I use a SaaS which has an admin panel and front site. I have no access to the backend and can change only front-end which means I have only JS in use. I created a different site (will call it "additional") to extend the front-end. This site has its own admin.
I make JS requests for needed data from origin site's front-end with JS to the additional site. But the result is that my client now has 2 different admin sites, and they are not happy with having to edit a product in 2 places.
The first solution is to extend additional back-end with the functionality of the back-end of SaaS site. But it will take a long time and actually these functionality will duplicate the SaaS.
The second solution is to somehow inject additional site in SaaS site admin. SaaS admin does not provide any tools for doing it. And here I have two options:
Create a Chrome extenstion (private, aka unpacked) which simply injects additional site admin iframe in a separate tab on SaaS product. I just take a product id from the URL and load additional site's URL (which will be a product edit page) in an iframe. But I need somehow to access the submit button in the iframe to click when a submit button on SaaS admin is clicked. It will not be a problem for my client to click 2 buttons. Moreover, he will see form errors immediately.
This variant is similar to the first, but here I will create an extension that will inject fields instead of an iframe. Yeah, it takes much more time to implement this. But the core problem is that currently I do not have an API on my additional site. When origin (SaaS) front-end site makes a request to the additional site, it is without authentication (but the requests are GET only). So in this variant I need to build an API on the additional site. In addition, I will have to save API credentials in Chrome extension. Yeah, it is a private extension and it will be enabled for the origin admin site and will be on 2 PCs (my and my client's). But is it secure to do in such a way?
I am not exprienced in these things. And I do not even know how to research it. Maybe you will have another variant.