mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
mauriceboe
02c52e63a0
Plugins can now render UI. Page plugins appear as a nav entry and open a full-page sandboxed iframe; the frame talks to TREK only over the postMessage bridge. - Server serves plugin client assets at /plugin-frame/:id/* with a strict path guard and a locked-down, per-plugin CSP (default-src none; connect-src limited to declared outbound hosts; sandbox WITHOUT allow-same-origin -> opaque origin, so the frame can't read the session cookie or the parent DOM). Global CSP frameSrc relaxed from 'none' to 'self' for exactly these frames. - GET /api/plugins feed lists active plugins for the client. - Client: pluginStore + PluginFrame (the trekBridge host) authenticates every inbound message by SENDER WINDOW IDENTITY (event.source), not by a claimed id or origin; pushes context (theme/locale/tripId/userId), validates navigation, renders notifications as text, resizes widgets, and proxies trek:invoke to the plugin's own routes host-side (session cookie stays with the host). - Page route /plugins/:id + Navbar nav injection for page plugins. Dashboard widget slot and the trek:request core-data bridge are deferred to a later slice.
86 lines
3.3 KiB
TypeScript
86 lines
3.3 KiB
TypeScript
import { Controller, Get, Param, Req, Res } from '@nestjs/common';
|
|
import type { Request, Response } from 'express';
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
import { pluginsEnabled } from './kill-switch';
|
|
import { PluginRuntimeService } from './plugin-runtime.service';
|
|
import { pluginCodeDir } from './paths';
|
|
|
|
/**
|
|
* Serves a page/widget plugin's static client from /plugin-frame/:id/* (#plugins,
|
|
* M3). The document is embedded in a sandbox WITHOUT allow-same-origin, so it
|
|
* runs at an OPAQUE origin: it cannot read the trek_session cookie, cannot reach
|
|
* the parent DOM, and its only channel to TREK is the postMessage bridge.
|
|
*
|
|
* Each response gets a locked-down, per-plugin CSP (default-src none; own scripts
|
|
* only; connect-src limited to declared outbound hosts) and a strict path guard
|
|
* so a plugin can only serve files under its own client/ directory.
|
|
*/
|
|
const MIME: Record<string, string> = {
|
|
'.html': 'text/html; charset=utf-8',
|
|
'.js': 'text/javascript; charset=utf-8',
|
|
'.mjs': 'text/javascript; charset=utf-8',
|
|
'.css': 'text/css; charset=utf-8',
|
|
'.json': 'application/json; charset=utf-8',
|
|
'.svg': 'image/svg+xml',
|
|
'.png': 'image/png',
|
|
'.jpg': 'image/jpeg',
|
|
'.jpeg': 'image/jpeg',
|
|
'.gif': 'image/gif',
|
|
'.webp': 'image/webp',
|
|
'.woff2': 'font/woff2',
|
|
'.ico': 'image/x-icon',
|
|
};
|
|
|
|
@Controller('plugin-frame/:pluginId')
|
|
export class PluginFrameController {
|
|
constructor(private readonly runtime: PluginRuntimeService) {}
|
|
|
|
@Get('*path')
|
|
serve(@Param('pluginId') pluginId: string, @Req() req: Request, @Res() res: Response): void {
|
|
if (!pluginsEnabled() || !this.runtime.isActive(pluginId)) {
|
|
res.status(404).send('Plugin not available');
|
|
return;
|
|
}
|
|
|
|
const rest = (req.params as Record<string, unknown>).path ?? (req.params as Record<string, unknown>)[0] ?? '';
|
|
const rel = (Array.isArray(rest) ? rest.join('/') : String(rest)).replace(/^\/+/, '') || 'index.html';
|
|
|
|
const clientDir = path.join(pluginCodeDir(pluginId), 'client');
|
|
const resolved = path.resolve(clientDir, rel);
|
|
// Containment: never escape the plugin's own client/ dir.
|
|
if (!resolved.startsWith(path.resolve(clientDir) + path.sep) && resolved !== path.resolve(clientDir)) {
|
|
res.status(403).send('Forbidden');
|
|
return;
|
|
}
|
|
if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) {
|
|
res.status(404).send('Not found');
|
|
return;
|
|
}
|
|
|
|
const ext = path.extname(resolved).toLowerCase();
|
|
res.setHeader('Content-Type', MIME[ext] ?? 'application/octet-stream');
|
|
res.setHeader('X-Content-Type-Options', 'nosniff');
|
|
res.setHeader('Content-Security-Policy', this.frameCsp(pluginId));
|
|
res.sendFile(resolved);
|
|
}
|
|
|
|
/** Per-plugin, locked-down CSP for the sandboxed frame document. */
|
|
private frameCsp(pluginId: string): string {
|
|
const outbound = this.runtime.outboundHostsOf(pluginId);
|
|
const connect = ["'self'", ...outbound.map((h) => (h.includes('://') ? h : `https://${h}`))].join(' ');
|
|
return [
|
|
"default-src 'none'",
|
|
"script-src 'self'",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
"img-src 'self' data: blob:",
|
|
"font-src 'self' data:",
|
|
`connect-src ${connect}`,
|
|
"frame-ancestors 'self'",
|
|
"base-uri 'none'",
|
|
"form-action 'self'",
|
|
'sandbox allow-scripts allow-forms allow-popups',
|
|
].join('; ');
|
|
}
|
|
}
|