sqlnotebook
A SQL notebook running a real SQLite engine (sql.js, WebAssembly) inside the opaque-origin frame. Query a database in the browser that has no way to reach the network: connect-src 'none' means the frame cannot even fetch its own engine, so the host hands the .wasm across the bridge as bytes. This is the only plugin here that opts into the 'wasm-unsafe-eval' tier, and the tier grants exactly that: eval() and new Function() stay refused, storage and cookies stay unreachable, the origin stays opaque.
v0.1.0sandboxed iframe
Install and mount
go get github.com/DonaldMurillo/gofastr-plugins@v0.5.0
import "github.com/DonaldMurillo/gofastr-plugins/sqlnotebook"
app.RegisterPlugin(sqlnotebook.New())Isolation
Runs in an opaque-origin iframe
The frame never gets allow-same-origin, so it cannot reach host cookies, the database, or the host DOM. It talks to the host only over the versioned postMessage bridge, limited to the capabilities listed below.
Manifest
- Plugin version
- 0.1.0
- Framework compat
- >=0.74.0
- Isolation
- sandbox-iframe-opaque
- Sandbox tokens
- allow-scripts
- Capabilities
- theme:read
- Optional capabilities
- none
- CSP additions
- 'wasm-unsafe-eval'
- Route prefix
/__gofastr/plugin/sqlnotebook- Entry
/__gofastr/plugin/sqlnotebook/frame.html- Schema
- sqlnotebook.v1
- Min height
- 360px