Offer option to download files from the CDN instead

Author: David Heinemeier Hansson

README.md

@@ -110,16 +110,34 @@ pin "react", to: "https://cdn.skypack.dev/react"
 ```
 
 
-## What if I don't like to use a JavaScript CDN?
+## Downloading vendor files from the JavaScript CDN
 
-You always have the option to simply download the compiled JavaScript packages from the CDNs, and saving them locally in your application. You can put such files in app/javascript/vendor, and then reference them with local pins, like:
+If you don't want to use a JavaScript CDN in production, you can also download vendored files from the CDN when you're setting up your pins:
+
+```bash
+./bin/importmap pin react --download
+Pinning "react" to vendor/react.js via download from https://ga.jspm.io/npm:[email protected]/index.js
+Pinning "object-assign" to vendor/object-assign.js via download from https://ga.jspm.io/npm:[email protected]/index.js
+```
+
+This will produce pins in your `config/importmap.rb` like so:
 
 ```ruby
-# config/importmap.rb
-pin "react", to: "vendor/[email protected]"
+pin "react", to: "vendor/react.js" # https://ga.jspm.io/npm:[email protected]/index.js
+pin "object-assign", to: "vendor/object-assign.js" # https://ga.jspm.io/npm:[email protected]/index.js
+```
+
+The packages are downloaded to `app/javascript/vendor`, which you can check into your source control, and they'll be available through your application's own asset pipeline serving.
+
+If you later wish to remove a downloaded pin, you again pass `--download`:
+
+```bash
+./bin/importmap unpin react --download
+Unpinning and removing "react"
+Unpinning and removing "object-assign"
 ```
 
-But using a JavaScript CDN is fast, secure, and easier to deal with. Start there.
+Just like with a normal pin, you can also update a pin by running the `pin --download` command again.
 
 
 ## Preloading pinned modules

lib/importmap/commands.rb

@@ -7,12 +7,18 @@ class Importmap::Commands < Thor
   desc "pin [*PACKAGES]", "Pin new packages"
   option :env, type: :string, aliases: :e, default: "production"
   option :from, type: :string, aliases: :f, default: "jspm"
+  option :download, type: :boolean, aliases: :d, default: false
   def pin(*packages)
     if imports = packager.import(*packages, env: options[:env], from: options[:from])
       imports.each do |package, url|
-        puts %(Pinning "#{package}" to #{url})
-
-        pin = packager.pin_for(package, url)
+        if options[:download]
+          puts %(Pinning "#{package}" to vendor/#{package}.js via download from #{url})
+          packager.download(package, url)
+          pin = packager.vendored_pin_for(package, url)
+        else
+          puts %(Pinning "#{package}" to #{url})
+          pin = packager.pin_for(package, url)
+        end
 
         if packager.packaged?(package)
           gsub_file("config/importmap.rb", /^pin "#{package}".*$/, pin, verbose: false)
@@ -28,11 +34,18 @@ def pin(*packages)
   desc "unpin [*PACKAGES]", "Unpin existing packages"
   option :env, type: :string, aliases: :e, default: "production"
   option :from, type: :string, aliases: :f, default: "jspm"
+  option :download, type: :boolean, aliases: :d, default: false
   def unpin(*packages)
     if imports = packager.import(*packages, env: options[:env], from: options[:from])
       imports.each do |package, url|
         if packager.packaged?(package)
-          puts %(Unpinning "#{package}")
+          if options[:download]
+            puts %(Unpinning and removing "#{package}")
+            packager.remove(package)
+          else
+            puts %(Unpinning "#{package}")
+          end
+
           remove_line_from_file "config/importmap.rb", /pin "#{package}"/
         end
       end

lib/importmap/packager.rb

@@ -10,8 +10,9 @@ class Importmap::Packager
   singleton_class.attr_accessor :endpoint
   self.endpoint = URI("https://api.jspm.io/generate")
 
-  def initialize(importmap_path = "config/importmap.rb")
+  def initialize(importmap_path = "config/importmap.rb", vendor_path: Pathname.new("app/javascript/vendor"))
     @importmap_path = importmap_path
+    @vendor_path    = vendor_path
   end
 
   def import(*packages, env: "production", from: "jspm")
@@ -33,15 +34,29 @@ def pin_for(package, url)
     %(pin "#{package}", to: "#{url}")
   end
 
+  def vendored_pin_for(package, url)
+    %(pin "#{package}", to: "vendor/#{package_filename(package)}" # #{url})
+  end
+
   def packaged?(package)
     importmap.match(/^pin "#{package}".*$/)
   end
 
+  def download(package, url)
+    ensure_vendor_directory_exists
+    remove_existing_package_file(package)
+    download_package_file(package, url)
+  end
+
+  def remove(package)
+    remove_existing_package_file(package)
+  end
+
   private
     def extract_parsed_imports(response)
       JSON.parse(response.body).dig("map", "imports")
     end
-      
+
     def handle_failure_response(response)
       if error_message = parse_service_error(response)
         raise ServiceError, error_message
@@ -65,4 +80,41 @@ def post_json(body)
     def importmap
       @importmap ||= File.read(@importmap_path)
     end
+
+
+    def ensure_vendor_directory_exists
+      FileUtils.mkdir_p @vendor_path
+    end
+
+    def remove_existing_package_file(package)
+      FileUtils.rm_rf vendored_package_path(package)
+      FileUtils.rm_rf "#{vendored_package_path(package)}.br"
+    end
+
+    def download_package_file(package, url)
+      if url =~ /jspm.io/
+        # Temporary workaround jspm.io only sending brotli
+        `curl -s '#{url}' | brotli -d > #{vendored_package_path(package)}`
+      else
+        response = Net::HTTP.get_response(URI(url))
+
+        if response.code == "200"
+          save_vendored_package(package, response.body)
+        else
+          handle_failure_response(response)
+        end
+      end
+    end
+
+    def save_vendored_package(package, content)
+      File.open(vendored_package_path(package), "w+") { |f| f.write(content) }
+    end
+
+    def vendored_package_path(package)
+      @vendor_path.join(package_filename(package))
+    end
+
+    def package_filename(package)
+      "#{package.gsub("/", "-")}.js"
+    end
 end

test/packager_integration_test.rb

@@ -4,7 +4,7 @@
 class Importmap::PackagerIntegrationTest < ActiveSupport::TestCase
   setup { @packager = Importmap::Packager.new(Rails.root.join("config/importmap.rb")) }
 
-  test "successful against live service" do
+  test "successful import against live service" do
     assert_equal "https://ga.jspm.io/npm:[email protected]/index.js", @packager.import("[email protected]")["react"]
   end
 
@@ -22,4 +22,18 @@ class Importmap::PackagerIntegrationTest < ActiveSupport::TestCase
   ensure
     Importmap::Packager.endpoint = original_endpoint
   end
+
+  test "successful download from live service" do
+    Dir.mktmpdir do |vendor_dir|
+      @packager = Importmap::Packager.new \
+        Rails.root.join("config/importmap.rb"),
+        vendor_path: Pathname.new(vendor_dir)
+
+      @packager.download("react", "https://ga.jspm.io/npm:[email protected]/index.js")
+      assert File.exist?(Pathname.new(vendor_dir).join("react.js"))
+      
+      @packager.remove("react")
+      assert_not File.exist?(Pathname.new(vendor_dir).join("react.js"))
+    end
+  end
 end