Electron contextBridge: limiting ipcRenderer.invoke to specific IPC channels

Electron's contextBridge is the supported way to expose IPC from a sandboxed preload script to the renderer, but the shape of that exposure is left as a design decision. With contextIsolation enabled (the default since Electron 12) and nodeIntegration disabled, the renderer can only reach what the preload explicitly exposes through contextBridge.exposeInMainWorld.

The unresolved point is how much of ipcRenderer to surface. A single generic wrapper around ipcRenderer.invoke(channel, ...args) keeps the bridge small, but it effectively lets renderer code call any channel the main process handles. Exposing one named function per channel is more restrictive, but it duplicates boilerplate as the API grows.

For windows that load remote content and cannot trust renderer code, the choice has security consequences:

• Is a per-channel function the recommended configuration, or is a generic invoke acceptable when paired with a channel whitelist?
• Where should the whitelist live: in the preload, or as validation inside each ipcMain.handle listener?
• Does enabling sandbox: true change which of these options is feasible?