I have always struggled with how packages are versioned and published to the npm registry.
My main concern is that you probably want to also add a git tag to your source code when you are releasing a new version, but npm packages have their own versioning system, and include a &quot;version&quot; field in the package.json
Because of this, most of the workflows I have seen, usually involve:
<ol>
<li>Running <code>npm version ...</code>. This will update the &quot;version&quot; field in the package.json file.</li>
<li>Publishing the package to the npm registry, using the version set in previous step.</li>
<li>Committing to git, so that we track the change in package.json file.</li>
<li>Adding a git tag.</li>
<li>Pushing to git remote to track new commit and new tag.</li>
</ol>
<blockquote>
Steps 3 and 4 are frequently done automatically as part of <code>npm version</code>.
</blockquote>
For me this flow has two main problems:
<ul>
<li>
My personal preference is that everything is driven by git tags, making them the single source of truth.
This would allow to just have one manual step -&gt; <code>git tag -a v1.0.0 -m &quot;...&quot; &amp;&amp; git push origin --tags</code>. Then, this would trigger a number of potential automations, including publishing to the npm registry, but also others like creating a release with the appropriate release notes, building release artifacts, etc.
</li>
<li>
The &quot;version&quot; field in the package.json file can very easily become outdated, if you git-tag by mistake before publishing the package, or if pushing the changes fails after <code>npm version ...</code> has been run.
I&#x27;ve seen this happening more often than it seems.
</li>
</ul>
Because of this, my current take when publishing npm packages for my personal projects is:
<ol>
<li>
Get rid of the &quot;version&quot; field from the package.json file. It&#x27;s misleading in source code, as it can very easily be out of date.
The only case where it&#x27;s useful is when the package has been installed and is inside node_modules, as other packages will assume this field to exist and have the right value on it.
In this case it&#x27;s always going to be correct due to the<code>npm version ...</code> + <code>npm publish</code> tandem (see next point).
</li>
<li>
Creating the git tag is the only &quot;manual step&quot;. This triggers an automation running <code>npm version ${GIT_TAG} --git-tag-version=false &amp;&amp; npm publish</code> (this is simplified. You probably also need to build your project and other potential extra steps).
The version to publish is inferred from the git tag (<code>${GIT_TAG}</code> is just a placeholder), and only at this stage we will set the &quot;version&quot; inside package.json, just before the package is published.
</li>
<li>
Other automations that need to happen during releases, can be also triggered now, like publishing release notes, building artifacts, etc.
</li>
</ol>
<blockquote>
As an example, you can see <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/github-actions/blob/24de7a2b89a9eb11b0acfd184de7187698b051b6/.github/workflows/js-lib-publish.yml">this GitHub actions workflow</a>, which follows this approach.
</blockquote>

I have always struggled with how packages are versioned and published to the npm registry. My main concern is that you probably want to also add a git tag to your source code when you are releasing a new version, but npm packages have their own versioning system, and include a "version" field in…

My current take when publishing packages to the npm registry

A couple of weeks ago I migrated a React project using redux to <a target="_blank" rel="noopener noreferrer" href="https://redux-toolkit.js.org/">Redux Toolkit</a>.
Redux has always been my preferred state management tool for React (which doesn&#x27;t mean I &quot;love&quot; it), but one of its main problems is the amount of boilerplate code it requires.
Because of that I had a couple of helper functions, but there was still some things not properly handled, like proper type inference on reducers and actions (I use TypeScript).
A bit by accident (I think it was on Twitter), I found out about Redux Toolkit (RTK from now on), an official library from the redux team, which provides some opinionated helpers to reduce the amount of boilerplate, and I decided to give it a chance.
These are my impressions.
<h3>TL;DR</h3>
I first started to use it in a proof of concept, and I quickly loved it.
RTK does not &quot;replace&quot; any of the redux principles, so you can progressively adopt it, by replacing small bits of code. My plan was to use it just for some reducers, but I liked it so much that I ended up migrating the whole project in a series of consecutive pull requests.
<h3>A bit of context</h3>
Before the migration, I used to follow the <a target="_blank" rel="noopener noreferrer" href="https://github.com/erikras/ducks-modular-redux">ducks modular pattern</a>, which promotes putting all your action types, action creators and the reducer handling those actions on the same module.
This fits pretty well with RTK, as in most of the cases you will use <a target="_blank" rel="noopener noreferrer" href="https://redux-toolkit.js.org/api/createSlice">slices</a>, and end up exporting the reducer and action creators returned by it, from the same module.
If you use <a target="_blank" rel="noopener noreferrer" href="https://redux-toolkit.js.org/api/createAsyncThunk">async thunks</a>, they usually need to be used by that same slice, so it&#x27;s not a bad idea to export them also from there.
<h3>Why I love it</h3>
There are a couple of reasons for which I loved RTK right away. The main one is that they make an impressive work on making type inference in TypeScript work properly.
<ul>
<li>Slices detect the type of the initial state in order to know what is expected to be passed as <code>state</code> to reducers.</li>
<li>You can infer the type of your store from what is generated by <code>configureStore</code> or <code>combineReducers</code> functions, allowing you to also properly type the <code>dispatch</code> function.</li>
<li>Action creators are generated with the proper param types based on the reducers provided to <code>createSlice</code> or the callback provided to <code>createAsyncThunk</code>.</li>
<li><code>createSlice</code> can consume all the action creators generated by <code>createAsyncThunk</code>, and infer the proper payload for each one of them.</li>
</ul>
Thanks to this, the code is super predictable and potential bugs can be caught sooner.
<blockquote>
More details on how to use RTK with typescript https://redux-toolkit.js.org/usage/usage-with-typescript
</blockquote>
But this is not the only benefit. Other reasons that make it very nice to work with are:
<ul>
<li>It keeps the same concepts from Redux, but removing the boilerplate or your own helper functions if you have them (yes, I didn&#x27;t want to keep all those <code>switch</code> statements everywhere).</li>
<li>It is mostly transparent for the components dispatching the actions or consuming the state.</li>
<li>All the tests covering your reducers/actions/components should keep passing, as the outcome from RTK is the same as if you built everything manually.</li>
<li>It introduces a couple of extra helpers, like <a target="_blank" rel="noopener noreferrer" href="https://redux-toolkit.js.org/rtk-query/overview">RTK query</a> or the <a target="_blank" rel="noopener noreferrer" href="https://redux-toolkit.js.org/api/createListenerMiddleware">listener middleware</a>, which is very useful to dispatch actions as a result of other actions being dispatched.</li>
</ul>
<h3>Challenges I found</h3>
Of course, adopting a new tool always comes with some challenges.
The main &quot;problem&quot; I found is that RTK is a bit opinionated, but that&#x27;s precisely how they manage to reduce boilerplate code, and it&#x27;s also &quot;advertised&quot; in their website, so not a big surprise.
I usually prefer to be in control of everything (configuration over convention), but that&#x27;s just a personal preference, and sometimes it&#x27;s ok to accept a bit of magic for the sake of simplicity.
This caused the next challenges for my particular case:
<ul>
<li>
RTK assumes your project follows a strict <a target="_blank" rel="noopener noreferrer" href="https://redux.js.org/tutorials/fundamentals/part-7-standard-patterns#flux-standard-actions">Flux pattern</a>, meaning your actions always have the properties <code>type</code>, <code>payload</code> and optionally <code>meta</code> and <code>error</code>.
I was not following this pattern (my actions had the payload &quot;mixed&quot; on the first object level), so I had to adapt all my actions first, fix the tests, then migrate the reducer to RTK and make sure the tests kept passing.
<div></div>
</li>
<li>
Immutability is no longer promoted in reducers. Instead, the library requires <a target="_blank" rel="noopener noreferrer" href="https://immerjs.github.io/immer/">immer</a> internally, and using proxies they automatically ensure immutability, even if you &quot;mutate&quot; the state.
This feels a bit counterintuitive at first, because redux always promoted an immutable approach, and the use of immer is not obvious.
However, they have <a target="_blank" rel="noopener noreferrer" href="https://redux-toolkit.js.org/usage/immer-reducers#why-immer-is-built-in">good reasons</a> to do it, and if your reducers return a state object, you can still use the immutable approach. It&#x27;s up to you.
<div></div>
</li>
<li>
Action creators resulting of <code>createAsyncThunk</code> can only have one argument.
This is because the async thunk callback receives a second argument containing the <code>dispatch</code> and <code>getState</code> functions, as well as a couple of other goodies, enforcing this convention to avoid human errors.
<div></div>
</li>
<li>
You cannot dispatch other actions after the callback passed to <code>createAsyncThunk</code>, because it has to return the payload and RTK dispatches the action for you.
However, this is probably something you usually should not be doing, and in my case, I resolved it with the <a target="_blank" rel="noopener noreferrer" href="https://redux-toolkit.js.org/api/createListenerMiddleware">listener middleware</a>, listening for the second action in order to dispatch the second one.
</li>
</ul>
<h3>Conclusion</h3>
My conclusion is that RTK is definitely worth it if you use redux.
It makes code simpler, more predictable and better typed. However, it still requires knowing how redux works internally and what are its patterns, in order to understand why the library exposes the helpers it exposes and why.
For existing redux projects, you can migrate progressively, addressing the challenges bit by bit and not all at once, which simplifies its adoption.
For new projects in which you want to use redux, I would recommend starting right away with RTK.

A couple of weeks ago I migrated a React project using redux to Redux Toolkit. Redux has always been my preferred state management tool for React (which doesn't mean I "love" it), but one of its main problems is the amount of boilerplate code it requires.

Because of that I had a couple of helper…

My experience migrating to Redux Toolkit (RTK)

In 2019, GitHub published their own solution to run automated workflows called GitHub Actions, which allowed those hosting their code in GitHub, to be able to define and run their CI/CD pipelines in the same platform. When it was released, one of the main pain points to use it was that defining…

How to reduce duplication in your GitHub Actions workflows

Recently ReactJS v18 was released. I started to look into its improvements, and checked which of my projects could benefit from them.
The main react-based project I maintain at the moment of writing this article is <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client">shlink-web-client</a>, so I naturally created a new branch and started the process.
The update was quite smooth, as most of the other dependencies I was using from the react ecosystem were already updated to support v18. All but one, <a target="_blank" rel="noopener noreferrer" href="https://enzymejs.github.io/enzyme/">enzyme</a>, the testing framework I was using to unit-test react components.
To be precise, I was able to continue running my tests, but some of them (those using <code>mount</code> instead of <code>shallow</code>) were still rendering components with the &quot;old&quot; React v17 approach, causing them to behave as in that version and a warning being printed in the console.
<h3>First fix attempt</h3>
The way enzyme integrates with the react version you are using is through an adapter library. The last official one supports only React v16, but someone released an <a target="_blank" rel="noopener noreferrer" href="https://github.com/wojtekmaj/enzyme-adapter-react-17">unofficial adapter for v17</a> which, with close to 650k weekly downloads, quickly became the way to go.
I checked if there was one for React 18, but sadly there wasn&#x27;t.
Also, the author of the adapter for v17 posted an article indicating <a target="_blank" rel="noopener noreferrer" href="https://dev.to/wojtekmaj/enzyme-is-dead-now-what-ekl">enzyme is dead</a>, he was not going to release one for v18, and publishing one for v17 was a mistake.
With those facts in mind, I started to face what was probably going to be the moment to migrate to <a target="_blank" rel="noopener noreferrer" href="https://testing-library.com/docs/react-testing-library/intro">react testing library</a>.
<h3>Migration strategy</h3>
I decided to follow a migration strategy similar to the one suggested in the article above, but with a couple of modifications:
<ul>
<li>I update to React 18 anyway, as tests still pass.</li>
<li>Migrate right away all tests using <code>mount</code>, as those are the ones behaving differently.</li>
<li>New tests should be written directly with react testing library (RTL from now on).</li>
<li>When an existing test needs to be changed, consider migrating it to RTL, and do it if there&#x27;s time.</li>
<li>Introduce some PR from time to time just migrating a handful of tests.</li>
<li>Once everything is migrated, get rid of everything related with enzyme.</li>
</ul>
<h3>First contact and impressions</h3>
I was a bit sceptical with RTL, as it was focused more on integration tests, instead of unit tests, which meant I had to completely change the mindset to write tests.
It also didn&#x27;t support shallow rendering, meaning that you will end up sometimes rendering a bigger component tree when testing container-like components, potentially causing side effects that could affect your test.
On the other hand there&#x27;s more and more people stating that <a target="_blank" rel="noopener noreferrer" href="https://kentcdodds.com/blog/why-i-never-use-shallow-rendering">shallow rendering is an anti-pattern</a>, and that&#x27;s probably the reason of enzyme getting &quot;discontinued&quot;.
Also, RTL has become the <a target="_blank" rel="noopener noreferrer" href="https://reactjs.org/docs/testing.html#tools">officially recommended framework</a> to test react components, it has become very popular, and it has even joined a wider group of testing libraries under the <a target="_blank" rel="noopener noreferrer" href="https://testing-library.com/"><code>@testing-library</code></a> organization.
The thing is that I started to use it, and I was quickly surprised with how it felt to work with it, and all the benefits it was bringing to my tests.
<h3>Benefits I have experienced</h3>
Once I started migrating the first tests I noticed some benefits:
<ul>
<li>Changing my mindset was actually easier than I thought. The docs are very well written, so it&#x27;s relatively easy to start using RTL.</li>
<li>My tests got simpler, and required less of those nasty global mocks that jest allows (I&#x27;m looking at you, <a target="_blank" rel="noopener noreferrer" href="https://jestjs.io/es-ES/docs/mock-functions#mocking-modules"><code>jest.mock</code></a>).</li>
<li>Tests were way less coupled with implementation details. I moved from testing the component props, to test what the user would see on the screen.</li>
<li>Related with previous point, I started to write my tests by looking at the screen instead of the component&#x27;s implementation.</li>
<li>Changes in source code led to fewer tests requiring to be changed.</li>
<li>A progressive migration was possible, where some tests still use enzyme and others are already using RTL.</li>
</ul>
And overall, it felt good and I have already dedicated a couple of PRs just to migrate more tests.
<h3>Challenges I faced</h3>
But of course, migrating to a new tool always comes with its own challenges, and this was not an exception. I&#x27;ll explain the main ones I have faced so far and how I tackled them:
<ul>
<li>
RTL lets you do some things in a couple of different ways, and the docs may not be super clear about what&#x27;s the recommended option.
For this I recommend reading <a target="_blank" rel="noopener noreferrer" href="https://acel.me/DCMb1">this article</a> from Kent C. Dodds, RTL&#x27;s author, which explains some common mistakes when using the library.
</li>
<li>
At first, I struggled a bit with asynchronous side effects and state changes in components, which can easily end up printing a warning like <code>Warning: An update to MyComponent inside a test was not wrapped in act</code>.
The warning also explains how you are supposed to solve this by wrapping your code in <code>act()</code>, but this warning comes from React, not RTL, and what it is not telling you is that RTL already wraps all needed operations in <code>act()</code>.
What this error usually mean is that you are not waiting for something to happen. <a target="_blank" rel="noopener noreferrer" href="https://acel.me/jnUdT">This other article</a>, also from Kent C. Dodds, explains everything you need to know about the things that can lead to this warning, and how to solve them.
</li>
<li>
Since you start testing from the user point of view, some use cases can be challenging to test without coupling with implementation details. For example, when you have a component which dynamically renders different images or icons, I used to directly check the component properties.
For this I found the best solution was to use <a target="_blank" rel="noopener noreferrer" href="https://jestjs.io/docs/snapshot-testing">jest snapshots</a>. I didn&#x27;t want to manually check which SVG was being rendered in the DOM, just that different ones were being used in every case.
<pre class="language-tsx"><code class="language-tsx">// I went from this...
test(&#x27;...&#x27;, () =&gt; {
 const wrapper = shallow(&lt;MyComp dynamicValue=&quot;foo&quot; /&gt;);
 expect(wrapper.find(FontAwesomeIcon).prop(&#x27;icon&#x27;)).toEqual(someIcon);
})

// To this
test(&#x27;...&#x27;, () =&gt; {
 const { container } = render(&lt;MyComp dynamicValue=&quot;foo&quot; /&gt;);
 expect(container.firstChild).toMatchSnapshot();
})
</code></pre>
</li>
<li>
Something very similar happens if you use some library that renders canvas. There&#x27;s no way to test that from a DOM point of view, which is what RTL does.
In my case I was using <a target="_blank" rel="noopener noreferrer" href="https://www.chartjs.org/">Chart.js</a> to render some charts, so I used <a target="_blank" rel="noopener noreferrer" href="https://github.com/hustcc/jest-canvas-mock">jest-canvas-mock</a>, which exposes a method on the canvas to see which are all the events invoked from the library.
Then I used snapshots again to verify they had the expected &quot;shape&quot;.
<pre class="language-tsx"><code class="language-tsx">// I went from this...
test(&#x27;...&#x27;, () =&gt; {
 const wrapper = shallow(&lt;MyCompWithCanvas /&gt;);
 expect(wrapper.find(Chart).prop(&#x27;data&#x27;).datasets).toEqual(...);
})

// To this
test(&#x27;...&#x27;, () =&gt; {
 const { container } = render(&lt;MyCompWithCanvas /&gt;);
 const events = container.querySelector(&#x27;canvas&#x27;)?.getContext(&#x27;2d&#x27;)?.__getEvents();

 expect(events).toBeTruthy();
 expect(events).toMatchSnapshot();
})
</code></pre>
</li>
</ul>
<h3>Conclusion</h3>
For better or worst, enzyme should no longer be considered an option. If you are starting a new project or are using it on small ones, consider migrating to RTL as soon as possible.
If you are using it in bigger projects, following the process described in this article will probably help you.
In any case, you will get surprised. React testing library is a great tool and provides many benefits over enzyme.
Its main issue is that it&#x27;s not a drop-in replacement for enzyme, so you will have to change a bit your mindset.

Recently ReactJS v18 was released. I started to look into its improvements, and checked which of my projects could benefit from them. The main react-based project I maintain at the moment of writing this article is shlink-web-client, so I naturally created a new branch and started the process.

The…

My experience migrating from enzyme to react testing library

Capturing code coverage for a test suite is a very useful way to know which parts of your source code are actually getting executed by tests. This is useful not only to know if you need to add more tests to your project (in case the coverage is too low), but also, if you want to apply technics like…

Capturing remote code coverage in API tests with PHPUnit

In the last couple of days I have been playing around with the idea of combining GitHub Actions and GitHub Pages to be able to dynamically build preview environments every time a pull request is opened against a repository hosting a client-side web app.
The idea is that you can quickly preview the changes made by some contributor, without having to clone their branch and running everything locally, something specially useful for open source projects.
In this article I will explain how to set everything up, and what are some considerations and problems you may face during the process.
<h3>Enable github pages</h3>
The first thing you need to do is enable your project to publish pages on some branch. I recommend creating a new branch for this, let&#x27;s say <code>preview-env</code>, and then enabling publishing on it.
In order to do that go to your repository and then Settings -&gt; Pages, look for the Source section, and you should see something like this:
<img src="/assets/img/preview-envs/github-pages-before-enabling.png" alt="GitHub pages before enabling"/>
Click in the dropdown and select your new branch, <code>preview-env</code>. Then click Save.
<img src="/assets/img/preview-envs/github-pages-after-enabling.png" alt="GitHub pages after enabling"/>
After saving you will see a message at the top of this section telling you what&#x27;s the URL in which the pages are published. It always follows the same pattern. If your organization is <code>my-org</code> and your repository is <code>my-repo</code>, the url will be <code>https://my-org.github.io/my-repo/</code>.
<h3>Configure the workflow</h3>
Now we need to configure a workflow that will &quot;deploy&quot; the preview environment for the branch every time a new pull request is created or updated:
Let&#x27;s imagine we have a React web app that is built with node.js. The configuration could look like this.
<pre class="language-yml"><code class="language-yml"># .github/workflows/deploy-preview.yml
name: Deploy preview

on:
 pull_request: null

jobs:
 deploy:
 runs-on: ubuntu-20.04
 continue-on-error: true
 steps:
 - name: Checkout code
 uses: actions/checkout@v2
 - name: Use node.js 14.15
 uses: actions/setup-node@v1
 with:
 node-version: 14.15
 - name: Generate slug
 id: generate_slug
 run: echo &quot;##[set-output name=slug;]$(echo ${GITHUB_HEAD_REF#refs/heads/} | sed -r &#x27;s/[~\^]+//g&#x27; | sed -r &#x27;s/[^a-zA-Z0-9]+/-/g&#x27; | sed -r &#x27;s/^-+\|-+$//g&#x27; | tr A-Z a-z)&quot;
 - name: Build
 run: npm ci &amp;&amp; npm run build
 - name: Deploy
 uses: JamesIves/github-pages-deploy-action@4.1.1
 with:
 branch: preview-env
 folder: build
 target-folder: ${{ steps.generate_slug.outputs.slug }}
 - name: Publish env
 uses: marocchino/sticky-pull-request-comment@v2
 with:
 header: Preview environment
 message: |
 ## Preview environment
 https://my-org.github.io/my-repo/${{ steps.generate_slug.outputs.slug }}/
</code></pre>
<blockquote>
If you are not familiar with GitHub Actions yet, take a look at the <a target="_blank" rel="noopener noreferrer" href="https://docs.github.com/en/actions">official documentation</a>.
</blockquote>
This workflow will follow the next steps:
<ul>
<li>Checkout the code from the repository.</li>
<li>Set-up node.js 14.15</li>
<li>Based on the branch name, generate a slug that we will use to have separated deployment folders for every pull request we receive. The slug is exposed to next steps as an output.</li>
<li>Build the project. This step will obviously depend on the needs of your project.</li>
<li>Using <a target="_blank" rel="noopener noreferrer" href="https://github.com/JamesIves/github-pages-deploy-action">JamesIves/github-pages-deploy-action</a>, deploy the contents we previously built in the GitHub page, under a sub-folder matching the slug we generated a few steps above, and under the branch <code>preview-env</code> (remember we enabled GitHub pages for this branch).</li>
<li>Finally, using <a target="_blank" rel="noopener noreferrer" href="https://github.com/marocchino/sticky-pull-request-comment">marocchino/sticky-pull-request-comment</a>, post a comment in the pull request with a link to the preview environment, so that you can just click on it and see the deployment.</li>
</ul>
The steps may change depending on your needs and how you build your project. For example, I have an extra step to update a property in the <code>package.json</code> that is then used to allow serving the app in a sub-path instead of the root of the domain.
You may also not build your site with node.js, as you could be using any of the multiple existing static site generators out there, but you get the idea.
Finally, you have probably noticed the config includes <code>continue-on-error: true</code>. This will allow the pull request to be merged even if this process fails for some reason.
<h3>Considerations when using forks</h3>
While the configuration above will work perfectly when creating pull requests inside the same repository, there are some limitations when the pull request comes from a fork (which is the usual in OSS projects).
For security reasons, the <code>GITHUB_TOKEN</code> injected in those cases doesn&#x27;t have write permissions, which will make the &quot;deploy&quot; step fail.
Also, you cannot define your own token with more permissions and inject it as a secret, as the secrets are not exposed to workflows running on forks.
However, with a couple small config changes, we can work around these limitations:
<h4>Change event</h4>
The first thing we need to do is use the <code>pull_request_target</code> event instead of the <code>pull_request</code> one.
<pre class="language-diff"><code class="language-diff">on:
- pull_request: null
+ pull_request_target: null
</code></pre>
According to the documentation, this is equivalent to the <code>pull_request</code> event, but it runs in the scope of the base repository.
Thanks to this, the <code>GITHUB_TOKEN</code> will come with write permissions, and we will have access to secrets if needed.
<h4>Checkout the fork</h4>
The second thing we are going to change is that we now need to specify the repository to checkout.
In order to do that, we need to add two inputs to the &quot;Checkout code&quot; step, like this:
<pre class="language-diff"><code class="language-diff"> steps:
 - name: Checkout code
 uses: actions/checkout@v2
+ with:
+ repository: ${{ github.event.pull_request.head.repo.full_name }}
+ ref: ${{ github.event.pull_request.head.ref }}
</code></pre>
This will ensure we checkout from the fork repository, instead of the base one, which is the default, as it&#x27;s the one where the <code>pull_request_target</code> event is scoped to.
And that&#x27;s it. With these two changes you can now deploy preview environments for pull requests coming from forks.
<blockquote>
IMPORTANT! The limitations of the <code>pull_request</code> event are there for a reason. People could potentially get access to your secrets or manipulate your code. Proceed at your own risk.
</blockquote>
<h3>Other considerations</h3>
Other than the limitations for forks, there are a few other minor things to take into consideration.
<ul>
<li>Changes in GitHub Pages do not reflect immediately. It may take up to a couple of minutes for the deployment to be available, but considering you will usually not review a PR right after it has been created, this should not be a big issue.</li>
<li>As you have seen, every time a pull request is created, the deployment will generate a new folder in your GitHub Pages branch. This may result in a lot of old folders to pile-up, so you may want to set up some way to clean them up periodically or after the pull request has been merged.</li>
<li>Due to the fact that GitHub Pages only allows static pages to be served, this process cannot be used with apps that require some kind of back-end or server-side logic.</li>
<li>If your project is already using GitHub Pages for something else (serve the project&#x27;s website or docs), that may conflict with this, preventing you from having this kind of preview envs.</li>
</ul>

In the last couple of days I have been playing around with the idea of combining GitHub Actions and GitHub Pages to be able to dynamically build preview environments every time a pull request is opened against a repository hosting a client-side web app. The idea is that you can quickly preview the…

Setting-up a preview environment for your client-side apps with GitHub Actions and GitHub Pages

Two days ago I released the first major version in almost 2 years for <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client">shlink-web-client</a>, a web UI for <a target="_blank" rel="noopener noreferrer" href="https://shlink.io">shlink</a>, my self-hosted URL shortener.
This new version introduces several improvements to the project, and I thought it was worth writing a post to explain all of them in depth.
<h3>New design</h3>
The project has been using the same design almost since the beginning. It was clean, but it laked a bit of contrast and consistency in many sections.
Now the main background is light-gray, with components composed in white cards with a slight box shadow, that makes them easier to spot inside the app.
Also, the main area has now a max-width that prevents components from stretching too much on wide screens.
<div class="row"><div class="col-md-6 "><img alt="Before" src="/assets/img/shlink-web-client-3/design-before.png" class="gallery-item"/>Before</div><div class="col-md-6 "><img alt="After" src="/assets/img/shlink-web-client-3/design-after.png" class="gallery-item"/>After</div></div>
<h3>Overview page</h3>
Up until now, after connecting to a Shlink server, you went directly to the list of short URLs.
With this new version, you now see an overview page first, which displays some general stats, a quick short URL creation form, and the latest 5 short URLs.
From there, you can navigate to the full list of short URLs, with filtering capabilities, or go to the advanced short URL creation form.
<div class="row"><div class="col-md-8 col-md-offset-2 "><img alt="Overview" src="/assets/img/shlink-web-client-3/overview.png" class="gallery-item"/>Overview</div></div>
<h3>Improved short URL creation form</h3>
One of the sections with more room for improvement was the short URL creation form. It had all the inputs mixed, displaying just the &quot;long url&quot; one, with the option to un-collapsing the rest at will.
The new design groups the inputs by context, which makes it more clear. It also displays the inputs all the time, since the &quot;quick form&quot; is now located in the overview page.
<div class="row"><div class="col-md-6 "><img alt="Before" src="/assets/img/shlink-web-client-3/creation-form-before.png" class="gallery-item"/>Before</div><div class="col-md-6 "><img alt="After" src="/assets/img/shlink-web-client-3/creation-form-after.png" class="gallery-item"/>After</div></div>
<h3>Enhanced visits page</h3>
The visits page had a problem, it was trying to display too much information in a single place.
<ul>
<li>Visits over time</li>
<li>Visits from every platform</li>
<li>Visits from every location</li>
<li>A list of visits as a table</li>
</ul>
The new approach splits those in subsections with their own sub-route each (<code>/by-location</code>, <code>/by-context</code>, etc). This helps to render a smaller amount of charts at once, since they are a bit CPU greedy.
Also, only the visits from the last 30 days are loaded by default, making it load way faster for URLs with a lot of visits.
<div class="row"><div class="col-md-6 "><img alt="Before" src="/assets/img/shlink-web-client-3/visits-before.png" class="gallery-item"/>Before</div><div class="col-md-6 "><img alt="After" src="/assets/img/shlink-web-client-3/visits-after.png" class="gallery-item"/>After</div></div>
<h3>Outer sections</h3>
The app has some sections which are not related to a specific server, like creating/editing servers, or the settings page.
These sections have also been adapted to the new style, and they also have a max-width for wide screens.
<div class="row"><div class="col-md-6 "><img alt="Before" src="/assets/img/shlink-web-client-3/create-server-before.png" class="gallery-item"/>Before</div><div class="col-md-6 "><img alt="After" src="/assets/img/shlink-web-client-3/create-server-after.png" class="gallery-item"/>After</div></div>
<h3>Date range selector</h3>
A new component allows selecting date ranges either by relative time ranges (last 30 days, last 90 days...) or by selecting absolute start and end dates.
This component is used to filter both short URL lists and visits lists.
<div class="row"><div class="col-md-6 col-md-offset-3"><img alt="Date range selector" src="/assets/img/shlink-web-client-3/date-range-selector.png" class=""/>Date range selector</div></div>
<h3>Domain selector</h3>
Shlink has had multi-domain support for some versions, but changing the domain from the web client required to set the value manually, which is a bit error-prone.
This version introduces a new component which allows selecting from domains already used in the past (which is what you will want in most of the cases), preventing accidental typos.
It also allows setting new values in case you want to use a new domain that you never used before. This domain will then appear in the list the next time.
<div class="row"><div class="col-md-6 "><img alt="Existing domains" src="/assets/img/shlink-web-client-3/domains-existing.png" class=""/>Existing domains</div><div class="col-md-6 "><img alt="New domain" src="/assets/img/shlink-web-client-3/domains-new.png" class=""/>New domain</div></div>
<h3>Other improvements</h3>
The changes described so far were the major ones. However, v3.0.0 includes a few other minor improvements.
<ul>
<li>Result and loading messages have been standardized: They are now more consistent and use the same set of components, which also ensures consistency in the future.</li>
<li>Error messages are now more descriptive: Instead of showing generic error messages when API calls fail, the actual error message is now always displayed, so that it&#x27;s easier to know what failed.</li>
<li>Dropped support for Shlink v1: All major versions come with some breaking changes that improve code maintainability. This one drops Shlink v1 support, which allows removing some conditional paths here and there.</li>
</ul>
Other than the last point, Shlink v3.0.0 is mostly backwards compatible, so it&#x27;s safe to upgrade if you are already using Shlink v2.x
<h3>Next steps</h3>
Of course this doesn&#x27;t end here, and I have a lot of ideas to improve it even further.
<ul>
<li>Dark theme: It&#x27;s what the cool kids do these days, and I have already done some experiments around it.</li>
<li>Shlink dashboard: Next gen web app for Shlink. You can read the whole reasoning in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client/issues/338">this issue</a>.</li>
<li>Filtering in lists added to URL: Many sections allow filtering lists, but the state is saved in memory, which means it gets lost if the page is refreshed, and it cannot be bookmarked. The intention is to make all filtering params to become part of the URL.</li>
<li>Exporting visits in CSV: It&#x27;s cool to see charts full of info, but sometimes admins need to feed other services with the data, and consuming the original API is not always an option. Exporting visits to a CSV file will be supported soon by shlink-web-client.</li>
</ul>

Two days ago I released the first major version in almost 2 years for shlink-web-client, a web UI for shlink, my self-hosted URL shortener. This new version introduces several improvements to the project, and I thought it was worth writing a post to explain all of them in depth.

New design

The…

Released shlink-web-client v3.0.0

Some of you know that I work now as a full stack javascript developer, and I have interacted with a few different projects, both in front-end javascript and in nodejs. My main concern about javascript has been that, apparently, the community has not adopted one of the practices that, for me, has…

Dependency injection in nodejs projects

I&#x27;m sure you are familiar with those &quot;remember me&quot; checkboxes in login forms. They are a common way to allow a user to keep his/her session in a web application for an extended period of time when he is in a trusted computer.
One could think that it is a small and easy-to-implement feature, but it has indeed a lot of considerations.
I wasn&#x27;t able to properly implement it in the first projects I worked in, and I&#x27;m trying to explain everything I&#x27;ve learned about it in the last years.
<blockquote>
In this article I&#x27;m not going to show you how to implement a persistent login in one or another programming language, but what are the good practices that should be followed when you implement it in the way you want.
</blockquote>
<h3>First thoughts.</h3>
The first thing that one could try is to extend the lifetime of the system that persists the session and identifies the user between requests (usually a cookie).
The problem is that many systems doesn&#x27;t allow to do that in an isolated way, you are forced to extend the lifetime of all sessions. Also, it is not always easy to change the session lifetime dynamically.
So it&#x27;s not a good idea, because the user could be accessing your app from a public computer, and his session could be stolen if he forgets to logout.
Because of this, the best way to do it is to have another element (another cookie) that keeps the persistent session and is used to transparently regenerate the regular session when it expires.
<h3>How to implement it.</h3>
When a user logs in and he has checked the &quot;remember me&quot; field, you will create a cookie with an extended lifetime (for example, 2 weeks).
That cookie will contain a unique token that will identify a user. It should be backed in the database by creating a table that relates the token with a user. It could contain other metadata too, like the client&#x27;s IP address or a flag that says if the session is still valid.
In consecutive requests, your system will keep checking if an authenticated user exists, but if not, instead of redirecting to a login or returning a 403 status, it should check for the persistent login cookie first.
When that cookie exists, you will find the user it belongs to, and authenticate him. Then, you will invalidate the cookie and the session in the database, and generate a new one that will expire in the same date as the previous one. Finally, the new token should be returned in a new persistent login cookie that will replace the previous one by having the same name.
When the user manually logs out, the persistent login cookie should be dropped too.
<h3>Security considerations</h3>
Now you have a basic idea on how to implement it, but there are some security considerations to take into account in order to avoid problems in the future.
The first thing that we have to assume is that persistent sessions have their risks. There is no way to implement a completely secure persistent login, but following this instructions the system will be reasonably secure.
<ul>
<li>Persistent login will be handled by a cookie in the client and a database in the server (or a similar persistence system).</li>
<li>Persistent sessions will have an expiration time, for example 2 weeks. During that time, any regular session will be regenerated by the persistent session. Once it has passed, the user will be prompted to provide his credentials when the regular session expires. The expiration time will be set both in the cookie and in the database.</li>
<li>Persistent login cookies will contain one-time tokens. Once a token has been used it will be invalidated and a new one will be generated.</li>
<li>In order to protect these tokens from <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Cross-site_scripting">XSS</a> attacks in the site, persistent login cookies should be <code>HttpOnly</code>, so that they cannot be read from the browser.</li>
<li>Multiple valid persistent sessions will be allowed.</li>
<li>When a user logs out, its current persistent session in the database and the persistent login cookie will be invalidated.</li>
<li>The user should be able to invalidate all the persistent sessions that are still valid.</li>
<li>Invalid persistent sessions won&#x27;t be deleted. This way, if the user tries to access with an invalid cookie, he will be notified of a possible stolen cookie, and immediately all the other persistent sessions will be invalidated.</li>
<li>When the user changes his/her password, all the persistent sessions should be invalidated.</li>
<li>The token needs to be unique. Just generate some hash including the date and some other field. It doesn&#x27;t need to be super secure, but make sure to not send critical information to the client (like usernames or passwords).</li>
<li>And finally, there should be some operations restricted to users whose regular session has been regenerated by a persistent session, like changing a password or performing some kind of payment. In those cases, the user should be prompted for his current password anyway.</li>
</ul>
Of course, if your system manages critical data, you shouldn&#x27;t implement persistent login at all. I don&#x27;t think you have seen it at any bank application.
In any other case, this should be a good way to go.

I'm sure you are familiar with those "remember me" checkboxes in login forms. They are a common way to allow a user to keep his/her session in a web application for an extended period of time when he is in a trusted computer. One could think that it is a small and easy-to-implement feature, but it…

How to properly implement persistent login

We are all very used to file uploads in plenty of web applications. From simple image uploads to a social network to multiple file uploads to file management applications like Dropbox. On this article I'm going to explain how to handle asynchronous multifile uploads from a jQuery powered front-end…

File uploads with Zend Framework 2 and jQuery

The <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/HTML5">HTML5</a> specification is in process to be a standard. New features are being included but some of them are already supported by major modern browsers.
One of those features is a group of new HTML tag attributes, really useful to solve situations that used to be fixed by using javascript.
<h3>Autofocus</h3>
This attribute makes an element to gain focus once te page has been loaded. Can be used with either an <code>input</code>, a <code>textarea</code> or a <code>button</code>
This is a boolean attribute, which means any value assigned to it is a valid value, it only needs to be present. Also, HTML5 specifications allows attributes without values, so it would be only necessary to attach the attribute to the element.
Usage:
<pre class="language-html"><code class="language-html">&lt;input type=&quot;text&quot; autofocus&gt;
&lt;textarea autofocus&gt;&lt;/textarea&gt;
&lt;button type=&quot;submit&quot; autofocus&gt;Send&lt;/button&gt;
</code></pre>
In a page there should be only one element with this attribute, but the last one will gain focus if more than one is present.
This attribute is supported by Google Chrome, Mozilla Firefox, Safari and Internet Explorer 10+.
<h3>Placeholder</h3>
The placeholder attribute allows us to define a helper text or default value in text input elements, dropping that value at the moment the user starts writing on the element, and displaying it again once the element gets an empty value. It can be used in both <code>&lt;input&gt;</code> and <code>&lt;textarea&gt;</code>.
Usage:
<pre class="language-html"><code class="language-html">&lt;input type=&quot;text&quot; placeholder=&quot;Name&quot;&gt;
&lt;input type=&quot;email&quot; placeholder=&quot;Email address&quot;&gt;
&lt;input type=&quot;password&quot; placeholder=&quot;Enter password&quot;&gt;
&lt;textarea placeholder=&quot;Comments&quot;&gt;&lt;/textarea&gt;
</code></pre>
This attribute is very useful in <code>&lt;input[type=password]&gt;</code> elements, where the placeholder value will be displayed despite that the user input will be hidden.
Internet Explorer 10+, Google Chrome, Mozilla Firefox, Safari and Opera do support this attribute.
Example:
<input type="password" placeholder="Enter your password" class="form-control"/>
<h3>Spellcheck</h3>
Nowadays, many browsers include dictionaries that allows us to see spelling errors in real time.
With spellcheck attribute we can define if certain element should use this feature or we want to disable it. It can be used in both <code>&lt;input&gt;</code> and <code>&lt;textarea&gt;</code>
Spellcheck accepts values true to enable the feature and false to disable it.
Usage:
<pre class="language-html"><code class="language-html">&lt;input type=&quot;text&quot; spellcheck=&quot;true&quot;&gt;
&lt;textarea spellcheck=&quot;false&quot;&gt;&lt;/textarea&gt;
</code></pre>
It is enabled in major browsers by default, so we will only need to disable it if needed.
Spellcheck is supported by Opera, Goocle Chrome and Safari.
<h3>Maxlength</h3>
This is also an attribute that can only be used on text input elements. It allows to define the maximum number of characers that can be written on that element.
Usage:
<pre class="language-html"><code class="language-html">&lt;input type=&quot;text&quot; maxlength=&quot;10&quot; placeholder=&quot;You can&#x27;t write more than 10 characters in here&quot;&gt;
&lt;textarea maxlength=&quot;200&quot;&gt;&lt;/textarea&gt;
</code></pre>
This attribute is useful to make client-side validation of the length of a field, but make sure to make server-side validation too.
All major browsers support this attribute.
Example:
<input type="text" maxLength="10" placeholder="You can&#x27;t write more than 10 characters in here" class="form-control"/>
<h3>Start</h3>
The start attribute is only used at ordered lists, <code>&lt;ol&gt;</code>, and is used to define the first numeric value of the list.
Usage:
<pre class="language-html"><code class="language-html">&lt;ol start=&quot;6&quot;&gt;
 &lt;li&gt;Item nuber six&lt;/li&gt;
 &lt;li&gt;Item number seven&lt;/li&gt;
 &lt;li&gt;Item number eight&lt;/li&gt;
&lt;/ol&gt;
</code></pre>
All major browsers support this attribute.
Example:
<ol start="6"><li>Item nuber six</li><li>Item number seven</li><li>Item number eight</li></ol>
<h3>Reversed</h3>
As well as the previous attribute, this is only used in ordered lists, <code>&lt;ol&gt;</code>, and is used to reverse the numeration of the list, making it start at the length of the list and end at 1.
It is boolean, so its only presence will make the magic.
Usage:
<pre class="language-html"><code class="language-html">&lt;ol reversed&gt;
 &lt;li&gt;Item number three&lt;/li&gt;
 &lt;li&gt;Item number two&lt;/li&gt;
 &lt;li&gt;Item number one&lt;/li&gt;
&lt;/ol&gt;
</code></pre>
Example:
<ol reversed=""><li>Item number three</li><li>Item number two</li><li>Item number one</li></ol>
Tip of the day!
Reversed attribute and start attribute can be combined in the same list, making the list go backwards but starting at the number we want to.
Example:
<ol start="2"><li>Item</li><li>Item</li><li>Item</li><li>Item</li><li>Item</li></ol>
Unfortunately only Google Chrome supports the reversed attribute.
<h3>Contenteditable</h3>
Last but not least. The contenteditable attribute acn be used on any element, making the content of that element editable directly from the browser.
Accepts values true and false, enabling or disabling the behavior.
Usage:
<pre class="language-html"><code class="language-html">&lt;p contenteditable=&quot;true&quot;&gt;This content is editable&lt;/p&gt;
&lt;div contenteditable=&quot;false&quot;&gt;This content is NOT editable&lt;/div&gt;
</code></pre>
This attribute is compatible with all major browsers.
Example:
<div contenteditable="true">This content is editable. Try it!</div>

The HTML5 specification is in process to be a standard. New features are being included but some of them are already supported by major modern browsers. One of those features is a group of new HTML tag attributes, really useful to solve situations that used to be fixed by using javascript.

Autofocu…

Alejandro Celaya | Blog

Software development, agile methodologies and open source software.

category Archive — "web"

— 2023 —

— 2022 —

— 2021 —

— 2020 —

— 2018 —

— 2016 —

— 2014 —