In developing the back-end for an Android/iOS app using some or all MEAN technologies--at least Express.js and Node.js--I'm getting requirements to set it up as a framework so third-parties can code to a published API to develop plugins/modules for my back-end that I might have running on some server somewhere.
This portion might get outsourced to someone else, in which case I would be responsible for ensuring that I communicate the requirements accurately to the assignee.
I'm relatively new to Node and Express, and I'm having difficulty finding information on how to go about writing code for this if I were to do it myself. When I try to search for information on how to create what I described above, I end up getting hits for Express itself or Node itself. Searching for "Express" and "frameworks", I basically get information on Express itself since Express.js is a framework; similarly searching for "Node" and "modules" basically just gives me tons of NPM information since NPM hosts Node modules.
Coming from a C++/C#/Java background, I envision this application would use the equivalent of something like "dlopen" to manually open the equivalent of a .so, .dll, or ,.jar file, find a class that implements an expected interface, and then call methods on that interface.
If I have ten of these or a hundred of these from numerous third-party developers, as the owner of the back-end, would I be responsible for hooking each of these into my application so that my application runs with all of these--with the end user potentially enabling/disabling/configuring zero or more of these for his/her own account via his/her own app?
I'm wondering if I should account for three separate cases for the outside code:
Fully-trusted code developed in-house, so no protection needed. If nothing else, this would help for debugging if ever necessary as a layer of complexity can be removed just to get into the code to get it to run with no frills.
Untrusted code from an arbitrary third party, so it might be beneficial to run it in its own dedicated process at the very least. Regarding the badly designed code, we might want to run our in-house modules in this environment in production anyway just for stability so if a module goes down, it doesn't take the entire Express application down with it.
I'm now wondering if #3 would be the way to go for all cases of #1 and #2 as well. Even for trusted code, simply provide the ability to put in web hooks and stand up separate, compartmentalized services perhaps in isolated Docker containers on the same host for one standardized interface, and don't even bother with "modules" and "plugins".