Merge pull request #2424 from tvdeyen/remove-webpacker

Remove webpacker

.gitignore

@@ -9,14 +9,9 @@ pkg
 tmp
 log
 .sass-cache
-spec/dummy/.browserslistrc
+spec/dummy/app/assets/builds/*.js*
 spec/dummy/app/javascript/
-spec/dummy/babel.config.js
-spec/dummy/bin/webpack
-spec/dummy/bin/webpack-dev-server
 spec/dummy/config/alchemy/config.yml
-spec/dummy/config/webpack/
-spec/dummy/config/webpacker.yml
 spec/dummy/db/*.sqlite3*
 spec/dummy/package.json
 spec/dummy/postcss.config.js

Gemfile

@@ -19,6 +19,7 @@ group :development, :test do
   # in our case the culprit is `handlebars-assets`. The changes between 2.7.0 and 2.8.0 are
   # minimal, but breaking.
   gem "execjs", "= 2.8.1"
+  gem "jsbundling-rails", "~> 1.1"
 
   if ENV["GITHUB_ACTIONS"]
     # Necessary because GH Actions gem cache does not have this "Bundled with Ruby" gem installed

Rakefile

@@ -44,13 +44,14 @@ namespace :alchemy do
           yarn install && \
           yarn link && \
           cd spec/dummy && \
+          yarn link @alchemy_cms/admin && \
           export RAILS_ENV=test && \
           bin/rake db:create && \
           bin/rake db:environment:set && \
           bin/rake db:migrate:reset && \
+          bin/rails javascript:install:esbuild && \
           bin/rails g alchemy:install --skip --skip-demo-files --auto-accept --skip-db-create && \
-          yarn link @alchemy_cms/admin && \
-          RAILS_ENV=test bin/webpack && \
+          bin/rails javascript:build && \
           cd -
         BASH
       ) || fail

alchemy_cms.gemspec

@@ -53,7 +53,6 @@ Gem::Specification.new do |gem|
   gem.add_runtime_dependency "simple_form", [">= 4.0", "< 6"]
   gem.add_runtime_dependency "sprockets", [">= 3.0", "< 5"]
   gem.add_runtime_dependency "turbolinks", [">= 2.5"]
-  gem.add_runtime_dependency "webpacker", [">= 4.0", "< 6"]
 
   gem.add_development_dependency "capybara", ["~> 3.0"]
   gem.add_development_dependency "capybara-screenshot", ["~> 1.0"]

app/views/layouts/alchemy/admin.html.erb

@@ -36,7 +36,7 @@
     </script>
     <%= render 'alchemy/admin/partials/routes' %>
     <%= javascript_include_tag('alchemy/admin/all', 'data-turbolinks-track' => true) %>
-    <%= javascript_pack_tag('alchemy/admin') %>
+    <%= javascript_include_tag('alchemy_admin', 'data-turbolinks-track' => true, defer: true) %>
     <%= yield :javascript_includes %>
   </head>
   <%= content_tag :body, id: 'alchemy', class: alchemy_body_class do %>

config/brakeman.ignore

@@ -18,6 +18,9 @@
       },
       "user_input": "params[:id]",
       "confidence": "Weak",
+      "cwe_id": [
+        22
+      ],
       "note": ""
     },
     {
@@ -38,6 +41,9 @@
       },
       "user_input": null,
       "confidence": "Medium",
+      "cwe_id": [
+        915
+      ],
       "note": "Because we actually can't know all attributes each inheriting controller supports, we permit all resource model params. It is adviced that all inheriting controllers implement this method and provide its own set of permitted attributes. As this all happens inside the password protected /admin namespace this can be considered a false positive."
     },
     {
@@ -55,7 +61,7 @@
           "type": "controller",
           "class": "Alchemy::Admin::ElementsController",
           "method": "fold",
-          "line": 102,
+          "line": 98,
           "file": "app/controllers/alchemy/admin/elements_controller.rb",
           "rendered": {
             "name": "alchemy/admin/elements/fold",
@@ -69,6 +75,9 @@
       },
       "user_input": "params[:id]",
       "confidence": "Weak",
+      "cwe_id": [
+        22
+      ],
       "note": ""
     },
     {
@@ -78,7 +87,7 @@
       "check_name": "Execute",
       "message": "Possible command injection",
       "file": "lib/alchemy/upgrader.rb",
-      "line": 30,
+      "line": 33,
       "link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
       "code": "`yarn add @alchemy_cms/admin@~#{Alchemy.version}`",
       "render_path": null,
@@ -89,6 +98,9 @@
       },
       "user_input": "Alchemy.version",
       "confidence": "Medium",
+      "cwe_id": [
+        77
+      ],
       "note": "The alchemy version is safe"
     },
     {
@@ -119,6 +131,9 @@
       },
       "user_input": "(Unresolved Model).new.url",
       "confidence": "Weak",
+      "cwe_id": [
+        79
+      ],
       "note": ""
     },
     {
@@ -139,6 +154,9 @@
       },
       "user_input": "params[:id]",
       "confidence": "Weak",
+      "cwe_id": [
+        22
+      ],
       "note": ""
     },
     {
@@ -156,7 +174,7 @@
           "type": "controller",
           "class": "Alchemy::Admin::ElementsController",
           "method": "index",
-          "line": 15,
+          "line": 16,
           "file": "app/controllers/alchemy/admin/elements_controller.rb",
           "rendered": {
             "name": "alchemy/admin/elements/index",
@@ -170,6 +188,9 @@
       },
       "user_input": "params[:page_version_id]",
       "confidence": "Weak",
+      "cwe_id": [
+        22
+      ],
       "note": ""
     },
     {
@@ -187,7 +208,7 @@
           "type": "controller",
           "class": "Alchemy::Admin::ElementsController",
           "method": "index",
-          "line": 15,
+          "line": 16,
           "file": "app/controllers/alchemy/admin/elements_controller.rb",
           "rendered": {
             "name": "alchemy/admin/elements/index",
@@ -201,6 +222,32 @@
       },
       "user_input": "params[:page_version_id]",
       "confidence": "Weak",
+      "cwe_id": [
+        22
+      ],
+      "note": ""
+    },
+    {
+      "warning_type": "Command Injection",
+      "warning_code": 14,
+      "fingerprint": "98ca8e77026312eaa7eec15ce26bfe45aa8dd0fcd38e4cff104cb9dffbde1733",
+      "check_name": "Execute",
+      "message": "Possible command injection",
+      "file": "lib/alchemy/upgrader.rb",
+      "line": 31,
+      "link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
+      "code": "`bin/importmap pin @alchemy_cms/admin@~#{Alchemy.version}`",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Alchemy::Upgrader",
+        "method": "update_npm_package"
+      },
+      "user_input": "Alchemy.version",
+      "confidence": "Medium",
+      "cwe_id": [
+        77
+      ],
       "note": ""
     },
     {
@@ -221,9 +268,12 @@
       },
       "user_input": "params[:id]",
       "confidence": "Weak",
+      "cwe_id": [
+        22
+      ],
       "note": ""
     }
   ],
-  "updated": "2021-10-26 21:44:59 +0200",
-  "brakeman_version": "5.1.1"
+  "updated": "2023-01-31 19:16:48 +0100",
+  "brakeman_version": "5.4.0"
 }

lib/alchemy/upgrader.rb

@@ -26,9 +26,14 @@ def copy_new_config_file
       end
 
       def update_npm_package
-        desc "Install new npm package."
-        `yarn add @alchemy_cms/admin@~#{Alchemy.version}`
-        log "Installed new npm package."
+        desc "Update npm package."
+        if File.exist? Rails.root.join("config/importmap.rb")
+          `bin/importmap pin @alchemy_cms/admin@~#{Alchemy.version}`
+        elsif File.exist? Rails.root.join("package.json")
+          `yarn add @alchemy_cms/admin@~#{Alchemy.version}`
+        else
+          log("Could not update alchemy admin package! Make sure you have a JS bundler installed", :warning)
+        end
       end
     end
   end

lib/alchemy/upgrader/seven_point_zero.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require "thor"
+
+module Alchemy
+  class Upgrader::SevenPointZero < Upgrader
+    include Thor::Base
+    include Thor::Actions
+
+    class << self
+      def update_admin_entrypoint
+        if File.exist? "app/javascript/packs/alchemy/admin.js"
+          FileUtils.mv "app/javascript/packs/alchemy/admin.js", "app/javascript/alchemy_admin.js"
+        else
+          log "Skipping. No alchemy/admin entrypoint found. Maybe already migrated from Webpacker?", :info
+        end
+        if Dir.exist?("app/javascript/packs/alchemy") && Dir.empty?("app/javascript/packs/alchemy")
+          FileUtils.rm_r "app/javascript/packs/alchemy"
+        end
+        if File.exist? "config/importmap.rb"
+          # We want the bundled package if using importmaps
+          task.gsub_file "app/javascript/alchemy_admin.js", 'import "@alchemy_cms/admin"', 'import "@alchemy_cms/dist/admin"'
+        end
+        if task.ask("Do you want to remove webpacker now? (y/N)", default: "N") == "y"
+          task.run "yarn remove @rails/webpacker webpack webpack-cli webpack-dev-server"
+          FileUtils.rm_r "app/javascript/packs"
+          FileUtils.rm_r "config/webpack"
+          FileUtils.rm "config/webpacker.yml"
+          FileUtils.rm "bin/webpack"
+          FileUtils.rm "bin/webpack-dev-server"
+        end
+        if task.ask("Do you want to add jsbundling-rails now? (Y/n)", default: "Y") == "Y"
+          task.run "bundle add jsbundling-rails"
+          task.run "bin/rails javascript:install:esbuild"
+        end
+      end
+
+      private
+
+      def task
+        @_task || new
+      end
+    end
+  end
+end

lib/alchemy_cms.rb

@@ -23,7 +23,6 @@
 require "simple_form"
 require "turbolinks"
 require "userstamp"
-require "webpacker"
 
 # Require globally used Alchemy mixins
 require_relative "alchemy/ability_helper"

lib/generators/alchemy/install/install_generator.rb

@@ -18,11 +18,6 @@ class InstallGenerator < ::Rails::Generators::Base
         default: false,
         desc: "Skip creation of demo element, page and application layout."
 
-      class_option :skip_webpacker_installer,
-        type: :boolean,
-        default: false,
-        desc: "Skip running the webpacker installer."
-
       class_option :skip_db_create,
         type: :boolean,
         default: false,
@@ -103,27 +98,28 @@ def install_gutentag_migrations
         rake "gutentag:install:migrations"
       end
 
-      def run_webpacker_installer
-        unless options[:skip_webpacker_installer]
-          # Webpacker does not create a package.json, but we need one
-          unless File.exist? app_root.join("package.json")
-            in_root { run "echo '{}' > package.json" }
-          end
-          rake("webpacker:install", abort_on_failure: true)
-        end
-      end
-
       def add_npm_package
-        run "yarn add @alchemy_cms/admin@~#{Alchemy.version}"
+        if File.exist? app_root.join("package.json")
+          run "yarn add @alchemy_cms/admin@~#{Alchemy.version}"
+        elsif File.exist? app_root.join("config/importmap.rb")
+          run "bin/importmap pin @alchemy_cms/admin@~#{Alchemy.version}"
+        else
+          log("Could not add alchemy admin package! Make sure you have a JS bundler installed", :warning)
+        end
       end
 
       def copy_alchemy_entry_point
-        webpack_config = YAML.safe_load(
-          File.read(app_root.join("config", "webpacker.yml")),
-          aliases: true
-        )[Rails.env]
-        copy_file "alchemy_admin.js",
-          app_root.join(webpack_config["source_path"], webpack_config["source_entry_path"], "alchemy/admin.js")
+        if Dir.exist? app_root.join("app/javascript")
+          if File.exist? app_root.join("config/importmap.rb")
+            # We want the bundled package if using importmaps
+            create_file app_root.join("app/javascript/alchemy_admin.js"), 'import "@alchemy_cms/dist/admin"'
+          else
+            # We want the normal package if using a bundler locally
+            create_file app_root.join("app/javascript/alchemy_admin.js"), 'import "@alchemy_cms/admin"'
+          end
+        else
+          log("Could not add alchemy admin entry point! Make sure you have a JS bundler installed", :warning)
+        end
       end
 
       def set_primary_language

lib/tasks/alchemy/upgrade.rake

@@ -44,8 +44,14 @@ namespace :alchemy do
     end
 
     namespace "7.0" do
-      task "run" do
-        # no-op
+      task "run" => [
+        "alchemy:upgrade:7.0:update_admin_entrypoint",
+      ]
+
+      desc "Update alchemy admin entrypoint"
+      task update_admin_entrypoint: [:environment] do
+        puts "adding npm_package..."
+        Alchemy::Upgrader::SevenPointZero.update_admin_entrypoint
       end
     end
   end

package.json

@@ -2,15 +2,16 @@
   "name": "@alchemy_cms/admin",
   "version": "7.0.0-a",
   "description": "AlchemyCMS",
-  "browser": "package/admin.js",
+  "browser": "package/dist/admin.js",
   "files": [
     "package/**/*"
   ],
   "directories": {
     "lib": "package"
   },
   "scripts": {
-    "test": "jest"
+    "test": "jest",
+    "build": "esbuild package/admin.js --bundle --sourcemap --minify --outdir=package/dist --public-path=assets"
   },
   "repository": {
     "type": "git",
@@ -32,6 +33,7 @@
     "@babel/core": "^7.9.6",
     "@babel/preset-env": "^7.9.6",
     "babel-jest": "^29.0.1",
+    "esbuild": "^0.17.5",
     "jest": "^25.2.7",
     "prettier": "^2.0.2",
     "xhr-mock": "^2.5.1"

spec/dummy/Procfile.dev

@@ -0,0 +1,2 @@
+web: unset PORT && bin/rails server
+js: yarn build --watch

spec/dummy/app/assets/config/manifest.js

@@ -2,3 +2,4 @@
 //
 //= link application.css
 //= link application.js
+//= link_tree ../builds