How to embed a coding lab?
labId
. Here’s what it would look like:
Embed coding lab
button would give you access to the labId
and other important parameters.
On any page in which you wish to let the user attempt the lab, you need to embed an iframe as follows:
EMBED_URL
needs to be securely generated on your backend as follows:
https://example.fermion.app/embed/lab?token=
.labId
(String) – This is the unique identifier of the lab as mentioned above.userId
(String) – This is a string that you have stored in your database that can uniquely identify a given user. You have to ensure that you store this identifier properly in your database and reuse it every time a user tries to access any lab.EMBED_URL
securely on your backend server:
This example uses the jsonwebtoken package to generate a JWT Token.
overrideDefaultFilesystemForLab
option can be used to configure how the coding lab filesystem will start. The accepted schema for this, if not null, is the following:
isEnabled
= false
then the default behavior is as follows:
type
. The only possible option today is other-lab-id
. Pass the labId
in the same object to be the labId
which you would like to make the starting point for user for this lab.
Let’s say the lab you’re creating this JWT token for has an ID of X
and the labId
you passed in overrideDefaultFilesystemForLab
has ID Y
.
X
with your token supplied, system will check if there is a past work snapshot for the given user that exists for the lab X
.Y
.Y
, system will copy the filesystem to lab X
and user will start the lab X
with the filesystem of lab Y
.Y
, system will boot the filesystem from the GitHub repository (and branch) you gave while setting up lab X
.window.postMessage
API. You can read more about window.postMessage
API here.
Note that you must not fully rely on events emitted by window.postMessage
you because of security reasons. Please do a server-side validation with our real API endpoint to be sure of the final result. You can use messages from window.postMessage
to optimistically display results, however, since it is a client-side API, it is possible to hijack the event data by the untrusted user.
You can listen to every postMessage like this:
event.data
with zod if you can. Our schemas are strictly typed and are zod-parseable.
Here are the events we emit through window.postMessage
API:
totalChallengesCount
is equal to passedChallengesCount
and take any action in your LMS frontend code accordingly.
You can query for this data through our public API as well for better guarantees of security.