richtext
Full Rich Text block editor built on ProseMirror. Block-JSON canonical, markdown export + a pure-Go SSR read view (richtext/ssr). The first heavy-JS plugin and the forcing function that proved the third-party isolation contract.
v0.1.0-phase0sandboxed iframe
Install and mount
go get github.com/DonaldMurillo/gofastr-plugins@v0.5.0
import "github.com/DonaldMurillo/gofastr-plugins/richtext"
app.RegisterPlugin(richtext.New())Isolation
Runs in an opaque-origin iframe
The frame never gets allow-same-origin, so it cannot reach host cookies, the database, or the host DOM. It talks to the host only over the versioned postMessage bridge, limited to the capabilities listed below.
Manifest
- Plugin version
- 0.1.0-phase0
- Framework compat
- >=0.28.0
- Isolation
- sandbox-iframe-opaque
- Sandbox tokens
- allow-scripts
- Capabilities
- document:read, document:write, upload:images, theme:read
- Optional capabilities
- none
- CSP additions
- none
- Route prefix
/__gofastr/plugin/richtext- Entry
/__gofastr/plugin/richtext/editor.html- Schema
- richtext-v1
- Min height
- 240px