whiteboard

Collaborative whiteboard, and the proof that collaboration does not need a socket in the cage. The frame (Yjs CRDT + a small canvas controller, ~28 KB gzip) runs under connect-src 'none': strokes are order-insensitive binary update blobs that cross the postMessage bridge as ArrayBuffers, and the HOST relays them between browsers — SSE fan-out, replay-on-join, and presence cursors carrying an opaque pid and a colour, never a name, because identity is the host's to decide and the frame is untrusted. The optional sync:room capability is granted exactly when the host wires a room hub; the routes fail closed without one, and a reconnect publishes the frame's full CRDT state so offline edits on both sides converge instead of last-writer-winning.

v0.1.0sandboxed iframe

Install and mount

go get github.com/DonaldMurillo/gofastr-plugins@v0.5.0

import "github.com/DonaldMurillo/gofastr-plugins/whiteboard"

app.RegisterPlugin(whiteboard.New())

Isolation

Runs in an opaque-origin iframe

The frame never gets allow-same-origin, so it cannot reach host cookies, the database, or the host DOM. It talks to the host only over the versioned postMessage bridge, limited to the capabilities listed below.

Manifest

Module path: github.com/DonaldMurillo/gofastr-plugins/whiteboard
Plugin version: 0.1.0
Framework compat: >=0.28.0
Isolation: sandbox-iframe-opaque
Sandbox tokens: allow-scripts
Capabilities: theme:read
Optional capabilities: sync:room
CSP additions: none
Route prefix: /__gofastr/plugin/whiteboard
Entry: /__gofastr/plugin/whiteboard/board.html
Schema: whiteboard-v1
Min height: 480px
Docs: docs/whiteboard.md

All plugins