How to communicate with extension?

[Chris]

We're try to work with a Firefox extension, Zotero. Zotero exposes an
API to other extensions:

Zotero.doSomething("foo");

You can get the Zotero object with a call to the Components object:

var Zotero = Components.classes["@zotero.org/Zotero;1"]
.getService(Components.interfaces.nsISupports)
.wrappedJSObject;

Here's the problem: I want to call the API from within Javascript on a
web page, and I get security exceptions. What's the best way around this?

I could write my own Firefox extension that serves as a bridge between
the two, but I'd rather not make our users install two extensions. Is
there any concept of dependencies between extensions, so if the user
installs my extension, the Zotero extension gets installed automatically?

I could modify the Zotero code, but I'd really rather not fork the code
base, because then I've got to maintain it.

There's one other possibility: we're also developing components using
Flex. I tried to call Zotero from within Flex using Javascript, but I
got the same security exception. Is there anything that can be done
within Flex to communicate with Zotero?

Any thoughts on how to get around this problem appreciated.

[Neil]

Chris wrote:

> We're try to work with a Firefox extension, Zotero. Zotero exposes an
> API to other extensions:
>
> Zotero.doSomething("foo");
>
> You can get the Zotero object with a call to the Components object:
>
> var Zotero = Components.classes["@zotero.org/Zotero;1"]
> .getService(Components.interfaces.nsISupports)
> .wrappedJSObject;

This will only work from another extension; there's no way that a web
page is going to be allowed to do this, but what you can do is to
register an object as a JavaScript global. There are some limitations;
for instance, you have to declare all the methods and parameters in a
separate interface description, and you have to tell Firefox that your
object is safe.

> Is there any concept of dependencies between extensions, so if the
> user installs my extension, the Zotero extension gets installed
> automatically?

I understand that this is being worked on, as it's quite a popular request.

--
Warning: May contain traces of nuts.

[Chris]

Neil wrote:
> Chris wrote:
>
>> We're try to work with a Firefox extension, Zotero. Zotero exposes an
>> API to other extensions:
>>
>> Zotero.doSomething("foo");
>>
>> You can get the Zotero object with a call to the Components object:
>>
>> var Zotero = Components.classes["@zotero.org/Zotero;1"]
>> .getService(Components.interfaces.nsISupports)
>> .wrappedJSObject;
>
> This will only work from another extension; there's no way that a web
> page is going to be allowed to do this, but what you can do is to
> register an object as a JavaScript global. There are some limitations;
> for instance, you have to declare all the methods and parameters in a
> separate interface description, and you have to tell Firefox that your
> object is safe.
>

Thanks. Do you have a reference on how to do this?

[Neil]

Chris wrote:

> Neil wrote:
>
>> what you can do is to register an object as a JavaScript global.
>> There are some limitations; for instance, you have to declare all the
>> methods and parameters in a separate interface description, and you
>> have to tell Firefox that your object is safe.
>
> Thanks. Do you have a reference on how to do this?

You could start here:
http://weblogs.mozillazine.org/weirdal/archives/017188.html