Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vite: Improve handling of preview annotations #28798

Open
wants to merge 41 commits into
base: next
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
41 commits
Select commit Hold shift + click to select a range
a724e02
Vite: improve handling of preview annotations
tobiasdiez Aug 3, 2024
74be16e
use absolute paths in tests
tobiasdiez Aug 3, 2024
e625e78
update comment
tobiasdiez Aug 3, 2024
71c7c57
use star imports for loading previews
tobiasdiez Aug 5, 2024
cdfe782
Merge remote-tracking branch 'upstream/next' into previewAnno
tobiasdiez Aug 6, 2024
869d9e1
Merge branch 'next' into previewAnno
tobiasdiez Aug 6, 2024
f33697e
move preview variable declaration
tobiasdiez Aug 6, 2024
52c56a5
Merge branch 'previewAnno' of https://github.com/tobiasdiez/storybook…
tobiasdiez Aug 6, 2024
d873110
Merge branch 'next' into previewAnno
tobiasdiez Aug 13, 2024
7d1b3f0
update lock file
tobiasdiez Aug 13, 2024
1038c75
Merge branch 'next' into previewAnno
ndelangen Aug 14, 2024
eddb6cd
fixes
ndelangen Aug 14, 2024
d0c7fb5
fixes
ndelangen Aug 14, 2024
1e98912
fix incorrect import
ndelangen Aug 14, 2024
a404e3a
Merge remote-tracking branch 'upstream/next' into previewAnno
tobiasdiez Aug 16, 2024
aef9463
fix imports
tobiasdiez Aug 16, 2024
83c947a
linting
ndelangen Aug 16, 2024
9cd753e
Merge branch 'next' into previewAnno
ndelangen Aug 19, 2024
be2e4c8
Merge branch 'next' into previewAnno
tobiasdiez Aug 21, 2024
27153b2
Merge branch 'next' into previewAnno
tobiasdiez Aug 31, 2024
941324f
Merge branch 'next' into previewAnno
tobiasdiez Sep 6, 2024
9391e2a
Merge branch 'next' into previewAnno
tobiasdiez Sep 22, 2024
3f4900b
Merge remote-tracking branch 'upstream/next' into previewAnno
tobiasdiez Sep 23, 2024
3235249
fix tests
tobiasdiez Sep 23, 2024
4ad25a5
optimze semver
tobiasdiez Sep 23, 2024
300f6f4
Merge branch 'optimize-dep' into previewAnno
tobiasdiez Sep 23, 2024
531b527
move slsah back to dev dep
tobiasdiez Sep 23, 2024
3349a93
Merge branch 'next' into previewAnno
tobiasdiez Oct 4, 2024
502248b
fix tests
tobiasdiez Oct 7, 2024
5680d8d
Merge remote-tracking branch 'origin/next' into fork/tobiasdiez/previ…
kasperpeulen Dec 3, 2024
f5af3eb
Use inline snapshots
kasperpeulen Dec 3, 2024
48f2b8d
Fix eslint
kasperpeulen Dec 3, 2024
d411b19
Fix timing issue
kasperpeulen Dec 3, 2024
d43c165
Merge remote-tracking branch 'origin/next' into fork/tobiasdiez/previ…
kasperpeulen Dec 3, 2024
f8fdac1
Update snapshots
kasperpeulen Dec 3, 2024
90411b1
Merge branch 'next' into previewAnno
tobiasdiez Dec 5, 2024
cc21e5f
Fix import
tobiasdiez Dec 5, 2024
00ecf1c
Merge remote-tracking branch 'upstream/next' into previewAnno
tobiasdiez Dec 11, 2024
70dbdfd
Merge branch 'next' into previewAnno
tobiasdiez Dec 16, 2024
7572f4c
Merge branch 'next' into previewAnno
kasperpeulen Dec 16, 2024
ba7be49
Merge branch 'next' into previewAnno
tobiasdiez Dec 27, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions code/.storybook/preview.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -117,9 +117,6 @@ const ThemedSetRoot = () => {
return null;
};

// eslint-disable-next-line no-underscore-dangle
const preview = (window as any).__STORYBOOK_PREVIEW__ as PreviewWeb<ReactRenderer> | undefined;
const channel = (window as any).__STORYBOOK_ADDONS_CHANNEL__ as Channel | undefined;
export const loaders = [
/**
* This loader adds a DocsContext to the story, which is required for the most Blocks to work. A
Expand All @@ -134,6 +131,9 @@ export const loaders = [
* The DocsContext will then be added via the decorator below.
*/
async ({ parameters: { relativeCsfPaths, attached = true } }) => {
// eslint-disable-next-line no-underscore-dangle
const preview = (window as any).__STORYBOOK_PREVIEW__ as PreviewWeb<ReactRenderer> | undefined;
const channel = (window as any).__STORYBOOK_ADDONS_CHANNEL__ as Channel | undefined;
// __STORYBOOK_PREVIEW__ and __STORYBOOK_ADDONS_CHANNEL__ is set in the PreviewWeb constructor
// which isn't loaded in portable stories/vitest
if (!relativeCsfPaths || !preview || !channel) {
Expand Down
Binary file not shown.
101 changes: 68 additions & 33 deletions code/builders/builder-vite/src/codegen-modern-iframe-script.ts
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
import { getFrameworkName, loadPreviewOrConfigFile } from 'storybook/internal/common';
import type { Options, PreviewAnnotation } from 'storybook/internal/types';

import { genArrayFromRaw, genImport, genSafeVariableName } from 'knitwork';
import { filename } from 'pathe/utils';
import { dedent } from 'ts-dedent';

import { processPreviewAnnotation } from './utils/process-preview-annotation';
import { SB_VIRTUAL_FILES, getResolvedVirtualModuleId } from './virtual-file-names';

Expand All @@ -14,27 +18,55 @@ export async function generateModernIframeScriptCode(options: Options, projectRo
[],
options
);
const previewAnnotationURLs = [...previewAnnotations, previewOrConfigFile]
.filter(Boolean)
.map((path) => processPreviewAnnotation(path, projectRoot));
return generateModernIframeScriptCodeFromPreviews({
previewAnnotations: [
...previewAnnotations.map((p) => (typeof p === 'string' ? p : p.absolute)),
previewOrConfigFile,
],
projectRoot,
frameworkName,
});
}

export async function generateModernIframeScriptCodeFromPreviews(options: {
previewAnnotations: (string | undefined)[];
projectRoot: string;
frameworkName: string;
}) {
const { projectRoot, frameworkName } = options;
const previewAnnotationURLs = options.previewAnnotations
.filter((path) => path !== undefined)
.map((path) => processPreviewAnnotation(path as string, projectRoot));

const variables: string[] = [];
const imports: string[] = [];
for (const previewAnnotation of previewAnnotationURLs) {
const variable =
genSafeVariableName(filename(previewAnnotation)).replace(/_(45|46|47)/g, '_') +
'_' +
hash(previewAnnotation);
variables.push(variable);
imports.push(genImport(previewAnnotation, { name: '*', as: variable }));
}

// This is pulled out to a variable because it is reused in both the initial page load
// and the HMR handler. We don't use the hot.accept callback params because only the changed
// modules are provided, the rest are null. We can just re-import everything again in that case.
const getPreviewAnnotationsFunction = `
const getProjectAnnotations = async (hmrPreviewAnnotationModules = []) => {
const configs = await Promise.all([${previewAnnotationURLs
.map(
// and the HMR handler.
// The `hmrPreviewAnnotationModules` parameter is used to pass the updated modules from HMR.
// However, only the changed modules are provided, the rest are null.
const getPreviewAnnotationsFunction = dedent`
const getProjectAnnotations = (hmrPreviewAnnotationModules = []) => {
const configs = ${genArrayFromRaw(
variables.map(
(previewAnnotation, index) =>
// Prefer the updated module from an HMR update, otherwise import the original module
`hmrPreviewAnnotationModules[${index}] ?? import('${previewAnnotation}')`
)
.join(',\n')}])
// Prefer the updated module from an HMR update, otherwise the original module
`hmrPreviewAnnotationModules[${index}] ?? ${previewAnnotation}`
),
' '
)}
return composeConfigs(configs);
}`;

// eslint-disable-next-line @typescript-eslint/no-shadow
const generateHMRHandler = (frameworkName: string): string => {
const generateHMRHandler = (): string => {
// Web components are not compatible with HMR, so disable HMR, reload page instead.
if (frameworkName === '@storybook/web-components-vite') {
return `
Expand All @@ -43,19 +75,18 @@ export async function generateModernIframeScriptCode(options: Options, projectRo
}`.trim();
}

return `
return dedent`
if (import.meta.hot) {
import.meta.hot.accept('${getResolvedVirtualModuleId(SB_VIRTUAL_FILES.VIRTUAL_STORIES_FILE)}', (newModule) => {
// importFn has changed so we need to patch the new one in
window.__STORYBOOK_PREVIEW__.onStoriesChanged({ importFn: newModule.importFn });
// importFn has changed so we need to patch the new one in
window.__STORYBOOK_PREVIEW__.onStoriesChanged({ importFn: newModule.importFn });
});

import.meta.hot.accept(${JSON.stringify(previewAnnotationURLs)}, (previewAnnotationModules) => {
${getPreviewAnnotationsFunction}
// getProjectAnnotations has changed so we need to patch the new one in
window.__STORYBOOK_PREVIEW__.onGetProjectAnnotationsChanged({ getProjectAnnotations: () => getProjectAnnotations(previewAnnotationModules) });
});
}`.trim();
import.meta.hot.accept(${JSON.stringify(previewAnnotationURLs)}, (previewAnnotationModules) => {
// getProjectAnnotations has changed so we need to patch the new one in
window.__STORYBOOK_PREVIEW__.onGetProjectAnnotationsChanged({ getProjectAnnotations: () => getProjectAnnotations(previewAnnotationModules) });
});
}`.trim();
};

/**
Expand All @@ -66,23 +97,27 @@ export async function generateModernIframeScriptCode(options: Options, projectRo
*
* @todo Inline variable and remove `noinspection`
*/
const code = `
const code = dedent`
import { setup } from 'storybook/internal/preview/runtime';

import '${SB_VIRTUAL_FILES.VIRTUAL_ADDON_SETUP_FILE}';

setup();

import { composeConfigs, PreviewWeb, ClientApi } from 'storybook/internal/preview-api';
import { importFn } from '${SB_VIRTUAL_FILES.VIRTUAL_STORIES_FILE}';


${getPreviewAnnotationsFunction}
${imports.join('\n')}
${getPreviewAnnotationsFunction}

window.__STORYBOOK_PREVIEW__ = window.__STORYBOOK_PREVIEW__ || new PreviewWeb(importFn, getProjectAnnotations);
window.__STORYBOOK_STORY_STORE__ = window.__STORYBOOK_STORY_STORE__ || window.__STORYBOOK_PREVIEW__.storyStore;
${generateHMRHandler(frameworkName)};
`.trim();
window.__STORYBOOK_PREVIEW__ = window.__STORYBOOK_PREVIEW__ || new PreviewWeb(importFn, getProjectAnnotations);

window.__STORYBOOK_STORY_STORE__ = window.__STORYBOOK_STORY_STORE__ || window.__STORYBOOK_PREVIEW__.storyStore;

${generateHMRHandler()};
`.trim();
return code;
}
function hash(value: string) {
return value.split('').reduce((acc, char) => acc + char.charCodeAt(0), 0);
}
1 change: 1 addition & 0 deletions code/builders/builder-vite/src/optimizeDeps.ts
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,7 @@ const INCLUDE_CANDIDATES = [
'refractor/lang/typescript.js',
'refractor/lang/yaml.js',
'regenerator-runtime/runtime.js',
'semver', // TODO: Remove once https://github.com/npm/node-semver/issues/712 is fixed
'sb-original/default-loader',
'sb-original/image-context',
'slash',
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,64 +4,71 @@ import { onlyWindows, skipWindows } from '../../../../vitest.helpers';
import { processPreviewAnnotation } from './process-preview-annotation';

describe('processPreviewAnnotation()', () => {
it('should pull the `bare` value from an object', () => {
it('should pull the `absolute` value from an object', () => {
const annotation = {
bare: '@storybook/addon-links/preview',
absolute: '/Users/foo/storybook/node_modules/@storybook/addon-links/dist/preview.mjs',
};
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe('@storybook/addon-links/preview');
expect(url).toBe('/Users/foo/storybook/node_modules/@storybook/addon-links/dist/preview.mjs');
});

it('should convert relative paths into urls', () => {
const annotation = './src/stories/components';
it('should convert relative paths into absolute paths', () => {
const annotation = './src/stories/preview';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe('/src/stories/components');
expect(url).toBe('/Users/foo/storybook/src/stories/preview');
});

skipWindows(() => {
it('should convert absolute filesystem paths into urls relative to project root', () => {
const annotation = '/Users/foo/storybook/.storybook/preview.js';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe('/.storybook/preview.js');
});
it('should keep absolute filesystem paths', () => {
const annotation = '/Users/foo/storybook/.storybook/preview.js';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe('/Users/foo/storybook/.storybook/preview.js');
});

// TODO: figure out why this fails on windows. Could be related to storybook-metadata.test file altering path.sep
it('should convert node_modules into bare paths', () => {
const annotation = '/Users/foo/storybook/node_modules/storybook-addon/preview';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe('storybook-addon/preview');
});
it('should keep absolute node_modules paths', () => {
const annotation = '/Users/foo/storybook/node_modules/storybook-addon/preview';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe('/Users/foo/storybook/node_modules/storybook-addon/preview');
});

it('should convert relative paths outside the root into absolute', () => {
const annotation = '../parent.js';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe('/Users/foo/parent.js');
});
it('should convert relative paths outside the root into absolute', () => {
const annotation = '../parent.js';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe('/Users/foo/parent.js');
});

it('should not change absolute paths outside of the project root', () => {
const annotation = '/Users/foo/parent.js';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe(annotation);
});
it('should not change absolute paths outside of the project root', () => {
const annotation = '/Users/foo/parent.js';
const url = processPreviewAnnotation(annotation, '/Users/foo/storybook/');
expect(url).toBe(annotation);
});

onlyWindows(() => {
it('should convert absolute windows filesystem paths into urls relative to project root', () => {
const annotation = 'C:/foo/storybook/.storybook/preview.js';
const url = processPreviewAnnotation(annotation, 'C:/foo/storybook');
expect(url).toBe('/.storybook/preview.js');
});
it('should convert relative paths outside the root into absolute on Windows', () => {
const annotation = '../parent.js';
const url = processPreviewAnnotation(annotation, 'C:/Users/foo/storybook/');
expect(url).toBe('C:/Users/foo/parent.js');
});
it('should keep absolute windows filesystem paths as is', () => {
const annotation = 'C:/foo/storybook/.storybook/preview.js';
const url = processPreviewAnnotation(annotation, 'C:/foo/storybook');
expect(url).toBe('C:/foo/storybook/.storybook/preview.js');
});
it('should convert relative paths outside the root into absolute on Windows', () => {
const annotation = '../parent.js';
const url = processPreviewAnnotation(annotation, 'C:/Users/foo/storybook/');
expect(url).toBe('C:/Users/foo/parent.js');
});

it('should not change Windows absolute paths outside of the project root', () => {
const annotation = 'D:/Users/foo/parent.js';
const url = processPreviewAnnotation(annotation, 'D:/Users/foo/storybook/');
expect(url).toBe(annotation);
});

it('should normalize absolute Windows paths using \\', () => {
const annotation = 'C:\\foo\\storybook\\.storybook\\preview.js';
const url = processPreviewAnnotation(annotation, 'C:\\foo\\storybook');
expect(url).toBe('C:/foo/storybook/.storybook/preview.js');
});

it('should not change Windows absolute paths outside of the project root', () => {
const annotation = 'D:/Users/foo/parent.js';
const url = processPreviewAnnotation(annotation, 'D:/Users/foo/storybook/');
expect(url).toBe(annotation);
});
it('should normalize relative Windows paths using \\', () => {
const annotation = '.\\src\\stories\\preview';
const url = processPreviewAnnotation(annotation, 'C:\\foo\\storybook');
expect(url).toBe('C:/foo/storybook/src/stories/preview');
});
});
55 changes: 13 additions & 42 deletions code/builders/builder-vite/src/utils/process-preview-annotation.ts
Original file line number Diff line number Diff line change
@@ -1,54 +1,25 @@
import { isAbsolute, relative, resolve } from 'node:path';

import { stripAbsNodeModulesPath } from 'storybook/internal/common';
import type { PreviewAnnotation } from 'storybook/internal/types';

import slash from 'slash';
import { isAbsolute, normalize, resolve } from 'pathe';

/**
* Preview annotations can take several forms, and vite needs them to be a bit more restrained.
*
* For node_modules, we want bare imports (so vite can process them), and for files in the user's
* source, we want URLs absolute relative to project root.
*/
export function processPreviewAnnotation(path: PreviewAnnotation | undefined, projectRoot: string) {
// If entry is an object, take the first, which is the
// bare (non-absolute) specifier.
/** Preview annotations can take several forms, so we normalize them here to absolute file paths. */
export function processPreviewAnnotation(path: PreviewAnnotation, projectRoot: string) {
// If entry is an object, take the absolute specifier.
// This is so that webpack can use an absolute path, and
// continue supporting super-addons in pnp/pnpm without
// requiring them to re-export their sub-addons as we do
// in addon-essentials.
if (typeof path === 'object') {
return path.bare;
}

// This should not occur, since we use `.filter(Boolean)` prior to
// calling this function, but this makes typescript happy
if (!path) {
throw new Error('Could not determine path for previewAnnotation');
console.log(
'Deprecated: Preview annotations should be strings, not objects. Use the `absolute` property instead.'
);
return path.absolute;
}

// For addon dependencies that use require.resolve(), we need to convert to a bare path
// so that vite will process it as a dependency (cjs -> esm, etc).
// TODO: Evaluate if searching for node_modules in a yarn pnp environment is correct
if (path.includes('node_modules')) {
return stripAbsNodeModulesPath(path);
// If it's already an absolute path, return it.
if (isAbsolute(path)) {
return normalize(path);
}

Comment on lines +20 to 22
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't this pose a security vulnerability? Leaking the build-environment's filesystem directory-structure to the client bundle? I'm not a security expert at all, I just recall a few CVEs coming our way for exactly this, and I know we go out of our way in other places to ensure that nothing above the project root ends up in the bundle.

And maybe I'm misunderstanding this whole thing, and this doesn't actually end up in the bundle, and then it's fine. I was mostly just gauging this from the new tests.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, this only "leaks" the full path to vite - but vite will then replace it with the import of the correct output chunk upon bundling.

// resolve absolute paths relative to project root
const relativePath = isAbsolute(path) ? slash(relative(projectRoot, path)) : path;

// resolve relative paths into absolute urls
// note: this only works if vite's projectRoot === cwd.
if (relativePath.startsWith('./')) {
return slash(relativePath.replace(/^\.\//, '/'));
}

// If something is outside of root, convert to absolute. Uncommon?
if (relativePath.startsWith('../')) {
return slash(resolve(projectRoot, relativePath));
}

// At this point, it must be relative to the root but not start with a ./ or ../
return slash(`/${relativePath}`);
// resolve relative paths, relative to project root
return normalize(resolve(projectRoot, path));
}
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ export const getVirtualModules = async (options: Options) => {
// If entry is an object, use the absolute import specifier.
// This is to maintain back-compat with community addons that bundle other addons
// and package managers that "hide" sub dependencies (e.g. pnpm / yarn pnp)
// The vite builder uses the bare import specifier.
if (typeof entry === 'object') {
return entry.absolute;
}
Expand Down
Loading