Flarum Extensions & 3rd-party resources

pkernstock

Hi,

I just wanted to raise awareness and maybe kick off some discussions on how to work with 3rd party libraries from external sources in Flarum base as well as in Flarum extensions.

I can totally understand that embedding CSS/JS files from well-known CDNs - like jsdelivr - is a common thing and easier to maintain. However as someone who prefers hosting stuff myself and concerning privacy, I tend to host them on the same server as e.g. Flarum is running on.

In a recent verdict in Germany, a webhoster was found guilty for violating GDPR because of using gfonts on their website. Based on the original judgement (or translated into English the reason was, that the IP address was shared when loading the font with Google without consent and that a font is not technical essentially required for the website to work properly.

(To note: In the community Flarum I'm hosting, we have three extensions using external libraries: flarum/emoji, fof/discussion-language and fof/reactions.)

That being said, wouldn't it make sense to integrate such resources into the extensions themself instead of re-using them? Or there any plans in releasing something in Flarum core to help extension developers with something like that?

askvortsov

pkernstock Core already supports extensions bundling and preloading their own assets:

Extensions can already include their own assets by just placing static files in the assets subdirectory with relation to the extension root.
Assets can be preloaded via the Frontend::preload extender

From there, extensions would just need to decide whether to bundle assets and reference them this way, or reference them externally via a CDN. And that's the complicated part, because I don't really see a way for core to enforce one policy or another. Furthermore, I'm not sure it should do so, since this limits some legitimate use cases.

One thing that could make sense is if a common util extension provided an abstraction layer over emojis for other extensions. This extension could (theoretically) support aggregating emojis from various sources, including CDNs, custom file uploads, etc. It could be a dependency for all the extensions depending on emojis (flarum/emoji, flamoji, fof/reactions, etc). But I don't think the core team currently has the time to maintain this, and it would only solve this problem for the narrow realm of emojis.