Pandore/homarr
Public Access
1
0 Fork 0
Code Actions Activity

feat(custom-widgets): full Mantine v9 + SubFetch support for custom JSX

Browse Source 
Massively expands the custom JSX widget system to support virtually all
Mantine v9 components and adds in-widget HTTP request capabilities via
a server-proxied SubFetch system.

- Whitelist ~100 Mantine components (core, all 16 charts, dates)
- Add SubFetch, SubData, ActionButton, ToggleSwitch, RefreshButton
- Add server-side subFetch tRPC mutation with same-origin + auth
- Show HTTP method warning badges in widget and admin preview
- Remove `fetch` from forbidden keywords, increase template to 50KB
- Expand bindings: Date.*, parseInt, parseFloat, Array.from, etc.
- Update AI prompt with full component reference + demo templates
This commit is contained in:
Thomas Camlong committed 2026-07-12 00:42:31 +02:00
1 parent 576856d634
commit aa8410d326
12 files changed
+1164 -257
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/validation/src/custom-widget.ts
+4 -4
View File
@@ -258,7 +258,7 @@ const rawDisplayConfigSchema = z.object({
});
const FORBIDDEN_TEMPLATE_PATTERN =
/\bconstructor\b|\b__proto__\b|\bprototype\b|\beval\b|\bFunction\b|\bimport\s*\(|\brequire\b|\bglobalThis\b|\bwindow\b|\bdocument\b|\bfetch\b|\bXMLHttpRequest\b/i;
/\bconstructor\b|\b__proto__\b|\bprototype\b|\beval\b|\bFunction\b|\bimport\s*\(|\brequire\b|\bglobalThis\b|\bwindow\b|\bdocument\b|\bXMLHttpRequest\b/i;
const customJsxDisplayConfigSchema = z.object({
type: z
@@ -267,13 +267,13 @@ const customJsxDisplayConfigSchema = z.object({
template: z
.string()
.min(1)
.max(10000)
.max(50000)
.refine((t) => !FORBIDDEN_TEMPLATE_PATTERN.test(t), {
message:
"Template contains forbidden keywords (constructor, __proto__, eval, Function, import, require, globalThis, window, document, fetch)",
"Template contains forbidden keywords (constructor, __proto__, eval, Function, import, require, globalThis, window, document)",
})
.describe(
"JSX template string using whitelisted Mantine components. Access API data via {data.fieldName}. Forbidden keywords: constructor, __proto__, eval, Function, import, require, globalThis, window, document, fetch",
"JSX template string using whitelisted Mantine components. Access API data via {data.fieldName}. Use SubFetch for in-widget HTTP requests. Forbidden keywords: constructor, __proto__, eval, Function, import, require, globalThis, window, document",
),
});