fix(api): accept sso_verified access mode and unknown plugin install statuses

api/core/plugin/entities/plugin_daemon.py

@@ -194,7 +194,7 @@ class PluginInstallTaskStatus(StrEnum):
 class PluginInstallTaskPluginStatus(BaseModel):
     plugin_unique_identifier: str = Field(description="The plugin unique identifier of the install task.")
     plugin_id: str = Field(description="The plugin ID of the install task.")
-    status: PluginInstallTaskStatus = Field(description="The status of the install task.")
+    status: PluginInstallTaskStatus | str = Field(description="The status of the install task.")
     message: str = Field(description="The message of the install task.")
     icon: str = Field(description="The icon of the plugin.")
     labels: I18nObject = Field(description="The labels of the plugin.")
@@ -202,7 +202,7 @@ class PluginInstallTaskPluginStatus(BaseModel):
 
 
 class PluginInstallTask(BasePluginEntity):
-    status: PluginInstallTaskStatus = Field(description="The status of the install task.")
+    status: PluginInstallTaskStatus | str = Field(description="The status of the install task.")
     total_plugins: int = Field(description="The total number of plugins to be installed.")
     completed_plugins: int = Field(description="The number of plugins that have been installed.")
     plugins: list[PluginInstallTaskPluginStatus] = Field(description="The status of the plugins.")

api/openapi/markdown/console-openapi.md

@@ -21989,7 +21989,7 @@ Shared permission levels for resources (datasets, credentials, etc.)
 | created_at | dateTime |  | Yes |
 | id | string |  | Yes |
 | plugins | [ [PluginInstallTaskPluginStatus](#plugininstalltaskpluginstatus) ] | The status of the plugins. | Yes |
-| status | [PluginInstallTaskStatus](#plugininstalltaskstatus) | The status of the install task. | Yes |
+| status | [PluginInstallTaskStatus](#plugininstalltaskstatus)<br>string | The status of the install task. | Yes |
 | total_plugins | integer | The total number of plugins to be installed. | Yes |
 | updated_at | dateTime |  | Yes |
 
@@ -22003,7 +22003,7 @@ Shared permission levels for resources (datasets, credentials, etc.)
 | plugin_id | string | The plugin ID of the install task. | Yes |
 | plugin_unique_identifier | string | The plugin unique identifier of the install task. | Yes |
 | source | string | The installation source of the plugin | No |
-| status | [PluginInstallTaskStatus](#plugininstalltaskstatus) | The status of the install task. | Yes |
+| status | [PluginInstallTaskStatus](#plugininstalltaskstatus)<br>string | The status of the install task. | Yes |
 
 #### PluginInstallTaskStartResponse
 

api/services/enterprise/enterprise_service.py

@@ -312,7 +312,12 @@ class EnterpriseService:
         def update_app_access_mode(cls, app_id: str, access_mode: str):
             if not app_id:
                 raise ValueError("app_id must be provided.")
-            allowed = {WebAppAccessMode.PUBLIC, WebAppAccessMode.PRIVATE, WebAppAccessMode.PRIVATE_ALL}
+            allowed = {
+                WebAppAccessMode.PUBLIC,
+                WebAppAccessMode.PRIVATE,
+                WebAppAccessMode.PRIVATE_ALL,
+                WebAppAccessMode.SSO_VERIFIED,
+            }
             if access_mode not in allowed:
                 raise ValueError(f"access_mode must be one of: {', '.join(m.value for m in allowed)}")
 

api/tests/unit_tests/core/plugin/test_plugin_entities.py

@@ -17,7 +17,7 @@ from core.plugin.entities.parameters import (
     cast_parameter_value,
     init_frontend_parameter,
 )
-from core.plugin.entities.plugin_daemon import CredentialType
+from core.plugin.entities.plugin_daemon import CredentialType, PluginInstallTask, PluginInstallTaskStatus
 from core.plugin.entities.request import (
     RequestInvokeLLM,
     RequestInvokeSpeech2Text,
@@ -337,6 +337,34 @@ class TestPluginDaemonEntities:
         with pytest.raises(ValueError, match="Invalid credential type"):
             CredentialType.of("invalid")
 
+    @pytest.mark.parametrize(
+        ("raw", "expected"),
+        [("success", PluginInstallTaskStatus.Success), ("a-status-added-later", "a-status-added-later")],
+    )
+    def test_install_task_parses_known_and_unknown_statuses(self, raw, expected):
+        plugin = {
+            "plugin_unique_identifier": "langgenius/openai:0.1.0@abc",
+            "plugin_id": "langgenius/openai",
+            "status": raw,
+            "message": "",
+            "icon": "",
+            "labels": {"en_US": "OpenAI"},
+        }
+        task = PluginInstallTask.model_validate(
+            {
+                "id": "task-1",
+                "created_at": "2026-01-01T00:00:00Z",
+                "updated_at": "2026-01-01T00:00:00Z",
+                "status": raw,
+                "total_plugins": 1,
+                "completed_plugins": 0,
+                "plugins": [plugin],
+            }
+        )
+
+        assert task.status == expected
+        assert task.plugins[0].status == expected
+
 
 class TestPluginRequestEntities:
     def test_request_invoke_llm_converts_prompt_messages(self):

api/tests/unit_tests/services/enterprise/test_enterprise_service.py

@@ -183,6 +183,15 @@ class TestWebAppAuth:
         with pytest.raises(ValueError, match="access_mode must be"):
             EnterpriseService.WebAppAuth.update_app_access_mode("a1", "invalid")
 
+    def test_update_access_mode_accepts_sso_verified(self):
+        with patch(f"{MODULE}.EnterpriseRequest") as req:
+            req.send_request.return_value = {"result": True}
+            EnterpriseService.WebAppAuth.update_app_access_mode("a1", "sso_verified")
+
+        req.send_request.assert_called_once_with(
+            "POST", "/webapp/access-mode", json={"appId": "a1", "accessMode": "sso_verified"}
+        )
+
     def test_update_access_mode_delegates_and_returns(self):
         with patch(f"{MODULE}.EnterpriseRequest") as req:
             req.send_request.return_value = {"result": True}

packages/contracts/generated/api/console/workspaces/types.gen.ts

@@ -1569,7 +1569,7 @@ export type PluginInstallTask = {
   created_at: string
   id: string
   plugins: Array<PluginInstallTaskPluginStatus>
-  status: PluginInstallTaskStatus
+  status: PluginInstallTaskStatus | string
   total_plugins: number
   updated_at: string
 }
@@ -2316,7 +2316,7 @@ export type PluginInstallTaskPluginStatus = {
   plugin_id: string
   plugin_unique_identifier: string
   source?: string | null
-  status: PluginInstallTaskStatus
+  status: PluginInstallTaskStatus | string
 }
 
 export type PluginInstallTaskStatus = 'failed' | 'pending' | 'running' | 'success'

packages/contracts/generated/api/console/workspaces/zod.gen.ts

@@ -2399,7 +2399,7 @@ export const zPluginInstallTaskPluginStatus = z.object({
   plugin_id: z.string(),
   plugin_unique_identifier: z.string(),
   source: z.string().nullish(),
-  status: zPluginInstallTaskStatus,
+  status: z.union([zPluginInstallTaskStatus, z.string()]),
 })
 
 /**
@@ -2410,7 +2410,7 @@ export const zPluginInstallTask = z.object({
   created_at: z.iso.datetime(),
   id: z.string(),
   plugins: z.array(zPluginInstallTaskPluginStatus),
-  status: zPluginInstallTaskStatus,
+  status: z.union([zPluginInstallTaskStatus, z.string()]),
   total_plugins: z.int(),
   updated_at: z.iso.datetime(),
 })