Load dashboard specified in type index

[jg10-mastodon-social]

I'm creating this issue to be an implementable version of the parent issue #14

My vision is that pos-app-browser supports multiple different pane loading mechanisms, and we therefore start with one, knowing there will be others.

This sub-issue proposes to follow the draft spec in https://jg10.solidcommunity.net/open-with/databrowser-open-with-v0.html#pane-class-podos-compatible-panes

1. Type indexes are extended with a predicate to link to a pane
2. The pane specifies a dashboard either as a URL that dereferences to a conforming HTML fragment, or a string with the HTML fragment itself.
3. pos-type-router loads registered dashboards and their type and selects one or more apps/tools or dashboards (see Allow multiple tools per resource  #78)
4. rendering involves safely adding the HTML fragment to the dom in such a way that init and resource events are respected

Remaining decisions:

• Where should new vocabulary terms be defined?
  • While allowing multiple classes of pane is forward compatible, it would also be possible as a stopgap measure to use a single predicate, directly on the type index, e.g. :MyTypeRegistration PodOS:paneURL <path>
  • Either way, there will be PodOS-specific predicates to define.
• What sanitization to apply to the HTML - should even inline event handlers be stripped, or is setting innerHTML sufficient (which doesn't execute script tags)

[jg10-mastodon-social]

• Where should new vocabulary terms be defined?

I propose to mint https://browser.pod-os.org/terms#htmlToolUrl and to document this in a new decision "self-host core browser vocabulary"

Some notes to support this -

Considered options:

• Use https://w3id.org/
• Advocate for inclusion in other vocabularies
• Participate in developing new vocabularies
• Self-host vocabulary

Decision drivers:

• Time to publication of new term
• Expected breadth of use of new term
• Potential for replacement by a wider standard

While the ADR would document further, my key argument is that RDF terms for core browser vocabulary are intended firstly for internal use (while allowing for third party interoperability), and should therefore be self-hosted alongside the browser and with only a weak commitment to ongoing use. The terms do not form part of a standard and while they will be preserved as cool URIs, PodOS reserves the right to deprecate them and abandon their use in future.
In general, PodOS will adopt and support development of standards, and may define terms for internal use in the short term.

As imagined in the issue above, I also propose that the domain of the predicate will initially be solid:TypeRegistration but that as standardisation efforts progress, the domain might be extended.

[jg10-mastodon-social]

What sanitization to apply to the HTML - should even inline event handlers be stripped, or is setting innerHTML sufficient (which doesn't execute script tags)

When dynamic loading is enabled, I think we should lock it down completely -

• use CSP to prevent unsafe-eval and unsafe-inline script-src in particular
• use DOMPurify with added tags and attributes whitelisted to include only those that a dashboard creator is allowed to use, which may not even be all elements
  • validate provided attribute values to ensure they are actually safe, especially for attributes that DOMPurify considers safe by default

For DOMPurify, given the whitelisting approach, this poses the testing problem that we need to avoid features being inadvertently blocked.
I think this will require new unit tests for each whitelisted element.

As a minimal acceptance criteria for a first PR, I suggest only:

• DOMPurify is applied, and pos-label is whitelisted (which has no attributes)

[jg10-mastodon-social]

As an MVP, I now suggest that only HTML fragments defined directly in the type index are loaded. This reduces complexity and risk for a first spike.

Proposed acceptance criteria:

• New term is hosted and documented in RDFS at https://browser.pod-os.org/terms#htmlToolFragment
• When a resource is loaded, a matching pane is identified in the type index
• DOMPurify is applied to the HTML, and pos-label is whitelisted (which has no attributes)
• The HTML is inserted into the page
• The resource event is respected (init is not yet tested) and pos-label renders.

If this sounds ok as a spike, I'll create a sub-issue and PR.

[jg10-mastodon-social]

First attempt at definition of the term

podos:htmlToolFragmentTypeRegistration a sh:NodeShape ;
sh:class solid:TypeRegistration;
sh:property [
  sh:path solid:forClass;
  sh:nodeKind sh:IRI;
  sh:mincount 1
];
sh:property [
  sh:path podos:htmlToolFragment;
  sh:datatype rdf:HTML;
  sh:mincount 1
].

podos:htmlToolFragment a rdfs:Property;
rdfs:label "Fragment defining a PodOS HTML tool";
rdfs:range rdf:HTML.

RDFS deliberately leaves domain open, consistent with comments above.
SHACL is currently underspecified for the same reason. Multiple classes and fragments could in principle be supported. The shape could be versioned instead and fully specified.