Support asset-packagist for library download

MR needs a rebase.

Updated library version and did rebase.

Thanks @VladimirAus!

@Chi do you think this can do any harm? For me it looks like it's just another option.
The worst part is to update the hard coded version from time to time...

I think the general problem is, that there's not yet a good core solution for external library dependencies via composer?

@Anybody, No idea. Personally, I don't use Composer for managing JS libraries.

What about using https://asset-packagist.org/package/bower-asset/codemirror instead of the custom declaration and documenting this in the README.md?

Then we wouldn't have to add the definition ourselves...
(bower-asset is better then npm-asset as it typically only bundles the required assets, not the whole library)

Didn't try it yet for codemirror_editor myself!

Just tried
composer require npm-asset/codemirror
composer require bower-asset/codemirror
https://asset-packagist.org/package/search?query=codemirror&platform=bow...
both work to download the library into libraries/codemirror (if configured correctly in composer)

But status report says:

Errors found
CodeMirror library
Not found
You need to download the CodeMirror library and extract the archive to the libraries/codemirror directory on your server.

propably due to different folder structures.

I think the best way to proceed here is to support

• CDN (disabled by default for GDPR reasons - opt-in needed)
• manual library upload
• Installation via asset-packagist

BTW we should specify, which version(s) of codemirror are supported!

@Grevil could you please take a look what's the difference in expected vs. actual directory structure and how to solve this without a breaking change?

I think maintaining the dependency ourselves is worse, so I'll rename the issue and close the MR.

But perhaps we should ship this with a fresh 2.x semver branch?

Anybody → closed merge request !2

Okay I think I found the difference. There are no .min.js files in the npm/bower assets. Guess that's what codemirror is looking for.
Still that would be something we can't fix in the library. We could just depend the non-minified files?

But please double-check my assumption.

@Anybody, have you read the README.md? 😛

If you are using Composer for downloading third-party libraries turn off
the 'minified' setting as asset-packagist.org does not provide minified files.

Turning that setting of and simply running composer require bower-asset/codemirror solves the status report issue and makes the library usable. 😉

Thanks @Grevil! ;)

Still I think we should improve the situation by showing that hint in the issue summary. Furthermore we should inform about the composer installation steps on the module page and the README.md I think.

Currently that way is poorly documented, leading to this issue, I think:
https://git.drupalcode.org/project/codemirror_editor/-/blob/8.x-1.x/READ...

Grevil → closed merge request !6

But yea the statement by @Chi in comment #6:

Right, Composer based installation is not supported.

Seems to be untrue. The composer "instruction" was introduced 4 years ago in the README through #3066348: Existing README needs some formating → . But in all fairness, he doesn't manage his js libraries through composer.

@Grevil: Yes, both are true. There are good reasons for NOT using composer for npm / bower assets (security), see the related core issues. But in reality people need ways to do that at least optionally.

So I think extending the README.md a bit and putting the drush command vs. the composer commands on the module page might be useful.

We could also add a link to the core issue with the related discussion about security.

References:

• https://github.com/drupal-composer/drupal-project/issues/278
• #3198245: Composer script: enable-asset-packagist →
• ✨ Official support for npm Closed: duplicate
• https://www.drupal.org/docs/develop/using-composer/manage-dependencies →

Alright, please review the README change.

@Grevil: Please also add a sentence to the status report error: "If you installed the library using composer, please remember to switch off the *minified* setting on the [LINK] module settings page" << example

Here is a screenshot of the modified status report message:

Automatically closed - issue fixed for 2 weeks with no activity.