Expose integrity in the module preload tags

Author: rafaelfranca

app/helpers/importmap/importmap_tags_helper.rb

@@ -25,13 +25,23 @@ def javascript_import_module_tag(*module_names)
   # (defaults to Rails.application.importmap), such that they'll be fetched
   # in advance by browsers supporting this link type (https://caniuse.com/?search=modulepreload).
   def javascript_importmap_module_preload_tags(importmap = Rails.application.importmap, entry_point: "application")
-    javascript_module_preload_tag(*importmap.preloaded_module_paths(resolver: self, entry_point:, cache_key: entry_point))
+    packages = importmap.preloaded_module_packages(resolver: self, entry_point:, cache_key: entry_point)
+
+    _generate_preload_tags(packages) { |path, package| [path, { integrity: package.integrity }] }
   end
 
   # Link tag(s) for preloading the JavaScript module residing in `*paths`. Will return one link tag per path element.
   def javascript_module_preload_tag(*paths)
-    safe_join(Array(paths).collect { |path|
-      tag.link rel: "modulepreload", href: path, nonce: request&.content_security_policy_nonce
-    }, "\n")
+    _generate_preload_tags(paths) { |path| [path, {}] }
   end
+
+  private
+    def _generate_preload_tags(items)
+      content_security_policy_nonce = request&.content_security_policy_nonce
+
+      safe_join(Array(items).collect { |item|
+        path, options = yield(item)
+        tag.link rel: "modulepreload", href: path, nonce: content_security_policy_nonce, **options
+      }, "\n")
+    end
 end

lib/importmap/map.rb

@@ -41,8 +41,60 @@ def pin_all_from(dir, under: nil, to: nil, preload: true)
   # resolve for different asset hosts, you can pass in a custom `cache_key` to vary the cache used by this method for
   # the different cases.
   def preloaded_module_paths(resolver:, entry_point: "application", cache_key: :preloaded_module_paths)
+    preloaded_module_packages(resolver: resolver, entry_point: entry_point, cache_key: cache_key).keys
+  end
+
+  # Returns a hash of resolved module paths to their corresponding package objects for all pinned packages
+  # that are marked for preloading. The hash keys are the resolved asset paths, and the values are the
+  # +MappedFile+ objects containing package metadata including name, path, preload setting, and integrity.
+  #
+  # The +resolver+ must respond to +path_to_asset+, such as +ActionController::Base.helpers+ or
+  # +ApplicationController.helpers+. You'll want to use the resolver that has been configured for the
+  # +asset_host+ you want these resolved paths to use.
+  #
+  # ==== Parameters
+  #
+  # [+resolver+]
+  #   An object that responds to +path_to_asset+ for resolving asset paths.
+  #
+  # [+entry_point+]
+  #   The entry point name or array of entry point names to determine which packages should be preloaded.
+  #   Defaults to +"application"+. Packages with +preload: true+ are always included regardless of entry point.
+  #   Packages with specific entry point names (e.g., +preload: "admin"+) are only included when that entry
+  #   point is specified.
+  #
+  # [+cache_key+]
+  #   A custom cache key to vary the cache used by this method for different cases, such as resolving
+  #   for different asset hosts. Defaults to +:preloaded_module_packages+.
+  #
+  # ==== Returns
+  #
+  # A hash where:
+  # * Keys are resolved asset paths (strings)
+  # * Values are +MappedFile+ objects with +name+, +path+, +preload+, and +integrity+ attributes
+  #
+  # Missing assets are gracefully handled and excluded from the returned hash.
+  #
+  # ==== Examples
+  #
+  #   # Get all preloaded packages for the default "application" entry point
+  #   packages = importmap.preloaded_module_packages(resolver: ApplicationController.helpers)
+  #   # => { "/assets/application-abc123.js" => #<struct name="application", path="application.js", preload=true, integrity=nil>,
+  #   #      "https://cdn.skypack.dev/react" => #<struct name="react", path="https://cdn.skypack.dev/react", preload=true, integrity="sha384-..."> }
+  #
+  #   # Get preloaded packages for a specific entry point
+  #   packages = importmap.preloaded_module_packages(resolver: helpers, entry_point: "admin")
+  #
+  #   # Get preloaded packages for multiple entry points
+  #   packages = importmap.preloaded_module_packages(resolver: helpers, entry_point: ["application", "admin"])
+  #
+  #   # Use a custom cache key for different asset hosts
+  #   packages = importmap.preloaded_module_packages(resolver: helpers, cache_key: "cdn_host")
+  def preloaded_module_packages(resolver:, entry_point: "application", cache_key: :preloaded_module_packages)
     cache_as(cache_key) do
-      resolve_asset_paths(expanded_preloading_packages_and_directories(entry_point:), resolver:).values
+      expanded_preloading_packages_and_directories(entry_point:).to_h do |_, package|
+        [resolve_asset_path(package.path, resolver: resolver), package]
+      end.delete_if { |key| key.nil? }
     end
   end
 

test/importmap_tags_helper_test.rb

@@ -43,7 +43,7 @@ def content_security_policy_nonce
     assert_dom_equal(
       %(
         <link rel="modulepreload" href="https://cdn.skypack.dev/md5">
-        <link rel="modulepreload" href="/rich_text.js">
+        <link rel="modulepreload" href="/rich_text.js" integrity="sha384-OLBgp1GsljhM2TJ+sbHjaiH9txEUvgdDTAzHv2P24donTt6/529l+9Ua0vFImLlb">
       ),
       javascript_importmap_module_preload_tags
     )

test/importmap_test.rb

@@ -152,6 +152,133 @@ def setup
     assert_not_equal set_two, @importmap.preloaded_module_paths(resolver: ApplicationController.helpers, cache_key: "2").to_s
   end
 
+  test "preloaded_module_packages returns hash of resolved paths to packages when no entry_point specified" do
+    packages = @importmap.preloaded_module_packages(resolver: ApplicationController.helpers)
+
+    md5 = packages["https://cdn.skypack.dev/md5"]
+    assert md5, "Should include md5 package"
+    assert_equal "md5", md5.name
+    assert_equal "https://cdn.skypack.dev/md5", md5.path
+    assert_equal true, md5.preload
+
+    goodbye_controller_path = packages.keys.find { |path| path.include?("goodbye_controller") }
+    assert goodbye_controller_path, "Should include goodbye_controller package"
+    assert_equal "controllers/goodbye_controller", packages[goodbye_controller_path].name
+    assert_equal true, packages[goodbye_controller_path].preload
+
+    leaflet = packages["https://cdn.skypack.dev/leaflet"]
+    assert leaflet, "Should include leaflet package"
+    assert_equal "leaflet", leaflet.name
+    assert_equal "https://cdn.skypack.dev/leaflet", leaflet.path
+    assert_equal 'application', leaflet.preload
+
+    chartkick = packages["https://cdn.skypack.dev/chartkick"]
+    assert chartkick, "Should include chartkick package"
+    assert_equal "chartkick", chartkick.name
+    assert_equal ['application', 'alternate'], chartkick.preload
+
+    application_path = packages.keys.find { |path| path.include?("application") }
+    assert_nil application_path, "Should not include application package (preload: false)"
+
+    tinymce_path = packages.keys.find { |path| path.include?("tinymce") }
+    assert_nil tinymce_path, "Should not include tinymce package (preload: 'alternate')"
+  end
+
+  test "preloaded_module_packages returns hash based on single entry_point provided" do
+    packages = @importmap.preloaded_module_packages(resolver: ApplicationController.helpers, entry_point: "alternate")
+
+    tinymce = packages["https://cdn.skypack.dev/tinymce"]
+    assert tinymce, "Should include tinymce package for alternate entry point"
+    assert_equal "tinyMCE", tinymce.name
+    assert_equal "https://cdn.skypack.dev/tinymce", tinymce.path
+    assert_equal 'alternate', tinymce.preload
+
+    # Should include packages for multiple entry points (chartkick preloads for both 'application' and 'alternate')
+    chartkick = packages["https://cdn.skypack.dev/chartkick"]
+    assert chartkick, "Should include chartkick package"
+    assert_equal "chartkick", chartkick.name
+    assert_equal ['application', 'alternate'], chartkick.preload
+
+    # Should include always-preloaded packages
+    md5 = packages["https://cdn.skypack.dev/md5"]
+    assert md5, "Should include md5 package (always preloaded)"
+
+    leaflet_path = packages.keys.find { |path| path.include?("leaflet") }
+    assert_nil leaflet_path, "Should not include leaflet package (preload: 'application' only)"
+  end
+
+  test "preloaded_module_packages returns hash based on multiple entry_points provided" do
+    packages = @importmap.preloaded_module_packages(resolver: ApplicationController.helpers, entry_point: ["application", "alternate"])
+
+    leaflet = packages["https://cdn.skypack.dev/leaflet"]
+    assert leaflet, "Should include leaflet package for application entry point"
+
+    # Should include packages for 'alternate' entry point
+    tinymce = packages["https://cdn.skypack.dev/tinymce"]
+    assert tinymce, "Should include tinymce package for alternate entry point"
+
+    # Should include packages for multiple entry points
+    chartkick = packages["https://cdn.skypack.dev/chartkick"]
+    assert chartkick, "Should include chartkick package for both entry points"
+
+    # Should include always-preloaded packages
+    md5 = packages["https://cdn.skypack.dev/md5"]
+    assert md5, "Should include md5 package (always preloaded)"
+
+    application_path = packages.keys.find { |path| path.include?("application") }
+    assert_nil application_path, "Should not include application package (preload: false)"
+  end
+
+  test "preloaded_module_packages includes package integrity when present" do
+    # Create a new importmap with a preloaded package that has integrity
+    importmap = Importmap::Map.new.tap do |map|
+      map.pin "editor", to: "rich_text.js", preload: true, integrity: "sha384-OLBgp1GsljhM2TJ+sbHjaiH9txEUvgdDTAzHv2P24donTt6/529l+9Ua0vFImLlb"
+    end
+
+    packages = importmap.preloaded_module_packages(resolver: ApplicationController.helpers)
+
+    editor_path = packages.keys.find { |path| path.include?("rich_text") }
+    assert editor_path, "Should include editor package"
+    assert_equal "editor", packages[editor_path].name
+    assert_equal "sha384-OLBgp1GsljhM2TJ+sbHjaiH9txEUvgdDTAzHv2P24donTt6/529l+9Ua0vFImLlb", packages[editor_path].integrity
+  end
+
+  test "preloaded_module_packages uses custom cache_key" do
+    set_one = @importmap.preloaded_module_packages(resolver: ApplicationController.helpers, cache_key: "1").to_s
+
+    ActionController::Base.asset_host = "http://assets.example.com"
+
+    set_two = @importmap.preloaded_module_packages(resolver: ActionController::Base.helpers, cache_key: "2").to_s
+
+    assert_not_equal set_one, set_two
+  ensure
+    ActionController::Base.asset_host = nil
+  end
+
+  test "preloaded_module_packages caches reset" do
+    set_one = @importmap.preloaded_module_packages(resolver: ApplicationController.helpers, cache_key: "1").to_s
+    set_two = @importmap.preloaded_module_packages(resolver: ApplicationController.helpers, cache_key: "2").to_s
+
+    @importmap.pin "something", to: "https://cdn.example.com/somewhere.js", preload: true
+
+    assert_not_equal set_one, @importmap.preloaded_module_packages(resolver: ApplicationController.helpers, cache_key: "1").to_s
+    assert_not_equal set_two, @importmap.preloaded_module_packages(resolver: ApplicationController.helpers, cache_key: "2").to_s
+  end
+
+  test "preloaded_module_packages handles missing assets gracefully" do
+    importmap = Importmap::Map.new.tap do |map|
+      map.pin "existing", to: "application.js", preload: true
+      map.pin "missing", to: "nonexistent.js", preload: true
+    end
+
+    packages = importmap.preloaded_module_packages(resolver: ApplicationController.helpers)
+
+    assert_equal 1, packages.size
+
+    existing_path = packages.keys.find { |path| path&.include?("application") }
+    assert existing_path, "Should include existing asset"
+  end
+
   private
     def generate_importmap_json
       @generate_importmap_json ||= JSON.parse @importmap.to_json(resolver: ApplicationController.helpers)