fix: add security layer to pluginApi

[GuiLeme]

What does this PR do?

This PR secures access to the pluginApi, ensuring that only the plugin itself can interact with it. It introduces a new pluginApiConstructor function, which is executed on the html5-client side and receives the pluginApi as a parameter—without exposing it via the global window object.

Before loading the plugin script, the html5-client checks if a function has already been injected into the window to hijack the pluginApi. If so, the script is blocked from loading. Otherwise, the plugin itself defines the function to access its API.

Motivation

Prevent unwanted behaviours from user.

More

Closely related to the PR from the CORE: bigbluebutton/bigbluebutton#22930

[github-actions]

This pull request has conflicts ☹
Please resolve those so we can review the pull request.
Thanks.

[Arthurk12]

Everything looks good regarding the feature itself. I tried hijacking the plugin constructor through the window object but couldn’t access the pluginApi function via the window, which is a good sign.

One suggestion I have concerns the security check in plugin constructors. Currently, this check depends on the plugin developer calling BbbPluginSdk.pluginApiSecurityCheck(uuid) in the correct place. So suggest encapsulating the common setup logic (including the security check) in a helper function—let’s say setupPlugin—provided by BbbPluginSdk. This would:

• Ensure the security check is always performed correctly.
• Reduce duplication and verbosity in plugin implementations.
• Provide a centralized place in the SDK to add future checks or logic without needing to update individual plugins.

With this approach, plugin code would look like:

BbbPluginSdk.setupPlugin((pluginApi: PluginApi, pluginUuid: string, pluginElement: HTMLElement) => {
  const root = ReactDOM.createRoot(pluginElement);
  root.render(
    <SampleUserListItemAdditionalInformationPlugin
      pluginUuid={pluginUuid}
      pluginApi={pluginApi}
    />
  );
});

[github-actions]

This pull request has conflicts ☹
Please resolve those so we can review the pull request.
Thanks.