# INVEETAIRE — Google Maps / IFrame Investigation

DO NOT WRITE ANY CODE.

DO NOT MODIFY ANY FILES.

This is an investigation and architecture review only.

====================================================
BACKGROUND
====================================================

INVEETAIRE allows Couples to configure Google Maps for each wedding event.

Currently, Google Maps embedding using <iframe> is not working correctly.

When Couples paste an iframe embed code, it appears to be stripped or not rendered.

The actual root cause is still unknown.

Do not assume anything.

Investigate the complete lifecycle first.

====================================================
OBJECTIVE
====================================================

Determine exactly WHY iframe embedding fails.

Trace the entire lifecycle:

Input

↓

Validation

↓

Controller

↓

Service

↓

Model

↓

Database

↓

Loading

↓

Rendering

↓

Browser

====================================================
STEP 1
====================================================

Locate every place where Google Maps or iframe is handled.

Generate a file list.

Example:

- View
- Controller
- Service
- Model
- Validator
- Helper
- Theme Renderer

====================================================
STEP 2
====================================================

Inspect the Couple Event Configuration form.

Determine:

How does the Couple currently provide Google Maps?

Examples:

- Embed HTML

- iframe

- Google Maps URL

- Embed URL

Show the current implementation.

====================================================
STEP 3
====================================================

Inspect Validation.

Look for anything that removes HTML.

Examples:

strip_tags()

htmlspecialchars()

htmlentities()

DOMPurifier

XSS filtering

HTML sanitizer

TinyMCE cleanup

Input filtering

Framework security middleware

Identify every place that may modify iframe HTML.

====================================================
STEP 4
====================================================

Inspect Database.

Determine what is actually stored.

Examples:

A.

Entire iframe HTML

B.

Only iframe src

C.

Google Maps URL

D.

Escaped HTML

E.

Nothing

Show the exact data flow.

====================================================
STEP 5
====================================================

Inspect Rendering.

Determine how Maps are rendered.

Examples:

echo

<?= ?>

htmlspecialchars()

raw output

innerHTML

Explain whether rendering itself is preventing iframe execution.

====================================================
STEP 6
====================================================

Inspect Security Headers.

Review:

Content-Security-Policy

frame-src

frame-ancestors

X-Frame-Options

sandbox attributes

Determine whether browser security blocks embedding.

====================================================
STEP 7
====================================================

Inspect Browser Compatibility.

Determine which of these formats the application currently supports.

1.

Google Maps Share URL

https://maps.app.goo.gl/...

2.

Google Maps URL

https://www.google.com/maps/...

3.

Google Maps Embed URL

https://www.google.com/maps/embed...

4.

Entire iframe HTML

Determine which formats succeed or fail.

====================================================
STEP 8
====================================================

Determine the REAL root cause.

Do NOT guess.

If multiple causes exist,

list every cause separately.

====================================================
STEP 9
====================================================

Architecture Recommendation.

Recommend the best long-term architecture.

Should INVEETAIRE store:

Option A

Entire iframe HTML

Option B

Google Maps URL only

Option C

Google Maps Embed URL only

Option D

Extract iframe src automatically

Option E

Another architecture

Discuss:

- Security
- Simplicity
- UX
- Maintainability
- Future extensibility

Recommend ONE final architecture.

====================================================
OUTPUT
====================================================

Generate:

1. Current architecture

2. Complete data flow

3. Files involved

4. Root cause(s)

5. Security review

6. Browser compatibility review

7. Recommended architecture

8. Refactor proposal

9. Production recommendation

IMPORTANT

This is an investigation only.

DO NOT modify any code.

DO NOT create any new files.

DO NOT implement anything yet.