Plugins: document topbar/sidebar slots, message decorators, SRI

This commit is contained in:
reverse 2026-06-20 08:38:52 +00:00
parent d4d93bfd39
commit cf2dec44ed
No known key found for this signature in database

View file

@ -21,7 +21,14 @@ Add script URLs to `plugins` in [`config.json`](https://orbit.tchatou.fr/docs/co
```
They load in order, after the app boots. Host them anywhere the page can reach
(same-origin recommended).
(same-origin recommended). For a third-party origin, pin the file with
Subresource Integrity by giving an object instead of a URL:
```json
{ "plugins": [{ "url": "https://cdn.example/x.js", "integrity": "sha384-…" }] }
```
(`crossorigin` defaults to `anonymous` when an `integrity` hash is set.)
## A quick plugin
@ -75,6 +82,7 @@ instead. See **[Compiled plugins](https://orbit.tchatou.fr/docs/compiled-plugins
| `orbit.storage.get(key, def)/set(key, val)` | namespaced persistence |
| `orbit.addUi(slot, render)` | add UI to a slot (returns a remover) |
| `orbit.addSettingsSection({label, icon?, render})` | add a whole Settings section |
| `orbit.addMessageDecorator(m => …)` | append UI to every message; `m` = `{id, nick, text, kind, ts, mine}` |
| `orbit.h / orbit.html` | render helpers |
| `log(…)` | namespaced console logger |
@ -89,10 +97,14 @@ instead. See **[Compiled plugins](https://orbit.tchatou.fr/docs/compiled-plugins
| Slot | Where |
|---|---|
| `composer_button` | a button in the message composer toolbar |
| `topbar_item` | an item in the channel topbar action row (next to search / notifications) |
| `sidebar_item` | an item in the conversation sidebar header (next to the compose button) |
| `settings_section` | a whole section in Settings (own nav entry + pane) — use `orbit.addSettingsSection()` |
More slots (message decorators, side panels) will be added as the core grows
stable homes for them.
Message decorators are added with `orbit.addMessageDecorator(m => …)` rather than
a slot — the callback runs for every rendered message. Every contributed slot and
decorator renders inside its own error boundary, so a crashing plugin renders
nothing instead of taking down the app.
## Trust & security