Support for custom JS files

[robinkar]

The new custom CSS feature (#2150) introduced in OOD 3.0 is quite nice. It would be nice to have a similar feature available for including custom JS files.
As an example, the JS we would like to include consists of Matomo tracking code and some code used in all interactive app forms, which we would like to avoid copying across all of the form.js files and include globally instead.

Currently, we include these JS files by overriding views/layouts/application.html.erb, but an officially supported method for accomplishing this would be great.

┆Issue is synchronized with this Asana task by Unito

[johrstrom]

Hi, thanks for the ticket. I recall someone else (maybe CSC) wanting Matomo support directly so that could be an option.

I'm a little weary to add this directly. It could introduce a big vulnerability. On the other hand, there's clearly something you need that we don't support directly so ... it does add support for a lot of things indirectly.

[abujeda]

Created an implementation proposal based on the custom CSS feature:
#2791

[johrstrom]

Yea thinking about this again, it really comes down to having a strong CSP and if we can secure the assets we serve, which that PR seems to do.

[robinkar]

Hi, thanks for the ticket. I recall someone else (maybe CSC) wanting Matomo support directly so that could be an option.

I'm a little weary to add this directly. It could introduce a big vulnerability. On the other hand, there's clearly something you need that we don't support directly so ... it does add support for a lot of things indirectly.

I think that might have been us at CSC wanting Matomo support indeed. We do some slight customization of what data is reported though, so not sure if a generic solution would be suitable for us. We for example sanitize the files app URLs and add tracking for Shell app launches.

Created an implementation proposal based on the custom CSS feature: #2791

That is great, thank you.