Thanks for taking the time to clarify all that! The Figma approach would be my recommendation for Coda, not you though.
I didn’t know they were sanitized! But I also haven’t run into any restrictions so far. They even allow a Plugin which is almost an IDE! Check this out:
That’s good. Maybe I’m overblowing the limitations or the Sandbox approach is finely tuned in a manner that allows developers to do what they need in the vast majority of use cases.
The plugin API doesn’t allow you to access anything outside of the current file it’s running in. Plugins can’t access:
Styles and components from any team or organization libraries. The Plugin API can only access styles, components, and instances that are currently in the file, or have been imported into the file via a function like importComponentByKeyAsync()
Other file metadata like the file’s team or location, permissions, or any comments associated with that file. The includes the version history of that file. You can get read access to these aspects of a file via Figma’s REST API.
And despite their plugin success, it’s approach has not been a bed of roses. Even so, it’s about the best approach one could expect given the hopes of developers and the constraints needed to appease the CSOs.
I see these two as a good thing! It does not make sense to me that a plugin would access other files. But there’s nothing (that I know of at least) stopping you from asking the user for permission to access their account via the API, right inside the plugin. You can then make requests to read the entire files.