CSP compatibility improvements

[thibaudcolas]

Follow-up to Extend Stimulus adoption #57. Further adoption of Stimulus to support stricter CSP policies (stop using inline JS to initialise features).

Exact improvements TBC in line with Stimulus adoption planning.

[lb-]

Update as at the 5.1 release (August 2023). See previous update comment: #57 (comment)

Currently implemented

We have 18 controllers implemented, 6 of which were added in the last release.

• DialogController 'w-dialog'
• DropdownController 'w-dropdown'
• SwapController 'w-swap'
• TagController 'w-tag'
• TeleportController 'w-teleport'
• TooltipController 'w-tooltip'

State of inline script usage

A list of areas of code that still use inline scripts, roughly from most common to least common, roughly being used to determine next steps.

1. Date pickers (Migrate datetime chooser init script to Stimulus w-date wagtail#10261)
2. Bulk actions (progress being made, no issue raised)
3. Metadata/locale/config items - in limbo, need some direction on Ability to have a consistent approach to client-side (JS) metadata (aka global config) wagtail#9771
4. Choosers/Workflow actions - no progress
5. InlinePanel/formset - some pre-work issues created, no progress
6. File upload / title changes
7. Dirty form check / unsaved changes - issue created
8. Initialise comments - no progress

Pull requests

Ready to review

• Documentation - Extending Wagtail client-side with Stimulus wagtail#10590 (documentation, has had one round of feedback, awaiting next round)
• Adopt w-bulk Stimulus controller for form submissions listing wagtail#10613 (small w-bulk adoption/enhancement, making way for bulk actions)

Blocked

• Migrate datetime chooser init script to Stimulus w-date wagtail#10261 (awaiting team decision on direction of date pickers)
• Deprecate WidgetWithScript - potentially unsafe and no longer used wagtail#10311 (LB will refine after docs are in place)

Inactive

• Migrated breadcrumbs to stimulus controller wagtail#10160 (LB working on this)
• Migrate panel stimulus w panel wagtail#10238 (LB working on this)
• Stimulus code added to message controller wagtail#10327 (no takers yet, LB can do later)

[thibaudcolas]

For a record of what shipped in v5.2, see:

• Support extending Wagtail client-side with Stimulus
• Maintenance - Stimulus adoption