Nova Iframe Page Laravel Package

Product Decisions This Supports

• Build vs. buy (buy/borrow): Replaces a custom Nova tool or Vue component that would otherwise take 1–3 engineering days to scaffold (route, menu entry, Vue view, build pipeline). Adopting an existing package collapses that to a composer require plus a CSP check.
• Internal admin consolidation ("single pane of glass"): Enables embedding third-party or legacy surfaces — BI dashboards (Metabase, Grafana, Looker), support consoles, embedded docs, status pages, or a not-yet-migrated legacy admin — directly inside Nova, so ops and support stop juggling browser tabs.
• Roadmap enabler: A cheap primitive for a broader "admin hub" initiative. Useful as a stopgap during a legacy-panel migration, and as a low-cost experiment before committing to a deeper, bidirectional integration.
• v1.0.0 semver signal: The first stable tag implies the public API is considered settled, which supports pinning ^1.0 and treating it as a production dependency rather than a dev experiment. Confirm Nova version compatibility before pinning.
• Not a fit for: per-user parameterization, authenticated embeds, or any interaction beyond display — those need a custom implementation and a signed-URL/SSO design.

When to Consider This Package

Adopt when most of the following hold:

• You are on Laravel Nova (verify the supported Nova major version — Nova is a paid product with breaking majors, and this package's compatibility matrix is the first thing to check).
• The embed is read-only. A static iframe with a fixed URL is the sweet spot.
• The target actually allows framing. Many SaaS vendors send X-Frame-Options: DENY or a restrictive frame-ancestors CSP. Validate this before scheduling any work; it is the most common reason this class of package gets abandoned mid-sprint.
• Nothing sensitive sits behind the iframe. The embedded page sees an unauthenticated browser session. Anything private needs SSO, signed URLs, or a token-in-query pattern — which is a product/security decision, not a package feature.
• Maintenance risk is acceptable. Single-maintainer package with a thin changelog; check issue responsiveness, commit recency, and whether you can fork it. The surface area is small enough that a fork is genuinely viable.

Look elsewhere when:

• You need postMessage communication, dynamic per-user URLs, or event handling between Nova and the embedded app.
• You are not on Nova — Filament and plain Blade each have equivalent primitives.
• Compliance requirements prohibit loading third-party origins in an authenticated admin context.
• You need vendor support or an SLA.

Before committing: run a half-day spike that (1) installs against your Nova version, (2) loads the actual target URL in a staging admin, and (3) confirms the browser console is free of framing/CSP errors. Review the source — it is small enough to read in full.

How to Pitch It (Stakeholders)

For executives: This is a near-zero-cost way to consolidate the tools our ops and support teams use every day into the admin panel they already have open. It removes tab-switching, shortens time-to-answer for support tickets, and costs no license fee. Effort is measured in hours, not sprints, and the risk is contained because it is a display-only component that can be removed without touching our data model.

For engineering: A thin Laravel Nova wrapper around an iframe view. v1.0.0 gives us a stable, pinnable API surface and a small, auditable codebase — worth a 30-minute read before we depend on it. Ask: pin the version, confirm Nova compatibility, and add a note in the runbook about CSP/X-Frame-Options for any URL we embed, since that failure mode is silent until someone opens the page. If the maintainer goes quiet, forking is a realistic fallback given the code size.

Known risks to flag: single maintainer and bus factor of one, sparse release documentation, no guarantee of forward compatibility with future Nova majors, and the hard constraint that the embedded origin must permit framing. None of these are blockers for a read-only internal dashboard; all of them matter if this becomes load-bearing for a customer-facing surface.