New option to disable the vue template compiler

[bastianallgeier]

Summary of changes

• A new vue.runtime.js is added to the dist folder and loaded on demand when the compiler is disabled
• A new config option (see below) is used in the Assets class to load the right file
• An info box is shown in lab examples if the compiler is disabled. Lab examples can no longer be displayed
• A new security warning has been added to the system view when the compiler is active. This might need to be less aggressive.

Todos

• The security warning leads to https://getkirby.com/security/vue-compiler which does not exist yet
• The text for the security warning is not yet translated.
• Add unit test for Assets::vue

Changelog

Enhancements

• The Vue template compiler can be switched off in the config. This will load the vue runtime version. Plugins and the lab views that rely on the template compiler will no longer work.

// `/site/config/config.php`
return [
  'panel' => [
    'vue' => [
      'compiler' => false
    ]
  ]
]

[lukasbestle]

I get why this security warning depends on the debug mode: If we would always display it, we would have a security warning for the default configuration of the panel.vue.compiler option, which is weird. But IMO making it dependent on the debug mode is also weird – it's not an information one needs during debugging, but especially in production.

So I wonder if we can find a different solution:

• Maybe we can find a different way or place to display this warning in a context-sensitive way.
• Maybe it is possible to auto-detect whether any installed plugin needs the template compiler and control the default value of the option accordingly? Then we could display this warning even without debug mode.
• ...

[distantnative]

I wouldn't display it without debug mode or some other restriction (admins only?) cause the choice to have it might be done very deliberately by the developer, but then the users/customers freak out due to this warning if it's shown to them in production.

[lukasbestle]

That's true. I like the idea of admin-only.

[distantnative]

Or we only show it as long as the config option isn't set (so instead of passing a fallback/default we first check for null).

[bastianallgeier]

I love that last idea.

[bastianallgeier]

I've implemented it like that.

[distantnative]

@bastianallgeier Now he message is shown when set to true explicitly. My suggestion was rather to check for null, show it as long as no config option is set.

[bastianallgeier]

I've had a closer look at the coverage and I really think it's another issue from Codecov. The lines are all covered.