A plugin can contribute navigation, extension components and widgets through the IPlugin contract.
Navigation#
PluginNavigation supports optional public, admin and settings areas. Admin/settings navigation can be grouped by key; menu items can include title, URL, icon, priority, badge, roles and permissions. Keep role/permission metadata aligned with the authorization rules enforced by the server.
Extension points#
PluginExtension identifies a component by id, target and point, and can set priority, metadata, role restrictions and permission restrictions. Render extensions using the corresponding extension-point component exported by the appropriate server/client entry point.
Widgets#
PluginWidget has an id, display name, target area, React component, priority and optional default row/column spans. The package includes widget-area and composer components, including client variants. Use the /client subpath for components that require client interactivity.
Security and compatibility#
- Treat navigation visibility as presentation, not authorization.
- Check permissions again in the server action or route that performs the operation.
- Validate plugin-provided metadata before persistence.
- Keep client-only components out of server-only entry points.
- Test extension ordering and widget layout with multiple plugins enabled.
