Architecture

Intro

Airborn consists of multiple parts, many of which are isolated from the others with sandboxed <iframe>s. They communicate with window.postMessage(). To see how that works, see Internal API: underlying postMessage layer.

Bootstrap

When you open airborn.io, served by airborn-server, you get back bootstrap.html, which loads bootstrap.js. bootstrap.js handles logging in:

1. First, you enter your username and password
2. bootstrap.js proves to the server that you have the password (without sending it)
3. bootstrap.js downloads and decrypts with your password /hmac and /key, which are used to locate and decrypt all other files, respectively
4. bootstrap.js downloads, decrypts and globally eval()s init.js

If your details are still stored in sessionStorage or localStorage (depending on whether you checked "Remain logged in"), bootstrap.js skips steps 1 and 3.

init.js

init.js downloads, decrypts and globally eval()s core.js and startup.js, and also hides the login form.

core.js and startup.js

After you're fully logged in, core.js now lives directly at window.top (not inside a sandbox). It handles access to your files, all messages sent to window.top, setting browser window properties, and logging out again.

The distinction between core.js and startup.js is that core.js is supposed to only provide functionality, while startup.js actually does something with it. It can be viewed as a sort of function main() {}.

Elsewhere, "core.js" is used to refer to both core.js and startup.js.

laskyawm.js

core.js also opens a sandboxed <iframe> with laskyawm.html (and laskyawm.js) in it.

laskyawm.js creates the app launcher and creates and manages all windows and tabs that you open.

compat.js

Whenever you create a window or tab with an app in it, laskyawm.js creates another sandboxed <iframe> for it inside laskyawm. It also injects a reference to compat.js into the app. compat.js tries to make the environment inside the sandboxed iframe as normal as possible (see App Runtime).