Skip to content

Conversation

@jg10-mastodon-social
Copy link
Collaborator

@jg10-mastodon-social jg10-mastodon-social commented Aug 31, 2025

Closes #146

  • New term is hosted and documented in RDFS at https://browser.pod-os.org/terms#htmlToolFragment
  • ADR to self-host core browser vocabulary
  • When a resource is loaded, a matching pane is identified in the type index
    • A tool is added for each matching pane
    • New TypeIndex class in PodOS core
  • DOMPurify is applied to the HTML, and pos-label is whitelisted (which has no attributes)
  • The HTML is inserted into the page
  • The resource event is respected (init is not yet tested) and pos-label renders.

  • Tests have been written
    • all new code is covered by unit tests
    • the happy path of a new feature is covered by an end-to-end test
    • manual explorative tests have been performed
  • all dependencies are updated to the latest patch version at minimum
  • the CI pipeline passes
  • documentation is up-to-date
    • TSDoc style comments on important functions, properties and events
    • stories for new PodOS elements have been added to storybook
    • Readme.md files of PodOS elements have been re-generated
    • architectural decisions are documented as an ADR
    • Changelogs are updated according to
      Keep a Changelog

it('is whitelisted by sanitizeHtmlTool', () => {
const sanitized = sanitizeHtmlTool('<pos-label/>');
expect(sanitized).toEqual('<pos-label/>');
});
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As noted in #126 (comment), my intention here is that each white-listed component would manage its own set of tests to ensure that the HTML sanitization whitelists the right attributes etc. So when other changes are made, then these HTML sanitization tests are also updated.
(This is obviously dependent on getting DOMPurify to run correctly in the tests.)

],
fragment: '<pos-label/>',
},
];
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will need to be loaded from type index with defaults for missing values. New PodOS core methods will be needed.

<SelectedTool class="tool visible"></SelectedTool>
{SelectedTool == 'pos-html-tool' ? (
<pos-html-tool
fragment={(this.currentTool as HTMLToolConfig).fragment}
Copy link
Collaborator Author

@jg10-mastodon-social jg10-mastodon-social Nov 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not quite the right solution to support more than one HTML tool (if several types match). It doesn't allow them to be addressed separately through URL params.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm considering instead allowing tools to be registered with a unique name. This would be user friendly but require an additional predicate to be present in the registration.
Another alternative would be a hash of their content. This would more opaque.

@jg10-mastodon-social
Copy link
Collaborator Author

The current implementation works - navigating to http://localhost:3333/?uri=https%3A%2F%2Fjg10.solidcommunity.net%2Fpantry%2Fblog%2F01%2Frosti.ttl%23it&tool=pos-html-tool displays the recipe label, but see comments above for remaining (major) issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

HTML Tool PoC spike for fragment defined in type index

2 participants