Extending a GPL website by web service plugin

Question

Please consider this situation.

• A company modifies a GPLed website X and adds a feature to accept plugin.
• Then develops a new feature as API service Y and publishes it separately. Service Y needs to have some information from main apps and can get them by receiving messages -or- fetching from identity database.
• After that writes a plugin on website X to integrate it with service Y (for example by adding a widget and filling it by REST request to service Y).
• Finaly runs website X as a website on own server and serves requests from the globes.

Now:

1. Does the GPL say they must release program X and plugin sources?
2. Does the GPL say they must release service Y sources?
3. Program A is a website and user can receive client side JS codes from browser. Does it mean "distribution" in GPL terms?
4. What would happen if website X were published under AGPL?

Answer 1

Does the GPL say they must release program X and plugin sources?

In brief, the GPL says that anyone who receives the binaries of X or derivative works of X must also receive the sources. This answer deals with the issue of whether or not the plugin is a derivative work of X; other answers on this site also address the issue.

Does the GPL say they must release service Y sources?

As with the plugin, it depends on whether service Y is so tightly-coupled to X that it becomes a derivative work thereof. I personally don't think that a REST API constitutes tight coupling, but I could be wrong.

Program X [I assume you meant X] is a website and user can receive client side JS codes from browser. Does it mean "distribution" in GPL terms?

I don't believe there is much settled work on the licensing of JavaScript code; certainly the question doesn't often seem to trouble web developers. I have advocated an approach that treats code that the user neither asked for nor had foreknowledge of the delivery thereof in the same manner as unsolicited goods, which in England and Wales become the property of the recipient, but such is not (yet) a widely-held point of view.

I fear you would have an uphill battle convincing a court that receiving JS from the website meant you had received the entire binary of modified-X, and were now therefore entitled to a copy of the entire sources as per your q1.

What would happen if website X were published under AGPL?

That would expand the group of people entitled to receive the source code from "those who have received the binaries" to "those who have received the binaries and those who have interacted with the work remotely via a computer network".