Nova Iframe Laravel Package

Product Decisions This Supports

• Admin consolidation vs. tool sprawl. The decision this package actually informs is not "should we add a field?" but "does embedding a dashboard, provider console, or support desk inside Nova reduce context switching enough to justify another surface in the admin?" The iframe is incidental; the workflow bet is what gets priced.
• Build vs. buy vs. link-out. Present three options on equal footing at the start: adopt and pin the package, fork it into a first-party Nova field (~1–2 engineer-days), or skip the embed and ship a link-out in a new tab (zero dependencies, zero CSP work). Price the fallback before the pilot so it never becomes a sunk-cost argument for debugging an abandoned package.
• Roadmap gating. If "single pane of glass for operators" or "reduce internal tool sprawl" is a live theme, a one-resource pilot is cheap and measurable (time-to-answer, context switches per task, support handle time). If it isn't a live theme, defer — the package carries a small but real maintenance and security surface for marginal standalone value.
• Security and governance policy. Adopting iframes forces decisions that outlive the package: domain allowlisting, CSP frame-src, sandbox/allow/referrerpolicy, third-party cookie and session behaviour, and whether authenticated internal tools may be framed at all. These policy calls are the real work item and would be required for any iframe solution, including a homegrown one — so they belong on the roadmap as a deliverable, not a side effect.
• Use-case boundaries. Valid for read-only or independently authenticated content on detail views. Invalid for write-back workflows, SSO/session propagation, deep-linked authenticated tools, or anything high-availability — route those to API or JS integrations instead.

When to Consider This Package

Consider it when:

• You already run Laravel Nova and want a low-effort embed in one or a few resources — the change is purely additive and rollback is one line in a resource's fields() method.
• The embedded content is read-only or independently authenticated, and the target actually permits framing (verify X-Frame-Options and content-security-policy headers before committing to the spike — a DENY header ends the evaluation regardless of package quality).
• Your production CSP frame-src can be scoped to an allowlist for that origin, and someone owns that configuration.
• You can pin the exact version, commit composer.lock, audit the small source, and name an internal owner (or fork it). Tolerable precisely because the code is tiny.
• You want a working reference implementation to inform a first-party field rather than a long-term dependency.

Look elsewhere when:

• You need maintained compatibility across Nova/Laravel majors, tests, CI, changelogs, or responsive behaviour. At 7 stars, zero dependents, and a single maintainer, there is no support contract here — the maintenance burden is yours the moment it lands.
• You're on Nova 4+ or planning to be. Vue 3 asset-registration changes are unlikely to have been tracked; assume the field won't register and budget the inline rebuild instead.
• The embed needs sandbox, allow, referrerpolicy, loading states, or flexible (non-fixed-pixel) sizing. You'll be forking the Vue component anyway, at which point "adopt vs. build" collapses into "build."
• The measurable win over a plain link-out is marginal. If time-to-answer barely moves in the pilot estimate, ship the link.

How to Pitch It (Stakeholders)

To executives: This is a small, cheap experiment in consolidating operator tooling inside the admin panel we already pay for — not a platform investment. The upside is fewer tabs and faster answers for the team that lives in Nova; the cost is roughly one engineer-day of spike plus a security review we'd owe for any embedding approach. It's behind a feature flag on a single resource, rollback is one line, and we go in with an explicit link-out fallback if the pilot doesn't show a measurable win.

To engineering: Treat it as reference code, not a dependency. It's a ~50-line single-maintainer field with no CI and no Nova 4+ signal — so we pin the version, commit the lockfile, read the compiled bundle to confirm the API surface, and decide up front whether we fork. Three risks to name now rather than discover later: the target's framing headers (a DENY kills the plan), CSP frame-src scoping (deployment config, not package config), and missing sandbox/allow attributes (we add them at our layer; that's the security deliverable). One test asserting the expected src on a detail page is the difference between a five-minute signal and a production incident on the next Nova upgrade. Half a day per Nova major for re-validation.

To the operator using it: The content appears inside the record you're already looking at, in read-only form. If the embed fails — and sometimes it will, because third-party sites can refuse to be framed — there's always a link to open it in a new tab. An embed failure never blocks you from finishing the task.