Home
Reference
The documents in this section provide reference material and samples for Domino Leap.
Custom Widget API
This API provides a mechanism to incorporate custom widgets into the HCL Domino Leap product.
Security Considerations
This topic describes security considerations for Custom Widget API.

Reference
The documents in this section provide reference material and samples for Domino Leap.
- REST API reference
  The REST API can be used by other programs to communicate with Domino Leap.
- JavaScript™ API
- Services
  The following topics provide reference information about adding services to Domino Leap.
- Embedding items in an iframe
  You can use iFrames to embed charts and applications in a web page.
- Embedding API
  The Embedding API is used to embed a Domino Leap form directly in another webpage without using an <iframe>. The Domino Leap form is inserted into the DOM of the hosting page and can be interacted with using the JavaScript API or any custom JavaScript. Additionally, the style of items in the form can be customized by the CSS of the hosting page.
- Creating customized Cascading Style Sheets
  You can apply your own custom Cascading Style Sheet (CSS) to the rendering of your Domino Leap application. To create a custom theme, you must be familiar with the basic concepts of CSS.
- Custom Widget API
  This API provides a mechanism to incorporate custom widgets into the HCL Domino Leap product.
  - Data Widgets vs Display Widgets
    Some widgets are for collecting data (ie. "data widgets") and others are presentational in nature (ie. "display widgets").
  - Data Types
    Data widgets can declare one of the listed data types, each with additional optional constraints.
  - Rules
    App authors will be able to incorporate custom widgets in rules.
  - Built-In Properties
    Some properties that already exist in the product are general purpose, or, are integral to the proper functioning of a widget.
  - Custom Properties
    The custom widget can define an array of custom properties for the app author to modify.
  - Widgets with Options
    Widgets that allow the end-user to select from a set of options require specific treatment. This includes widgets such as dropdowns, radio groups, or checkbox groups. These options could be hardcoded in the custom widget, or defined by the app author.
  - Widget Instantiation
    The widget instantiate() function is called when an instance of the custom widget needs to be created. The function is expected to return an object that allows Domino Leap to interact with the instantiated widget.
  - Aggregation Widgets
    A custom widget with a datatype of aggregation is a special type of data widget that can achieve the use-case of a repeating section.
  - Validation
    Some intrinsic validation will be done according to the type and constraints declared in the widget's datatype property; however, it might be necessary for a widget to supply its own custom validation logic.
  - Internationalization
    Certain attributes of the widget definition can be displayed to app authors working in different locales. To support multiple languages during authoring, some properties can be specified as "multi-string" objects rather than a plain string values.
  - Usage of JavaScript API
    Custom widgets can use Domino Leap's JavaScript API to help achieve their objectives.
  - Versioning
    This topic describes the widget's version.
  - Upgrading
    The exact techniques for upgrading widgets from one major version to the next has not yet been established.
  - Security Considerations
    This topic describes security considerations for Custom Widget API.
  - Incorporating third-party libraries
    This topic describes incorporating third-party libraries.
  - Known limitations
  - Examples

Security Considerations

This topic describes security considerations for Custom Widget API.

It is the responsibility of the widget creator to avoid script injection attacks by ensuring that values are sanitized or escaped properly before placing them into the DOM. In general, the widget creator is responsible for following secure engineering practices.
The custom widget code has full access to the page, but it should not call product functions, manipulate the product's JavaScript values, or interact with the product's DOM nodes in any way that is not prescribed by this API. Doing so could jeporadize the security of the product and break your custom widgets in future product releases.
As stated above, special care must be taken when supplying a getJSAPIFacade() function to expose additional widget capabilities for app authors to leverage in their custom JavaScript. These functions should provide tightly constrained interactions with the custom widget, with no possibility for script injection or access to the widget's internal objects or its DOM, or those of the product. The "facade" naming is a reminder that the app author's code should only get references to values and objects that are necessary and "safe".
It is the responsibility of widget creators and Leap administrators to ensure that only trusted stable resources are loaded into Leap's pages. The specified additional resources will be loaded directly into the user's browser (by injecting them as-written into the <head> of the page). There will be no additional vetting or sanitizing of resources by Leap. It is not recommended for a customer to rely on resources that they do not tightly control (ie. avoid usage of libraries from a 3rd-party CDN).

Strict CSP support requires a special nonce='#!#cspNonce!#!' attribute on <script> tags. For example:

runtimeResources.4 = <script nonce='#!#cspNonce!#!'
        src='https://myWidgets.example.com/MyYesNoWidget.js'></script>