mm-react-embeddable

Components and hooks for embedding mm-apps into an interface. Primarily used for sandbox testing the creation of custom dashboard widgets.

Host readiness (ready, required)

MMEmbeddableZoneProvider takes a required boolean ready: true once the host holds the bearer its credentialBroker sends. Until then every MMEmbeddableZone keeps its slot but mounts no iframe, so the first broker call always carries a token. A host that omits the prop is treated as not ready and gets a one-time alert plus a console error — failing closed beats racing the broker against token hydration (a guest that mounted before the host's token arrived got a synthetic invalid_token, fell through with no credential, and rendered blank until refresh). Hosts on mm-react-tools pass ready={Boolean(useCredential('api'))}.

Consent UI

The library ships no consent UI. useEmbeddedAuthorizations() exposes the pending entries and the actions on them: approve/dismiss for entries the host brokered (entry.consent is set), authorize for legacy entries that take the popup path. Every host renders its own modal over that hook — converge, OperatorView, operator-kiosk and the mmdev playground each have one, all the same shape (rows name the app and where it runs; footer Cancel/Approve; checkbox rows when several apps are pending; legacy rows keep their own Authorize button because a popup must open from the user's click on that row).

A host with no credentialBroker, or one whose broker returns an answer it may not act on, gets an interactive entry, and the host's UI opens the popup for it.

A frame that already received a credential and asks again is treated as holding a dead token: the origin's cached credential is dropped and the broker check runs again, at most once per origin every 30 seconds. When ready goes false the cache is emptied.