Connect Invision to Third Party Stores

[Foxtrek_64]

This feature is inspired by another product, Woltlab.

The Woltlab store feature which is very similar to the marketplace here allows site administrators to publish package links. These package links can be added to a client's ACP, and combined with either a username and password for the vendor's site or some kind of token, allows the client's site to securely check for updates to plugins and, given the correct credentials, download and install said updates in a manner similar to how the Marketplace used to work.

Limitations:

• There would need to be some way to properly identify and limit packages available on this link to Invision Applications. Guides, sample html templates, and discographies need not apply.
  • This may be somewhat of a solved issue already, given the Invision marketplace would have needed to deal with this question.
• There should be a disclaimer somewhere that while this method can guarantee that applications were not changed between the time of uploading and the time of downloading (via hashing, which may also be a good way to verify integrity before installing), there is no mechanism for reproducible builds (linking a particular "build" of an application to any particular commit in a source repository), nor does package verification in any way guarantee that any particular download is safe to install or use. Include standard warranty disclaimers.
• Sites which offer this capability should require an HTTPS certificate to be present, used for TLS encryption. We should be able to reuse the one attached to their website. With free certificate providers like Let's Encrypt, this should not be a high bar to pass.
• A Marketplace-like view in the ACP would be nice, but is not required.

This is not intended to provide a new store front, but to alleviate a common complaint I hear about the removal of the marketplace: specifically, users must regularly check several websites for updates to their plugins on a regular basis, and this means maintaining a login with each. This simply provides some sort of automation for checking on updates and optionally installing them if the client's site supports it.