From 34c2b738018319ffd0d454d65605991e99201d3d Mon Sep 17 00:00:00 2001 From: Alex Dunmow Date: Tue, 7 Jul 2026 23:12:17 +0800 Subject: [PATCH] docs(plugins): captcha = ninjatpl tag + host-stamped X-Bn-Verified-Captcha; core imports forbidden Co-Authored-By: Claude Fable 5 --- developing-blockninja-plugins/SKILL.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/developing-blockninja-plugins/SKILL.md b/developing-blockninja-plugins/SKILL.md index 49d47a6..65a8fa0 100644 --- a/developing-blockninja-plugins/SKILL.md +++ b/developing-blockninja-plugins/SKILL.md @@ -166,6 +166,12 @@ marshaling to host functions. Full family/method table + disposition of every - `Interceptors`, `CoreServiceBindings` — **host-side**; RBAC method roles merge from the manifest, auth context arrives via forwarded HTTP headers (host interceptors already ran). +- **Captcha is host-verified** (pluginsdk ≥ v0.2.2): a guest cannot hold the host's + stateful captcha server, so never import `block/core/captcha` (any core import/require + fails check-safety). Render the widget with the ninjatpl captcha tag; enforce with + `auth.CaptchaVerified(r.Header)` — the host consumes the posted `cap-token` and stamps + the unforgeable `X-Bn-Verified-Captcha` trusted header before dispatch. Fail closed + when it returns false. Reference: calcomblock `HandleCreateBooking`. - `AppURL`/`MediaPath` — delivered once in `LoadRequest.host_config`. - **`deps.Provisioner` (core ≥ v0.17.x) is the seeding path** — `EnsurePage`, `EnsureMenuItem`, `EnsureMedia`, `EnsureSetting`, `MergeSiteSettings`, data