scanner

Barcode and QR scanning where the camera is UNREACHABLE from the plugin: an opaque-origin frame is refused getUserMedia outright (SecurityError: Invalid security origin, and an allow="camera" attribute does not change it — measured), so the HOST page owns the MediaStream and pushes grayscale luminance frames over the postMessage bridge, one in flight at a time, released by the frame's frameDone ack. The frame decodes and returns text plus format; pixels never come back and the cage still has connect-src 'none'. Two decoders: the platform's BarcodeDetector where the engine has one, and a bundled pure-JS zxing (no wasm) for Safari, Firefox and Chromium on Linux. Native is preferred for correctness, not speed — zxing's JS port fails to read some valid QR codes its own encoder produces. No document store, no upload path, no save route: a decoded string goes to the host page and nowhere else.

v0.1.0sandboxed iframe

Install and mount

go get github.com/DonaldMurillo/gofastr-plugins@v0.5.0

import "github.com/DonaldMurillo/gofastr-plugins/scanner"

app.RegisterPlugin(scanner.New())

Isolation

Runs in an opaque-origin iframe

The frame never gets allow-same-origin, so it cannot reach host cookies, the database, or the host DOM. It talks to the host only over the versioned postMessage bridge, limited to the capabilities listed below.

Manifest

Module path: github.com/DonaldMurillo/gofastr-plugins/scanner
Plugin version: 0.1.0
Framework compat: >=0.28.0
Isolation: sandbox-iframe-opaque
Sandbox tokens: allow-scripts
Capabilities: scan:decode, theme:read
Optional capabilities: none
CSP additions: none
Route prefix: /__gofastr/plugin/scanner
Entry: /__gofastr/plugin/scanner/scan.html
Schema: scanner-v1
Min height: 460px
Docs: docs/scanner.md

All plugins