Secure opaque-origin viewer, SCORM/xAPI bridge and opaque editor preview - #80

Draft

erseco wants to merge 102 commits into

mainfrom

feature/secure-iframe-scorm-bridge

Commits on Jun 13, 2026

feat(security): add iframemode admin setting + player_iframe sandbox policy helper
erseco
committed
feat(scorm): add transport option to scorm_tracker for the bridge
erseco
committed
feat(scorm): add in-iframe SCORM bridge shim with storage polyfill
erseco
committed
feat(security): add parent-side postMessage relay; opaque-origin iframe in view.php
erseco
committed
feat(scorm): inject and ship the bridge client into the package
erseco
committed
test: PHPUnit iframe-mode + Vitest bridge/relay/storage tests
erseco
committed
docs(research): DEC-0059 secure SCORM postMessage bridge (advances DEC-0019)
erseco
committed
fix(playground): force legacy iframemode; document opaque-origin service-worker limitation
erseco
committed
feat(security): serve secure-mode content via tokenpluginfile + CSP/Permissions-Policy
erseco
committed
fix(security): self-heal the bridge client into packages extracted before DEC-0060
erseco
committed
feat(security): show a blocked notice instead of silently downgrading secure->legacy (watchdog)
erseco
committed
fix(playground): show the secure-mode notice instead of forcing legacy (DEC-0060)
erseco
committed
docs(research): DEC-0060 secure iframe via tokenpluginfile (corrects DEC-0059 Route A)
erseco
committed
test: fix CSP test regex so it forbids only the bare https: wildcard, not the site origin
erseco
committed
test: cover new secure-iframe branches (transport, shim/relay/watchdog, content_headers, bridge re-extract)
erseco
committed
fix(security): surface the secure-mode notice right after the iframe load fails
erseco
committed
fix(playground): force iframemode=legacy in the demo blueprint
erseco
committed
Merge branch 'main' into feature/secure-iframe-scorm-bridge
erseco
authored
fix(security): sandbox the package response so it stays opaque outside the iframe
erseco
committed

Commits on Jun 14, 2026

Commits on Jun 18, 2026

Commits on Jun 22, 2026

Merge branch 'main' into feature/secure-iframe-scorm-bridge
erseco
authored

Commits on Jun 26, 2026

Merge branch 'main' into feature/secure-iframe-scorm-bridge
erseco
committed

Commits on Jun 29, 2026

Commits on Jun 30, 2026

Commits on Jul 2, 2026

docs(embed): repoint embedder header to eXe core as the canonical source
erseco
committed

Commits on Jul 6, 2026

Commits on Jul 11, 2026

Commits on Jul 12, 2026

docs(preview): document core artifact activation testing
erseco
committed

Commits on Jul 20, 2026

Commits on Jul 25, 2026

Commits on Jul 29, 2026