importmap-plus 2.0.0 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a89ba9297f9e04e1f3a892ea319d509ce9300789f648327c3b4b1cf72c0951d7
-  data.tar.gz: c088e5ab5732c9f132bfa63a60d2a7d9243ac85690670e1a040e3658fc1fb091
+  metadata.gz: '068b0fd351d34f6741037740731f5545ec5e98530ddd935abc45d18ac92b30e1'
+  data.tar.gz: 6482173bb6db3322fa43711fce8ccf0c9ac48d7b35c0b572e5b68d45f11d0445
 SHA512:
-  metadata.gz: 81f2d28ee6c2d724917e338451d4a0f2baef86feb1bcc5477feca8114f13213787d9164b6befc8e7e02cf24e5ec0f810e13d05195be4e27c689bc70db5fd9311
-  data.tar.gz: 3cbd693b24887409203b8f75294798c3ee4b08dec82a90eb404de2a24e7ba7f273d4babd48a72c3a1608f8f263b4804b27dcfbf624edbb69252ea8ea6b346d63
+  metadata.gz: 22b1de80057a17f315ab8230d5537400985c9f67c1c50faa184336856de9e3e1d8f06ea815392c78a0fef30bffa3373bd25b206ab638cf056c8447faa674fe44
+  data.tar.gz: 444fca5f51ec92e43ab7163bb14ce92791727b3a93242298e776a753cc243e218f17fdf3acb6c873842012bf38867862fa37bf4eb99e0464ed8e72061254c33f

data/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## Unreleased
+
+### Fixed
+
+- **`doctor` leaves a bundle installed inside the app alone.** A file an engine
+  serves out of its gem is skipped, because no `bin/importmap` command can fix
+  it — but "out of its gem" was read as "outside the app root". With
+  `bundle config set path vendor/bundle`, as a CI caching its gems has, the
+  gems are under the root, so an engine's controller importing a package the
+  app never pinned failed `doctor` in CI and nowhere else. Files under
+  `Gem.path` or `Bundler.bundle_path` are now skipped wherever they sit.
+
+- **A `preload: %w[...]` survives a rewrite.** `pin`, `update` and `pristine`
+  carried over `preload: ["admin", "app"]` but not the same list written as a
+  word array, which RuboCop and Standard prefer (`Style/WordArray`). The option
+  was dropped without a word, so an updated package quietly stopped being
+  preloaded on the pages that named it. It is now read — backslash escapes and
+  nested brackets included, so `%w[my\ app]` is the one entry point Ruby sees and
+  `%w[foo [bar]]` keeps its `[bar]` — and written back in the form the app chose:
+
+  ```ruby
+  pin "tailwindcss-stimulus-components", preload: %w[application webcad] # @6.1.3
+  # after bin/importmap update
+  pin "tailwindcss-stimulus-components", preload: %w[application webcad] # @6.1.4
+  ```
+
+- **A quoted preload keeps a bracket or quote inside it.** `preload: ["a]", "b"]`
+  was cut at the first `]` and `preload: "it's"` at the `'`, so a rewrite wrote
+  back a shorter list or a different entry point. Quoted strings are now read
+  whole, and a quoted preload — one entry point or a bracketed list — is written
+  back exactly as the app wrote it, quotes included, so `"\u0061pp"` stays the
+  `app` entry point and `"#{prefix}app"` still interpolates (both used to come
+  back as a different name). `preload: 'say "hi"'` no longer becomes `"say "hi""`.
+
+## 2.0.1
+
+### Fixed
+
+- **`bin/importmap doctor` no longer reports comments and prose as unpinned
+  imports.** The import scanner read `from "…"` and `import "…"` wherever the
+  text appeared, so a line comment such as `// e.g. 'en' from 'en-US'` and
+  strings such as turbo_power's `` `…provided in the "from" attribute for
+  the "…` `` came back as `error … imports " attribute for the ", which isn't
+  pinned`. Line comments are now discounted before scanning (strings and
+  regex literals are still consumed whole, so `"https://…"` is safe), and a
+  quoted text that can't be a module specifier — whitespace, a backtick, a
+  `${` interpolation, or no word character at all — is not reported.
+
 ## 1.2.0
 
 ### Added

data/lib/importmap/doctor.rb

@@ -59,11 +59,18 @@ class Importmap::Doctor
   # against the importing file's own URL, or fetches outright, is not one.
   SCHEME_REGEXP = %r{\A[a-zA-Z][a-zA-Z0-9+\-.]*:}.freeze # :nodoc:
 
-  def initialize(importmap:, resolver:, root:, asset_paths: [], online: false)
+  # Where installed gems live: the default +gem_paths+. A bundle installed
+  # with `path: vendor/bundle` puts Bundler's under the app root.
+  def self.gem_paths
+    [ *Gem.path, (Bundler.bundle_path.to_s if defined?(Bundler)) ].compact.uniq
+  end
+
+  def initialize(importmap:, resolver:, root:, asset_paths: [], gem_paths: self.class.gem_paths, online: false)
     @importmap   = importmap
     @resolver    = resolver
     @root        = Pathname.new(root)
     @asset_paths = Array(asset_paths).map { |path| Pathname.new(path) }
+    @gem_paths   = Array(gem_paths).map { |path| Pathname.new(path) }
     @online      = online
   end
 
@@ -188,9 +195,14 @@ class Importmap::Doctor
 
     # The files this gem may read: the app's own, not a file an engine serves
     # out of its gem, which no `bin/importmap` command can do anything about.
-    # One file serving two keys is scanned once.
+    # Being under the root isn't enough to be the app's: a bundle installed
+    # into vendor/bundle is too. One file serving two keys is scanned once.
     def scannable
-      @scannable ||= entries.select { |entry| entry.file && under?(entry.file, @root) }.uniq(&:file)
+      @scannable ||= entries.select { |entry| entry.file && app_file?(entry.file) }.uniq(&:file)
+    end
+
+    def app_file?(file)
+      under?(file, @root) && @gem_paths.none? { |gem_path| under?(file, gem_path) }
     end
 
     def vendored

data/lib/importmap/import_scanner.rb

@@ -6,16 +6,19 @@ require "importmap/module_inspector"
 #
 # Like Importmap::ModuleInspector and Importmap::PackageGraph::IMPORT_REGEXP
 # this reads the source with regexes rather than parsing JavaScript, so an
-# import statement spelled out inside a string literal is reported too, and a
-# form the regexp can't read — a magic comment between the keyword and the
+# import statement spelled out inside a string literal is reported too — unless
+# what it names can't be a module specifier at all — and a form the regexp
+# can't read — a magic comment between the keyword and the
 # specifier, a specifier built at runtime — isn't reported at all. Both
 # mistakes are the cautious direction for the one caller: a specifier reported
 # that the browser never asks for costs a pin, and a specifier missed leaves
 # the app exactly as broken as it was before anyone ran the check.
 #
-# Block comments are discounted first, through ModuleInspector#code, because a
-# published bundle is full of `/** @typedef {import('./slide.js').Slide} */` —
-# type annotations naming files the package never loads.
+# Comments are discounted first, through
+# ModuleInspector#code_without_line_comments, because a published bundle is
+# full of `/** @typedef {import('./slide.js').Slide} */` — type annotations
+# naming files the package never loads — and app code is full of prose like
+# `// 'en' from 'en-US'`.
 class Importmap::ImportScanner
   Import = Struct.new(:specifier, :kind, keyword_init: true) # :nodoc:
 
@@ -38,6 +41,12 @@ class Importmap::ImportScanner
       (?:from|import)\s*(["'])([^"'\n]*)\3
     )
   /x.freeze # :nodoc:
+  # What a quoted `from "…"` or `import "…"` has to hold to name a module
+  # rather than be prose the regexp above found in a string: something, no
+  # whitespace or backtick, no `${` interpolation, and at least one word
+  # character — `"from" attribute for the "`, `["import",","]` and
+  # `` `import("${url}")` `` are all strings, never specifiers.
+  SPECIFIER_REGEXP = /\A(?!.*\$\{)[^\s`]*\w[^\s`]*\z/.freeze # :nodoc:
 
   attr_reader :source
 
@@ -46,7 +55,9 @@ class Importmap::ImportScanner
   end
 
   def imports
-    @imports ||= Importmap::ModuleInspector.new(source).code.scan(IMPORT_REGEXP).map do |_, dynamic, _, static|
+    @imports ||= Importmap::ModuleInspector.new(source).code_without_line_comments.scan(IMPORT_REGEXP).filter_map do |_, dynamic, _, static|
+      next unless (dynamic || static).match?(SPECIFIER_REGEXP)
+
       dynamic ? Import.new(specifier: dynamic, kind: :dynamic) : Import.new(specifier: static, kind: :static)
     end
   end

data/lib/importmap/module_inspector.rb

@@ -144,6 +144,14 @@ class Importmap::ModuleInspector
     @code ||= without_block_comments
   end
 
+  # #code with its line comments discounted too, for Importmap::ImportScanner:
+  # prose such as `// e.g. 'en' from 'en-US'` reads as an import otherwise.
+  # Strings and regex literals are still consumed whole first, so the `//` of
+  # `"https://…"` or `/\/\//` never opens a comment.
+  def code_without_line_comments
+    @code_without_line_comments ||= without_block_comments(line_comments: true)
+  end
+
   private
     def statements
       @statements ||= without_block_comments(statements_only: true)
@@ -170,12 +178,15 @@ class Importmap::ModuleInspector
     # reads as an import statement while the text inside it stops being read
     # as code at all. That mode feeds only the ES-module check, where the
     # `[//]` trap above can at worst send a package on to the next CDN.
-    def without_block_comments(statements_only: false)
+    # With +line_comments+ alone they go but literals are kept, for the import
+    # scanner: the trap there can at worst miss an import in the doctor's
+    # report, where prose in a comment is a false error on every run.
+    def without_block_comments(statements_only: false, line_comments: statements_only)
       scanner = StringScanner.new(source)
       kept    = +""
 
       until scanner.eos?
-        if scanner.skip(BLOCK_COMMENT_REGEXP) || (statements_only && scanner.skip(LINE_COMMENT_REGEXP))
+        if scanner.skip(BLOCK_COMMENT_REGEXP) || (line_comments && scanner.skip(LINE_COMMENT_REGEXP))
           next
         elsif (literal = scanner.scan(STRING_REGEXP)) ||
               (regexp_literal_next?(kept, scanner) && (literal = scanner.scan(REGEXP_LITERAL_REGEXP)))

data/lib/importmap/packager.rb

@@ -13,10 +13,47 @@ class Importmap::Packager
   include Importmap::HttpRetries
 
   PIN_REGEX = /#{Importmap::Map::PIN_REGEX}(.*)/.freeze # :nodoc:
+  # A Ruby string literal, escapes included, so a quote or bracket inside one
+  # doesn't end the match early (`"it's"`, `["a]"]`).
+  QUOTED_STRING_REGEXP = /"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'/m.freeze # :nodoc:
   # The bracketed form matches an empty array too: `preload: []` is a pin an
   # app wrote, and a rewrite that dropped it would start preloading the package
-  # on every page.
-  PRELOAD_OPTION_REGEXP = /preload:\s*(\[[^\]]*\]|true|false|["'][^"']*["'])/.freeze # :nodoc:
+  # on every page. A word array nests its own delimiter the way Ruby does
+  # (`%w[foo [bar]]` is "foo" and "[bar]"), hence the recursive groups; with
+  # named groups in the pattern, the value has to be named too to stay [1].
+  PRELOAD_OPTION_REGEXP = /preload:\s*(?<value>\[(?:#{QUOTED_STRING_REGEXP}|[^\]"'])*\]|%w(?<brackets>\[(?:\\.|[^\[\]\\]|\g<brackets>)*\])|%w(?<parens>\((?:\\.|[^()\\]|\g<parens>)*\))|true|false|#{QUOTED_STRING_REGEXP})/.freeze # :nodoc:
+  # A `preload: %w[...]` read from a pin, so a rewrite writes it back in the
+  # form the app chose (RuboCop's Style/WordArray flags `["a", "b"]`). Read
+  # with Ruby's escapes rather than split on whitespace: `%w[my\ app]` is one
+  # word, and a backslash before anything but whitespace, a backslash or the
+  # literal's own delimiter stays in it.
+  class WordArray < Array # :nodoc:
+    LITERAL_REGEXP = /\A%w([\[(])(.*)[\])]\z/m.freeze
+
+    def self.parse(literal)
+      open, body = literal.match(LITERAL_REGEXP)&.captures
+      return unless open
+
+      escapable = /\\([\s\\#{Regexp.escape(open == "[" ? "[]" : "()")}])/
+      new(body.scan(/(?:\\.|[^\s\\])+/m).map { |word| word.gsub(escapable, '\1') })
+    end
+
+    def to_s
+      "%w[#{map { |word| word.gsub(/[\s\\\[\]]/) { "\\#{$&}" } }.join(" ")}]"
+    end
+  end
+  # A quoted preload read from a pin — a string or a bracketed array — keeps
+  # the literal it was read from, and a rewrite writes that back untouched.
+  # The names are read with only the simple escapes; the rest of Ruby's string
+  # semantics ("\u0061pp", "#{prefix}app") is Ruby's to evaluate, so writing
+  # the value read back through inspect would change the entry point.
+  module Literal # :nodoc:
+    attr_accessor :source
+
+    def self.of(value, source)
+      value.extend(self).tap { |literal| literal.source = source }
+    end
+  end
   TO_OPTION_REGEXP = /to:\s*["']([^"']*)["']/.freeze # :nodoc:
   # Only the booleans: a hash string is tied to the file it was computed for,
   # so a rewrite that changes the URL has to drop it.
@@ -537,21 +574,33 @@ class Importmap::Packager
         true
       when "false"
         false
+      when WordArray::LITERAL_REGEXP
+        WordArray.parse(value)
       when /^\[.*\]$/
         # config/importmap.rb is Ruby, not JSON, and a single-quoted pin is a
         # supported shape here, so the entry points are scanned out of the
         # literal rather than parsed. JSON.parse raised on every one of them.
-        value.scan(/["']([^"']*)["']/).flatten
+        Literal.of(value.scan(QUOTED_STRING_REGEXP).map { |double, single| unquote(double, single) }, value)
       else
-        value.gsub(/["']/, "")
+        Literal.of(unquote(*value.match(/\A#{QUOTED_STRING_REGEXP}\z/).captures), value)
       end
     end
 
+    # A single-quoted string unescapes only \\ and \'. In a double-quoted one
+    # a backslash before any character an entry point would hold is that
+    # character, which is all a preload name needs. The value is only read;
+    # a rewrite writes the Literal's source.
+    def unquote(double, single)
+      double ? double.gsub(/\\(.)/m, '\1') : single.gsub(/\\([\\'])/, '\1')
+    end
+
     def preload(preloads)
       # nil is "the pin carries no preload:"; [] is the pin carrying one that
       # names no entry point. Array() flattens both to [], so the difference
       # has to be read before it.
       return "" if preloads.nil?
+      return %(, preload: #{preloads}) if preloads.is_a?(WordArray)
+      return %(, preload: #{preloads.source}) if preloads.is_a?(Literal)
 
       case Array(preloads)
       in []
@@ -561,7 +610,7 @@ class Importmap::Packager
       in ["false"] | [false]
         %(, preload: false)
       in [string]
-        %(, preload: "#{string}")
+        %(, preload: #{string.to_s.inspect})
       else
         %(, preload: #{preloads})
       end

data/lib/importmap/version.rb

@@ -1,6 +1,6 @@
 module Importmap
   # importmap-plus versions independently of the importmap-rails it forks.
   # UPSTREAM_VERSION is the importmap-rails release this tracks.
-  VERSION = "2.0.0"
+  VERSION = "2.0.2"
   UPSTREAM_VERSION = "2.2.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: importmap-plus
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.2
 platform: ruby
 authors:
 - David Heinemeier Hansson