formbuilder
Form-schema authoring tool — the first plugin whose output the framework itself consumes and enforces. A drag-to-reorder field list plus a property panel in an opaque-origin sandboxed iframe (no vendor library) edits a canonical doc that is DATA ONLY: {version, fields[]} per formbuilder-v1, never markup — Go validates every save and refuses bad schemas with specific 400 codes (unknown type, duplicate/empty/invalid name, malformed rule, unknown version, markup). The demo closes the loop: a second route renders the SAVED schema as a real working form through GoFastr's own ui.Form and re-validates every rule server-side on POST, with zero client trust in the path.
v0.1.0sandboxed iframe
Install and mount
go get github.com/DonaldMurillo/gofastr-plugins@v0.5.0
import "github.com/DonaldMurillo/gofastr-plugins/formbuilder"
app.RegisterPlugin(formbuilder.New())Isolation
Runs in an opaque-origin iframe
The frame never gets allow-same-origin, so it cannot reach host cookies, the database, or the host DOM. It talks to the host only over the versioned postMessage bridge, limited to the capabilities listed below.
Manifest
- Plugin version
- 0.1.0
- Framework compat
- >=0.28.0
- Isolation
- sandbox-iframe-opaque
- Sandbox tokens
- allow-scripts
- Capabilities
- document:read, document:write, theme:read
- Optional capabilities
- none
- CSP additions
- none
- Route prefix
/__gofastr/plugin/formbuilder- Entry
/__gofastr/plugin/formbuilder/builder.html- Schema
- formbuilder-v1
- Min height
- 560px