Add secure iframe mode: opaque-origin sandbox + SCORM postMessage bridge#80

Draft

erseco wants to merge 45 commits into

mainfrom

feature/secure-iframe-scorm-bridge

Commits on Jun 13, 2026

feat(security): add iframemode admin setting + player_iframe sandbox policy helper
erseco
committed
feat(scorm): add transport option to scorm_tracker for the bridge
erseco
committed
feat(scorm): add in-iframe SCORM bridge shim with storage polyfill
erseco
committed
feat(security): add parent-side postMessage relay; opaque-origin iframe in view.php
erseco
committed
feat(scorm): inject and ship the bridge client into the package
erseco
committed
test: PHPUnit iframe-mode + Vitest bridge/relay/storage tests
erseco
committed
docs(research): DEC-0059 secure SCORM postMessage bridge (advances DEC-0019)
erseco
committed
fix(playground): force legacy iframemode; document opaque-origin service-worker limitation
erseco
committed
feat(security): serve secure-mode content via tokenpluginfile + CSP/Permissions-Policy
erseco
committed
fix(security): self-heal the bridge client into packages extracted before DEC-0060
erseco
committed
feat(security): show a blocked notice instead of silently downgrading secure->legacy (watchdog)
erseco
committed
fix(playground): show the secure-mode notice instead of forcing legacy (DEC-0060)
erseco
committed
docs(research): DEC-0060 secure iframe via tokenpluginfile (corrects DEC-0059 Route A)
erseco
committed
test: fix CSP test regex so it forbids only the bare https: wildcard, not the site origin
erseco
committed
test: cover new secure-iframe branches (transport, shim/relay/watchdog, content_headers, bridge re-extract)
erseco
committed
fix(security): surface the secure-mode notice right after the iframe load fails
erseco
committed
fix(playground): force iframemode=legacy in the demo blueprint
erseco
committed
Merge branch 'main' into feature/secure-iframe-scorm-bridge
erseco
authored
fix(security): sandbox the package response so it stays opaque outside the iframe
erseco
committed

Commits on Jun 14, 2026

Commits on Jun 18, 2026

Commits on Jun 22, 2026

Merge branch 'main' into feature/secure-iframe-scorm-bridge
erseco
authored

Commits on Jun 26, 2026

Merge branch 'main' into feature/secure-iframe-scorm-bridge
erseco
committed