In terms of an application that's about affording its end-uses the ability to add, view, and manipulate their own data (like Podio, Trello, Redbooth, Asana, et cetera), I'm wondering how it can be designed such that it also affords them the ability to add code-as-data to the app and have the app be a function of that user-added-code as well as its original, base code.
eval() is "evil", but I can't think of any other way to take code from a user. And, even with
eval(), it's unclear to me how to how to structure the app such that it can incorporate that user-supplied code back into itself. Additionally, should there be a core of the app that's never changed to keep the user from nuking the system —TiddlyWiki (something that seems to exemplify the quality I've in mind) mentions a "microkernel", a "boot script", and module system, though I don't quite get how it all works.
From what I've looked at thus far, I've seen mention of DSLs a lot. How's that fit in? And some stuff about vulnerability to malicious injection and the need to sandbox (or something) the user code. How's that work?
Spreadsheet apps also come to mind as doing what I'm asking about. With many of 'em, one can write their own functions that tie into core parts of the app and that stuff is written in cells as data.