ckanext-webpageviewplus 0.1.0__py3-none-any.whl

ckanext/webpageviewplus/actions.py

@@ -0,0 +1,128 @@
+from __future__ import annotations
+
+from typing import Any
+
+import ckan.model as model
+import ckan.plugins.toolkit as toolkit
+from ckan.types import Context
+
+from ckanext.webpageviewplus import (
+    connections,
+    events,
+    frame,
+    frameability,
+    settings,
+    stats,
+)
+
+
+def frameability_auth(context: Context, data_dict: dict[str, Any]) -> dict[str, Any]:
+    """Only someone who may add views to the resource may make CKAN fetch a
+    URL on its behalf."""
+    try:
+        toolkit.check_access(
+            "resource_view_create",
+            context,
+            {"resource_id": data_dict.get("resource_id")},
+        )
+    except toolkit.NotAuthorized:
+        return {"success": False}
+    return {"success": True}
+
+
+@toolkit.side_effect_free
+def webpageviewplus_frameability(
+    context: Context, data_dict: dict[str, Any]
+) -> dict[str, Any]:
+    """Whether the page at ``url`` allows this site to frame it.
+
+    :param url: the page URL
+    :param resource_id: the resource the view is for (for authorization)
+    :returns: ``{"verdict": "frameable" | "blocked" | "unknown" | "skipped",
+        "reason": "..."}``. Never refuses on the URL itself: the view's own
+        validation does that when it's saved.
+    """
+    toolkit.check_access("webpageviewplus_frameability", context, data_dict)
+    url = toolkit.get_or_bust(data_dict, "url")
+    if not settings.frameability_check():
+        return {"verdict": "skipped", "reason": "disabled"}
+    if not frame.is_http_url(url):
+        return {"verdict": "skipped", "reason": "not an http(s) URL"}
+    hosts = settings.ckan_hosts()
+    if frame.is_ckan_host(url, hosts):
+        return {"verdict": "skipped", "reason": "a page on this site"}
+    allowed = settings.allowed_hosts()
+    if allowed and frame.url_host(url) not in allowed:
+        return {"verdict": "skipped", "reason": "host not allowed"}
+    identity = frameability.ckan_identity(settings.site_url())
+    result = frameability.summary(frameability.check(url, identity))
+    if result.get("verdict") == "blocked":
+        events.emit("frameability_blocked", host=frame.url_host(url))
+    return result
+
+
+def _counted_view(data_dict: dict[str, Any]):
+    view_id = toolkit.get_or_bust(data_dict, "id")
+    view = model.Session.query(model.ResourceView).get(view_id)
+    if view is None or view.view_type != "webpage_view_plus":
+        raise toolkit.ObjectNotFound("View not found")
+    return view
+
+
+def view_stats_auth(context: Context, data_dict: dict[str, Any]) -> dict[str, Any]:
+    """Anyone who may update the view's resource."""
+    try:
+        view = _counted_view(data_dict)
+        toolkit.check_access("resource_update", context, {"id": view.resource_id})
+    except (toolkit.NotAuthorized, toolkit.ObjectNotFound, toolkit.ValidationError):
+        return {"success": False}
+    return {"success": True}
+
+
+@toolkit.side_effect_free
+def webpageviewplus_view_stats_show(
+    context: Context, data_dict: dict[str, Any]
+) -> dict[str, Any]:
+    """Opt-in view counts for one view.
+
+    :param id: the view's id
+    :param days: how many days back, today included (default 30, at most the
+        retention period)
+    :returns: ``{"counting": bool, "days": [{"day", "impressions", "seen",
+        "loaded", "engaged", "failed"}, ...], "totals": {...}}``. Counts hold
+        nothing about viewers.
+    """
+    toolkit.check_access("webpageviewplus_view_stats_show", context, data_dict)
+    view = _counted_view(data_dict)
+    try:
+        days = int(data_dict.get("days") or 30)
+    except (TypeError, ValueError):
+        raise toolkit.ValidationError({"days": ["Must be a whole number"]})
+    days = max(1, min(days, settings.view_counting_retention_days()))
+    result = stats.totals(view.id, days)
+    result["counting"] = stats.countable(view.config or {})
+    return result
+
+
+def connections_auth(context: Context, data_dict: dict[str, Any]) -> dict[str, Any]:
+    """Anyone who may update the resource."""
+    try:
+        toolkit.check_access("resource_update", context, {"id": data_dict.get("id")})
+    except (toolkit.NotAuthorized, toolkit.ObjectNotFound):
+        return {"success": False}
+    return {"success": True}
+
+
+@toolkit.side_effect_free
+def webpageviewplus_connections_show(
+    context: Context, data_dict: dict[str, Any]
+) -> list[dict[str, Any]]:
+    """The hosts an uploaded page was seen contacting, from CSP reports on
+    the content origin. Reports can be posted by anyone: a hint, not proof.
+
+    :param id: the resource's id
+    :returns: ``[{"host", "reports", "last_seen"}, ...]``, most reported first
+    """
+    toolkit.check_access("webpageviewplus_connections_show", context, data_dict)
+    resource_id = toolkit.get_or_bust(data_dict, "id")
+    return connections.hosts_for(resource_id)

ckanext/webpageviewplus/assets/style.css

@@ -0,0 +1,227 @@
+.webpageviewplus {
+  position: relative;
+}
+
+.webpageviewplus-frame {
+  display: block;
+  width: 100%;
+  border: 0;
+}
+
+.webpageviewplus-controls {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+  margin-top: 0.5rem;
+}
+
+.webpageviewplus-controls .btn {
+  min-height: 24px;
+  min-width: 24px;
+}
+
+.webpageviewplus-controls .btn:focus-visible,
+.webpageviewplus-card [data-webpageviewplus-load]:focus-visible,
+.webpageviewplus-narrow-open:focus-visible,
+.webpageviewplus-skip:focus-visible {
+  outline: 3px solid currentColor;
+  outline-offset: 2px;
+}
+
+/* Hidden until it has keyboard focus. Own rules rather than a Bootstrap
+   class, so it works whatever version the site's theme uses. */
+.webpageviewplus-skip {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  overflow: hidden;
+  clip-path: inset(50%);
+  white-space: nowrap;
+}
+
+.webpageviewplus-skip:focus {
+  position: static;
+  display: inline-block;
+  width: auto;
+  height: auto;
+  min-height: 24px;
+  margin-bottom: 0.5rem;
+  overflow: visible;
+  clip-path: none;
+}
+
+/* Only a landing spot for the skip link. */
+.webpageviewplus-after:focus {
+  outline: none;
+}
+
+.webpageviewplus-sr {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  margin: 0;
+  overflow: hidden;
+  clip-path: inset(50%);
+  white-space: nowrap;
+}
+
+/* Windows High Contrast and other forced-colour modes: system colours. */
+@media (forced-colors: active) {
+  .webpageviewplus-controls .btn,
+  .webpageviewplus-narrow-open,
+  .webpageviewplus-shield span,
+  .webpageviewplus-skip {
+    border: 1px solid ButtonText;
+    color: ButtonText;
+    background: ButtonFace;
+  }
+
+  .webpageviewplus-controls .btn:focus-visible,
+  .webpageviewplus-narrow-open:focus-visible,
+  .webpageviewplus-skip:focus-visible {
+    outline-color: Highlight;
+  }
+}
+
+/* Responsive height: below the site's narrow_width (the script sets the
+   class), aspect-ratio and share-of-window views take 80% of the screen,
+   over their inline height. Not in fullscreen or Expand. */
+.webpageviewplus-narrow:not(:fullscreen):not(.webpageviewplus-expanded)
+  .webpageviewplus-frame:is([data-height-mode="aspect"], [data-height-mode="viewport"]) {
+  height: 80vh !important;
+  height: 80svh !important;
+  aspect-ratio: auto !important;
+}
+
+/* Load on tap (Save-Data): the card stands in for the frame. */
+.webpageviewplus-card {
+  padding: 1rem;
+  border: 1px dashed currentColor;
+  border-radius: 4px;
+}
+
+.webpageviewplus-card-title {
+  margin: 0 0 0.25rem;
+  font-weight: bold;
+}
+
+.webpageviewplus-card [data-webpageviewplus-load] {
+  min-height: 24px;
+}
+
+/* Tap to interact: over the frame (the script sets its top and height),
+   so a swipe scrolls the page instead of the framed page. */
+.webpageviewplus-shield {
+  position: absolute;
+  left: 0;
+  right: 0;
+  z-index: 1;
+  display: flex;
+  align-items: flex-end;
+  justify-content: center;
+  padding: 0 0 1rem;
+  border: 0;
+  background: transparent;
+}
+
+.webpageviewplus-shield[hidden],
+.webpageviewplus:fullscreen .webpageviewplus-shield,
+.webpageviewplus-expanded .webpageviewplus-shield {
+  display: none;
+}
+
+.webpageviewplus-shield span {
+  display: inline-flex;
+  align-items: center;
+  min-height: 44px;
+  padding: 0 1rem;
+  border-radius: 22px;
+  color: #fff;
+  background: rgba(0, 0, 0, 0.8);
+}
+
+.webpageviewplus-shield:focus-visible span {
+  outline: 3px solid #fff;
+  outline-offset: 2px;
+}
+
+/* Reflow (WCAG 1.4.10): at a 320px width, which is 400% zoom on a
+   1280px screen, content framed in a short box turns into a small nested
+   scroll area, so every height mode gets a tall floor. 600px matches
+   FALLBACK_HEIGHT in frame.py. Not in fullscreen or Expand, where the frame
+   fills the screen instead. */
+.webpageviewplus-narrow-open {
+  display: none;
+}
+
+@media (max-width: 320px) {
+  .webpageviewplus:not(:fullscreen):not(.webpageviewplus-expanded) .webpageviewplus-frame {
+    min-height: 600px;
+  }
+
+  .webpageviewplus-narrow-open {
+    display: inline-block;
+    min-height: 24px;
+    margin-top: 0.5rem;
+  }
+}
+
+@media (pointer: coarse) {
+  .webpageviewplus-controls .btn,
+  .webpageviewplus-card [data-webpageviewplus-load],
+  .webpageviewplus-narrow-open {
+    min-height: 44px;
+    min-width: 44px;
+  }
+}
+
+/* Fullscreen: the frame fills the screen above the control bar, beating its
+   inline height. */
+.webpageviewplus:fullscreen {
+  display: flex;
+  flex-direction: column;
+  background: Canvas;
+  padding: 0.5rem;
+}
+
+.webpageviewplus:fullscreen .webpageviewplus-frame {
+  flex: 1;
+  height: auto !important;
+  aspect-ratio: auto !important;
+}
+
+/* Expand, the fallback where there's no element fullscreen (iPhone
+   Safari): the view fills the viewport in place. dvh keeps it clear of the
+   address bar; the safe-area insets are 0 unless the site's viewport meta
+   has viewport-fit=cover. No transition. */
+.webpageviewplus-expanded {
+  position: fixed;
+  inset: 0;
+  z-index: 2000;
+  display: flex;
+  flex-direction: column;
+  height: 100vh;
+  height: 100dvh;
+  margin: 0;
+  padding: max(0.5rem, env(safe-area-inset-top)) max(0.5rem, env(safe-area-inset-right))
+    max(0.5rem, env(safe-area-inset-bottom)) max(0.5rem, env(safe-area-inset-left));
+  background: Canvas;
+}
+
+.webpageviewplus-expanded .webpageviewplus-frame {
+  flex: 1;
+  /* Without this the frame keeps its intrinsic 150px and, on a short
+     screen, pushes the control bar (and Close) off it. */
+  min-height: 0;
+  height: auto !important;
+  aspect-ratio: auto !important;
+}
+
+.webpageviewplus-expanded .webpageviewplus-controls {
+  flex-shrink: 0;
+}
+
+.webpageviewplus-noscroll,
+.webpageviewplus-noscroll body {
+  overflow: hidden;
+}

ckanext/webpageviewplus/assets/webassets.yml

@@ -0,0 +1,10 @@
+webpageviewplus-css:
+  output: ckanext-webpageviewplus/%(version)s-webpageviewplus.css
+  contents:
+    - style.css
+
+webpageviewplus-js:
+  filters: rjsmin
+  output: ckanext-webpageviewplus/%(version)s-webpageviewplus.js
+  contents:
+    - webpageviewplus.js