SMeet Mini Apps

Publishing

SMeet publishes a Mini App only when both of its addresses are confirmed as yours, only SMeet may frame them, the policy and support links are given and the rules are accepted. Then a reviewer goes through the app.

Addresses#

A Mini App has two addresses, the pages people open: one of the production version and one of the test version. Their origins (the scheme, the host and the port) follow these rules:

https, port 443 or 8443, no user name or password in the address;
a host name, not an IP address; up to 100 characters, in ASCII (an international name in its xn-- form);
not on scrile.com or any of its subdomains: those are SMeet's own;
the production and the test version have different origins, and an origin belongs to one Mini App only.

The address itself may have any path, for example https://forms.example.com/app/. A changed address has to pass the domain and embedding checks again.

Confirming the domain#

For each origin, serve the app's verification token from Domains and embedding on the Mini App's screen:

Text

GET https://forms.example.com/.well-known/smeet-mini-app.txt

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8

smeet-mini-app-Fy3xK0wQm9PZ2s7vTn4cLbJ8hR5dW1eGqA6uYt2N

The answer is 200 with the token on a line of its own; other lines may be there too. SMeet reads at most 4 KiB.
No redirect: SMeet does not follow one. The whole request has 10 seconds.
Press Check now after you put the file in place. The token is not a secret; keep the file there while the app exists, because SMeet may check again.

Embedding#

Every page of the app sends a header that lets only SMeet show it in a frame:

HTTP

Content-Security-Policy: frame-ancestors https://messenger.scrile.com

If the app shows its own pages in frames of its own, add 'self': browsers check the header against every ancestor of a frame, so without it your nested frame does not load.

HTTP

Content-Security-Policy: frame-ancestors 'self' https://messenger.scrile.com

SMeet reads the headers of the address of each version, without following a redirect, and records one of four results:

Result	Means	Fix
`ok`	only SMeet, and the app itself, may frame the page
`missing`	nothing limits framing: no `frame-ancestors`, no `X-Frame-Options`, or the address does not answer 2xx	send the header above
`too_wide`	another source is allowed too, for example `https:` or `*`	allow SMeet only
`refused`	SMeet may not frame the page: `frame-ancestors 'none'`, `'self'` alone, `X-Frame-Options: DENY` or `SAMEORIGIN`	allow SMeet

Sending for review and publishing need ok for both versions; for a test launch the result is only shown to you. frame-ancestors decides when it is present; X-Frame-Options counts only without it.

Your origin belongs to the app#

SMeet's bridge trusts every document of your app's origin: a nested frame of the same origin, another page, a file served there. Such a document could sign the person in, send to the bot and open links on their behalf. So the origin of a Mini App serves no user or third-party HTML (Rules for authors):

people's files only as attachments with sandbox, or from another origin (Files);
no pages built from people's text as markup: put their text in with textContent;
no third-party widgets, scripts or ads that you would not answer for as for your own code; whatever you include runs with your app's powers;
a strict Content-Security-Policy of your own, for example default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; form-action 'none'; base-uri 'none'; object-src 'none'; frame-ancestors https://messenger.scrile.com, as the examples send.

Cookies#

Do not build the Mini App on cookies. In the SMeet window your page is a frame of another site: browsers treat its cookies as third-party cookies, and Safari blocks them. Sign-in uses a login attempt and a session in the page's memory instead (Why there are no cookies). The page may keep a draft in localStorage, under a key that includes the person's id after sign-in, so that two people on one device do not see each other's drafts.

Environments#

	Production	Test
Runs	the published configuration	the draft if there is one (also while it is in review or after a refusal), otherwise the published one
Opened by	everyone who may see the bot	the owner, the testers who accepted an invitation, the reviewers of an open review
Link	`https://messenger.scrile.com/u/<bot>?startapp=<param>`	the same with `&env=test`
The `mini_app` button	opens it	never opens it
`environment.deployment`, `environment` of the exchange and of `mini_app_submission`	`production`	`test`

Each environment has its own origin, keys, sessions and submissions; a code of one is never exchanged with a key of the other.
Invite up to 20 testers by their username in Testers; a person becomes a tester when they accept the invitation in their SMeet.
Saving a draft that changes its origin, data, capabilities or owner closes the open test windows; publishing such a change closes the production windows. People open the app again and see the new consent screen.
Keep test results out of your real work: a test form should not create a real request.

Review#

Send for review is available when:

the origins of both versions are confirmed, and embedding is ok for both;
the links to your privacy policy and your support are given;
the age category is not above the allowed one (4+ now);
you accepted the current version of the Rules for authors.

Mini Apps of SMeet's public space are reviewed by SMeet moderators; Mini Apps of an organisation by its owner and administrators, and only its members can open them. A reviewer opens the test version of the draft, goes through its main scenario and checks that it sells no digital goods and links to no purchases, that your policy names the data from SMeet and a contact for deletion, and that the content fits the category. A refusal names the numbers of the broken rules. While the request is in review the draft cannot be changed; Withdraw the request makes it editable again.

After publication, any change of the settings starts a new draft with its own review; until it is published, people keep seeing the published version. A substantial change of the site itself also needs a new review (Rules for authors).

Rules#

The Rules for authors are part of publishing: no digital goods and no payments, content within the category, data from SMeet only for the stated purpose, a privacy policy and support, your own origin, embedding by SMeet only, no third-party HTML on the origin, and a new review for substantial changes. SMeet can block an app that breaks them.

Links to your Mini App#

The link https://messenger.scrile.com/u/<bot_username>?startapp=<param> opens the production version; param is up to 64 characters of A-Z a-z 0-9 _ - and may be empty. Add &env=test for the test version.
A mini_app button opens it from the bot's message (The mini_app button).
Published Mini Apps of SMeet's public space are listed in the catalog at https://messenger.scrile.com/mini-apps/, with their icons (The icon in the catalog). Mini Apps of organisations are not listed.

SMeet's own Mini Apps#

The apps at https://messenger.scrile.com/mini-apps/ are made by SMeet itself and are part of SMeet. Their addresses are not available to authors, and these rules for addresses, confirmation and embedding are replaced for them by SMeet's own review of their code.