => resolveFailureLogged());
+      loadModuleFromUrlSpy.and.callFake((url: string) =>
+        url === failedPlugin.url ? failedModulePromise : Promise.resolve(successfulModule),
+      );
+      pluginRegistry.registerPluginMetaData('deck', failedPlugin);
+      const deferredMetadata = pluginRegistry.registerPluginMetaData('deck', deferredPlugin)!;
+      spyOn(Registry.pipeline, 'registerPreconfiguredJobStage').and.returnValue(extensionRegistrationPromise);
+
+      let resolved = false;
+      let rejected = false;
+      let result: any[] | undefined;
+      const aggregatePromise = pluginRegistry.loadPlugins().then(
+        (modules) => {
+          resolved = true;
+          result = modules;
+        },
+        () => {
+          rejected = true;
+        },
+      );
+
+      await Promise.resolve();
+      expect(loadModuleFromUrlSpy).toHaveBeenCalledTimes(2);
+      rejectFailedModule(new Error('failed module load'));
+      await failureLoggedPromise;
+      await Promise.resolve();
+
+      expect(resolved).toBeFalse();
+      expect(rejected).toBeFalse();
+      expect(deferredMetadata.module).toBeUndefined();
+
+      resolveExtensionRegistration(stage);
+      await aggregatePromise;
+
+      expect(resolved).toBeTrue();
+      expect(rejected).toBeFalse();
+      expect(result).toEqual([undefined, successfulModule]);
+      expect(deferredMetadata.module).toBe(successfulModule);
+      expect(errorSpy).toHaveBeenCalledOnceWith('Failed to load plugin failed-plugin code from /plugins/failed.js');
+    });
+
+    it('isolates a rejected extension registration and does not expose its module', async () => {
+      const stage = { key: 'rejected-stage' } as IStageTypeConfig;
+      const registrationError = new Error('untrusted registration error payload');
+      const failedModule = { plugin: { preconfiguredJobStages: [stage] } };
+      const successfulModule = { plugin: {} };
+      const failedPlugin = {
+        id: 'failed-plugin',
+        version: '1.0.0',
+        url: 'https://user:password@example.com/plugins/failed.js?token=secret#fragment',
+      };
+      const successfulPlugin = { id: 'successful-plugin', version: '1.0.0', url: '/plugins/successful.js' };
+      const errorSpy = spyOn(console, 'error').and.stub();
+      spyOn(Registry.pipeline, 'registerPreconfiguredJobStage').and.returnValue(Promise.reject(registrationError));
+      loadModuleFromUrlSpy.and.callFake((url: string) =>
+        Promise.resolve(url === failedPlugin.url ? failedModule : successfulModule),
+      );
+      const failedMetadata = pluginRegistry.registerPluginMetaData('deck', failedPlugin)!;
+      const successfulMetadata = pluginRegistry.registerPluginMetaData('deck', successfulPlugin)!;
+
+      await expectAsync(pluginRegistry.loadPlugins()).toBeResolvedTo([undefined, successfulModule]);
+
+      expect(failedMetadata.module).toBeUndefined();
+      expect(successfulMetadata.module).toBe(successfulModule);
+      expect(errorSpy).toHaveBeenCalledOnceWith(
+        'Failed to load plugin failed-plugin code from https://example.com/plugins/failed.js',
+      );
+    });
+
+    it('waits for every extension registration before isolating a rejected plugin', async () => {
+      const rejectedStage = { key: 'rejected-stage' } as IStageTypeConfig;
+      const deferredStage = { key: 'deferred-stage' } as IStageTypeConfig;
+      const registrationError = new Error('registration failed');
+      let rejectRegistration!: (reason?: any) => void;
+      let resolveRegistration!: (stage: IStageTypeConfig) => void;
+      const rejectedRegistration = new Promise<IStageTypeConfig>((_, reject) => (rejectRegistration = reject));
+      const deferredRegistration = new Promise<IStageTypeConfig>((resolve) => (resolveRegistration = resolve));
+      const plugin = { id: 'failed-plugin', version: '1.0.0', url: '/plugins/failed.js' };
+      const pluginModuleWithExtensions = {
+        plugin: { preconfiguredJobStages: [rejectedStage, deferredStage] },
+      };
+      const errorSpy = spyOn(console, 'error').and.stub();
+      spyOn(Registry.pipeline, 'registerPreconfiguredJobStage').and.callFake((stage) =>
+        stage === rejectedStage ? rejectedRegistration : deferredRegistration,
+      );
+      loadModuleFromUrlSpy.and.returnValue(Promise.resolve(pluginModuleWithExtensions));
+      const metadata = pluginRegistry.registerPluginMetaData('deck', plugin)!;
+      let settled = false;
+
+      const aggregatePromise = pluginRegistry.loadPlugins().then((result) => {
+        settled = true;
+        return result;
+      });
+      rejectRegistration(registrationError);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+
+      expect(settled).toBeFalse();
+      expect(errorSpy).not.toHaveBeenCalled();
+      expect(metadata.module).toBeUndefined();
+
+      resolveRegistration(deferredStage);
+      await expectAsync(aggregatePromise).toBeResolvedTo([undefined]);
+      expect(errorSpy).toHaveBeenCalledOnceWith('Failed to load plugin failed-plugin code from /plugins/failed.js');
+      expect(metadata.module).toBeUndefined();
+    });
+
+    it('waits for pending extension work before isolating a later synchronous registration failure', async () => {
+      const stage = { key: 'deferred-stage' } as IStageTypeConfig;
+      const registrationError = new Error('help registration failed');
+      let resolveRegistration!: (stage: IStageTypeConfig) => void;
+      const deferredRegistration = new Promise<IStageTypeConfig>((resolve) => (resolveRegistration = resolve));
+      const plugin = { id: 'failed-plugin', version: '1.0.0', url: '/plugins/failed.js' };
+      const pluginModuleWithExtensions = {
+        plugin: { preconfiguredJobStages: [stage], help: { key: 'value' } },
+      };
+      const errorSpy = spyOn(console, 'error').and.stub();
+      spyOn(Registry.pipeline, 'registerPreconfiguredJobStage').and.returnValue(deferredRegistration);
+      spyOn(HelpContentsRegistry, 'register').and.throwError(registrationError);
+      loadModuleFromUrlSpy.and.returnValue(Promise.resolve(pluginModuleWithExtensions));
+      const metadata = pluginRegistry.registerPluginMetaData('deck', plugin)!;
+      let settled = false;
+
+      const aggregatePromise = pluginRegistry.loadPlugins().then((result) => {
+        settled = true;
+        return result;
+      });
+      await new Promise((resolve) => setTimeout(resolve, 0));
+
+      expect(settled).toBeFalse();
+      expect(errorSpy).not.toHaveBeenCalled();
+      expect(metadata.module).toBeUndefined();
+
+      resolveRegistration(stage);
+      await expectAsync(aggregatePromise).toBeResolvedTo([undefined]);
+      expect(errorSpy).toHaveBeenCalledOnceWith('Failed to load plugin failed-plugin code from /plugins/failed.js');
+      expect(metadata.module).toBeUndefined();
+    });
+
+    it('starts every plugin attempt and isolates a synchronous load throw', async () => {
+      const firstPlugin = { id: 'first-plugin', version: '1.0.0', url: '/plugins/first.js' };
+      const secondPlugin = { id: 'second-plugin', version: '1.0.0', url: '/plugins/second.js' };
+      const loadSpy = spyOn<any>(pluginRegistry, 'load').and.callFake((plugin: IPluginMetaData) => {
+        if (plugin.id === firstPlugin.id) {
+          throw new Error('synchronous load failure');
+        }
+        return Promise.resolve(pluginModule);
+      });
+      const errorSpy = spyOn(console, 'error').and.stub();
+      pluginRegistry.registerPluginMetaData('deck', firstPlugin);
+      pluginRegistry.registerPluginMetaData('deck', secondPlugin);
+
+      await expectAsync(pluginRegistry.loadPlugins()).toBeResolvedTo([undefined, pluginModule]);
+
+      expect(loadSpy).toHaveBeenCalledTimes(2);
+      expect(errorSpy).toHaveBeenCalledOnceWith('Failed to load plugin first-plugin code from /plugins/first.js');
+    });
+
+    it('isolates and logs metadata validation failures', async () => {
+      const errorSpy = spyOn(console, 'error').and.stub();
+      const invalidMetadata = pluginRegistry.registerPluginMetaData('deck', {
+        id: 'invalid-plugin',
+        version: '1.0.0',
+        url: '/plugins/invalid.js?token=secret#fragment',
+      })!;
+      invalidMetadata.id = '';
+
+      await expectAsync(pluginRegistry.loadPlugins()).toBeResolvedTo([undefined]);
+
+      expect(loadModuleFromUrlSpy).not.toHaveBeenCalled();
+      expect(errorSpy).toHaveBeenCalledOnceWith('Failed to load plugin <unknown> code from /plugins/invalid.js');
     });
 
     it('should resolve to all loaded plugin modules', async () => {
@@ -94,22 +301,39 @@ describe('PluginRegistry', () => {
       await expectAsync(pluginRegistry.loadPlugins()).toBeResolvedTo([pluginModule]);
     });
 
-    it('should normalize the metadata object', async () => {
+    it('normalizes authoritative id, url, and source without exposing a manifest module', async () => {
       loadModuleFromUrlSpy.and.callFake(fakePromise(pluginModule));
-      const plugin1 = { name: 'io.spinnaker.test.plugin', devUrl: 'abc', version: '1.0.0' } as IPluginMetaData;
+      const plugin1 = {
+        id: 'io.spinnaker.test.plugin',
+        name: 'malicious-name',
+        url: '/trusted.js',
+        devUrl: '/malicious.js',
+        version: '1.0.0',
+        source: 'gate',
+        module: { plugin: { initialize: () => undefined } },
+      } as IPluginMetaData & { source: string };
       pluginRegistry.registerPluginMetaData('deck', plugin1);
       expect(pluginRegistry.getRegisteredPlugins()[0]).toEqual({
         id: 'io.spinnaker.test.plugin',
         source: 'deck',
-        url: 'abc',
+        url: '/trusted.js',
         version: '1.0.0',
       });
     });
 
     it('prefers plugins from deck manifest over plugins from gate manifest', async () => {
       loadModuleFromUrlSpy.and.callFake(fakePromise(pluginModule));
-      const deckManifest = { id: 'io.spinnaker.test.plugin', version: '1.0.1', url: 'test' } as IPluginMetaData;
-      const gateManifest = { id: 'io.spinnaker.test.plugin', version: '1.0.0' } as IPluginMetaData;
+      const deckManifest = {
+        id: 'io.spinnaker.test.plugin',
+        version: '1.0.1',
+        url: 'test',
+        source: 'gate',
+      } as IPluginMetaData & { source: string };
+      const gateManifest = {
+        id: 'io.spinnaker.test.plugin',
+        version: '1.0.0',
+        source: 'deck',
+      } as IPluginMetaData & { source: string };
       pluginRegistry.registerPluginMetaData('deck', deckManifest);
       pluginRegistry.registerPluginMetaData('gate', gateManifest);
       expect(pluginRegistry.getRegisteredPlugins().length).toBe(1);
@@ -123,8 +347,17 @@ describe('PluginRegistry', () => {
 
     it('prefers plugins from deck manifest regardless of registration order', async () => {
       loadModuleFromUrlSpy.and.callFake(fakePromise(pluginModule));
-      const deckManifest = { id: 'io.spinnaker.test.plugin', version: '1.0.1', url: 'test' } as IPluginMetaData;
-      const gateManifest = { id: 'io.spinnaker.test.plugin', version: '1.0.0' } as IPluginMetaData;
+      const deckManifest = {
+        id: 'io.spinnaker.test.plugin',
+        version: '1.0.1',
+        url: 'test',
+        source: 'gate',
+      } as IPluginMetaData & { source: string };
+      const gateManifest = {
+        id: 'io.spinnaker.test.plugin',
+        version: '1.0.0',
+        source: 'deck',
+      } as IPluginMetaData & { source: string };
       pluginRegistry.registerPluginMetaData('gate', gateManifest);
       pluginRegistry.registerPluginMetaData('deck', deckManifest);
       expect(pluginRegistry.getRegisteredPlugins().length).toBe(1);

package/src/plugins/plugin.registry.ts

@@ -1,10 +1,13 @@
-import { $http } from 'ngimport';
-
 import { REST } from '../api/ApiService';
 import { SETTINGS } from '../config/settings';
 import type { IDeckPlugin } from './deck.plugin';
 import { registerPluginExtensions } from './deck.plugin';
 
+export interface IPluginModule {
+  plugin: IDeckPlugin;
+  [key: string]: unknown;
+}
+
 /** The shape of plugin metadata objects in plugin-manifest.json */
 export interface IPluginMetaData {
   id?: string;
@@ -14,7 +17,7 @@ export interface IPluginMetaData {
   url?: string;
   /** @deprecated if using a plugin-manifest.json baked into a deck instance, use `url` instead */
   devUrl?: string;
-  module?: any;
+  module?: IPluginModule;
 }
 
 type ISource = 'gate' | 'deck';
@@ -24,7 +27,32 @@ export interface INormalizedPluginMetaData {
   source: ISource;
   version: string;
   url?: string;
-  module?: any;
+  module?: IPluginModule;
+}
+
+function getSafePluginId(pluginMetaData: IPluginMetaData): string {
+  const id = pluginMetaData.id ?? pluginMetaData.name;
+  if (typeof id !== 'string') {
+    return '<unknown>';
+  }
+  const safeId = Array.from(id)
+    .filter((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127)
+    .join('')
+    .slice(0, 128);
+  return safeId || '<unknown>';
+}
+
+function getSafePluginUrl(url: string): string {
+  try {
+    const parsedUrl = new URL(url, window.location.origin);
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+      return `<${parsedUrl.protocol.replace(':', '')} plugin URL>`;
+    }
+    const isRelative = !/^(?:[a-z][a-z\d+.-]*:|\/\/)/i.test(url);
+    return isRelative ? parsedUrl.pathname : `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;
+  } catch {
+    return '<invalid plugin URL>';
+  }
 }
 
 export class PluginRegistry {
@@ -41,12 +69,14 @@ export class PluginRegistry {
     // Handle duplicate plugin ids
     if (duplicateMetaData) {
       if (metaData.source === duplicateMetaData.source) {
-        console.error(`Attempted to load two copies of the same plugin from ${source}`, metaData, duplicateMetaData);
+        console.error(`Attempted to load two copies of the same plugin from ${source}`);
         throw new Error(`Attempted to load two copies of the same plugin from ${source}`);
       } else {
         // If gate and deck both register the same plugin id, deck wins
         // eslint-disable-next-line no-console
-        console.log(`Attempted to load plugin ${pluginMetaData.id} from gate and deck.   Using plugin from deck.`);
+        console.log(
+          `Attempted to load plugin ${getSafePluginId(pluginMetaData)} from gate and deck.   Using plugin from deck.`,
+        );
         if (source === 'deck') {
           this.pluginManifests = this.pluginManifests.filter((x) => x !== duplicateMetaData);
         } else if (source === 'gate') {
@@ -62,13 +92,13 @@ export class PluginRegistry {
 
   // Temporary backwards compat, remove in 2020 after armory has migrated
   normalize(source: ISource, pluginMetaData: IPluginMetaData): INormalizedPluginMetaData {
-    const { devUrl, url, id, name, ...rest } = pluginMetaData;
+    const { devUrl, url, id, name, version } = pluginMetaData;
 
     return {
+      version,
       id: id ?? name,
       url: url ?? devUrl,
       source,
-      ...rest,
     };
   }
 
@@ -87,11 +117,11 @@ export class PluginRegistry {
   public loadPluginManifestFromDeck() {
     const source = 'deck';
     const uri = '/plugin-manifest.json';
-    const loadPromise = Promise.resolve($http.get<IPluginMetaData[]>(uri))
-      .then((response) => response.data)
-      .catch((error: any) => {
+    const loadPromise = fetch(uri, { credentials: 'include' })
+      .then((response) => (response.ok ? response.json() : []))
+      .catch((): IPluginMetaData[] => {
         console.error(`Failed to load ${uri} from ${source}`);
-        throw error;
+        return [];
       });
 
     return this.loadPluginManifest(source, uri, loadPromise);
@@ -101,16 +131,12 @@ export class PluginRegistry {
   public loadPluginManifestFromGate() {
     const source = 'gate';
     const uri = '/plugins/deck/plugin-manifest.json';
-    const loadPromise: PromiseLike<IPluginMetaData[]> = REST(uri)
+    const loadPromise: Promise<IPluginMetaData[]> = REST(uri)
       .get()
-      .catch((error: any) => {
+      .catch((): IPluginMetaData[] => {
         console.error(`Failed to load ${uri} from ${source}`);
-        // If we cannot hit the Gate URL, ignore it
-        if (error.data.status === 404) {
-          console.error(error);
-          return Promise.resolve([]);
-        }
-        throw error;
+        // If the Gate plugin manifest cannot be loaded, ignore and continue
+        return [];
       });
 
     return this.loadPluginManifest(source, uri, loadPromise);
@@ -126,46 +152,55 @@ export class PluginRegistry {
     source: ISource,
     location: string,
     pluginsMetaDataPromise: PromiseLike<IPluginMetaData[]>,
-  ): Promise<IPluginMetaData[]> {
+  ): Promise<Array<INormalizedPluginMetaData | undefined>> {
     try {
       const plugins = await pluginsMetaDataPromise;
-      return plugins.map((pluginMetaData) => this.registerPluginMetaData(source, pluginMetaData));
-    } catch (error) {
+      return (plugins || []).map((pluginMetaData) => this.registerPluginMetaData(source, pluginMetaData));
+    } catch {
       console.error(`Error loading plugin manifest from ${location}`);
-      throw error;
+      return [];
     }
   }
 
-  public loadPlugins(): Promise<any[]> {
-    return Promise.all(this.pluginManifests.map((plugin) => this.load(plugin)));
+  public loadPlugins(): Promise<Array<IPluginModule | undefined>> {
+    return Promise.all(
+      this.pluginManifests.map((plugin) =>
+        Promise.resolve()
+          .then(() => this.load(plugin))
+          .catch(() => {
+            console.error(
+              `Failed to load plugin ${getSafePluginId(plugin)} code from ${getSafePluginUrl(
+                this.getPluginUrl(plugin),
+              )}`,
+            );
+            return undefined;
+          }),
+      ),
+    );
   }
 
-  private async load(pluginMetaData: IPluginMetaData) {
+  private async load(pluginMetaData: INormalizedPluginMetaData): Promise<IPluginModule> {
     this.validateMetaData(pluginMetaData);
 
+    const pluginUrl = this.getPluginUrl(pluginMetaData);
+    const module = await this.loadModuleFromUrl(pluginUrl);
+    if (!module || !module.plugin) {
+      throw new Error(`Successfully loaded plugin module, but it doesn't export an object called 'plugin'`);
+    }
+
+    await registerPluginExtensions(module.plugin);
+    pluginMetaData.module = module;
+    return module;
+  }
+
+  private getPluginUrl(pluginMetaData: IPluginMetaData): string {
     // Use `url` from the manifest, if it exists. This will be the case during local development.
     const { devUrl, url } = pluginMetaData;
     const gateUrl = `${SETTINGS.gateUrl}/plugins/deck/${pluginMetaData.id}/${pluginMetaData.version}/index.js`;
-    const pluginUrl = url ?? devUrl ?? gateUrl;
-
-    try {
-      const module = await this.loadModuleFromUrl(pluginUrl);
-      Object.assign(pluginMetaData, { module });
-
-      if (!module || !module.plugin) {
-        throw new Error(
-          `Successfully loaded plugin module from ${pluginUrl}, but it doesn't export an object called 'plugin'`,
-        );
-      }
-
-      return registerPluginExtensions(module.plugin as IDeckPlugin).then(() => module);
-    } catch (error) {
-      console.error(`Failed to load plugin code from ${pluginUrl}`);
-      throw error;
-    }
+    return url ?? devUrl ?? gateUrl;
   }
 
-  private loadModuleFromUrl(url: string) {
+  private loadModuleFromUrl(url: string): Promise<IPluginModule> {
     // This inline comment is used by webpack to emit a native import() (instead of doing a webpack import)
     // See: https://webpack.js.org/api/module-methods/
     return import(/* webpackIgnore: true */ /* @vite-ignore */ url);