Embedding & Widgets

Each widget is a WidgetConfig document with a typed payload (results, calendar, ranking, live_score) and a stable token used in the public URL. The results widget queries CompetitionResult restricted to published rows with embed-friendly cache headers and configurable optional columns (balls won, club affiliation). The calendar widget pulls CalendarEvent within a date range, filtered by event type and federation/club, with a configurable months_ahead window.

The ranking widget reads RankingEntry by config id, dimension, and category and toggles club and rank-change columns. The live-score widget queries Match for in_progress and scheduled rows, exposes mène-level detail, court assignment, and a client-side auto-refresh interval. WidgetCustomization carries a full eight-color palette, branding (logo URL, powered-by toggle, custom footer), light/dark/custom theme, size preset, BCP 47 locale, border radius, font family, max items, and an escape hatch for custom CSS — all serialised into the iframe URL as compact query parameters so the embedded view can hydrate without an extra round trip.

The embed-code generator (POST /widgets/{id}/embed-code, plus a public GET /public/widgets/{token}/embed-code mirror) returns three artefacts: an iframe snippet hardened with sandbox, lazy-load, and referrerpolicy attributes; a JavaScript snippet that injects the iframe and listens for postMessage resize events; and a raw direct-URL for use in CMS rich-text fields or RSS readers. Widget responses set Content-Security-Policy frame-ancestors so embeds work only on declared domains.