| name | playcanvas-editor-universo-compat |
| description | Use when working with the PlayCanvas Editor wrapper boundary inside the Universo platform, security sandboxing (iframes), window.config injection, bridge messages, and metahub storage. |
| metadata | {"version":"1.0.0","scope":"playcanvas-editor-universo-compat","file_policy":"markdown-only"} |
PlayCanvas Editor Universo Compatibility
Use this skill when developing or reviewing the wrapper boundary between the hosted Editor artifact and the main Universo React/MUI dashboard application.
Version Guard
- Governs
@universo-react/playcanvas-editor-frontend and @universo-react/playcanvas-editor-backend.
- Enforces security guidelines for the sandbox iframe environment.
Required Output
Before changing the bridge or security configurations:
- describe the message format sent across the iframe postMessage bridge;
- state the origin URL and sandbox attributes used on the iframe;
- detail how
window.config variables are generated and sanitized.
Workflow
- The editor is loaded inside an iframe with restricted sandbox attributes (e.g.
allow-scripts, allow-same-origin).
- Communication between the host and the editor is handled via the bridge contract using the window postMessage API or custom bridge listeners.
- Configuration parameters (access tokens, endpoints) are parsed by the backend and injected dynamically into the editor context.
- Scene assets are saved and read through the metahub-scoped storage adapters.
Blocking Rules
- Do not let the editor iframe access the host page DOM directly.
- Do not bypass Same-Origin verification on received messages. All messages must be origin-checked.
- Do not expose administrative API configurations to the editor runtime.
- Do not bypass token expirations; the bridge must request a fresh token before expiration occurs.
