add scripts from cli (#680)

* add scripts from cli

* add warning when including scripts

* flake8 fixes

* confirm scripts injection

client/index_template.html

@@ -10,6 +10,7 @@
             font-family: 'Roboto Condensed', 'Helvetica Neue', 'Helvetica', 'Arial', sans-serif;
             font-size: 14px;
         }
+
         body {
             margin: 0;
             padding: 0;
@@ -19,6 +20,7 @@
             box-sizing: border-box;
         }
     </style>
+
 </head>
 <body>
 <script type="text/javascript">
@@ -28,8 +30,13 @@ window.CELLXGENE.API = {
     version: "v0.2/"
   };
 </script>
-    <noscript>If you're seeing this message, that means <strong>JavaScript has been disabled on your browser</strong>, please <strong>enable JS</strong> to make this app work.</noscript>
+<noscript>If you're seeing this message, that means <strong>JavaScript has been disabled on your browser</strong>,
+    please <strong>enable JS</strong> to make this app work.
+</noscript>
 
 <div id="root"></div>
+{% for script in SCRIPTS %}
+<script type="text/javascript" src="{{script | safe}}"></script>
+{% endfor %}
 </body>
 </html>

server/app/web/webapp.py

@@ -8,7 +8,8 @@ bp = Blueprint("webapp", __name__, template_folder="templates")
 @bp.route("/")
 def index():
     dataset_title = current_app.config["DATASET_TITLE"]
-    return render_template("index.html", datasetTitle=dataset_title)
+    scripts = current_app.config["SCRIPTS"]
+    return render_template("index.html", datasetTitle=dataset_title, SCRIPTS=scripts)
 
 
 @bp.route("/favicon.png")

server/cli/launch.py

@@ -66,6 +66,13 @@ from server.app.util.utils import custom_format_warning
     show_default=True,
     help="Relative expression cutoff used when selecting top N differentially expressed genes",
 )
+@click.option(
+    "--scripts",
+    default=[],
+    multiple=True,
+    help="Additional script files to include in html page",
+    show_default=True,
+)
 def launch(
         data,
         layout,
@@ -80,6 +87,7 @@ def launch(
         host,
         max_category_items,
         diffexp_lfc_cutoff,
+        scripts,
 ):
     """Launch the cellxgene data viewer.
     This web app lets you explore single-cell expression data.
@@ -106,6 +114,19 @@ def launch(
     else:
         warnings.formatwarning = custom_format_warning
 
+    if scripts:
+        click.echo(r"""
+/ / /\ \ \__ _ _ __ _ __ (_)_ __   __ _
+\ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+ \  /\  / (_| | |  | | | | | | | | (_| |
+  \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+                                  |___/
+The --scripts flag is intended for developers to include google analytics etc. You could be opening yourself to a
+security risk by including the --scripts flag. Make sure you trust the scripts that you are including.
+        """)
+        scripts_pretty = ", ".join(scripts)
+        click.confirm(f"Are you sure you want to inject these scripts: {scripts_pretty}?", abort=True)
+
     if not verbose:
         sys.tracebacklimit = 0
 
@@ -121,6 +142,7 @@ def launch(
 
     app = server.create_app()
     app.config.update(DATASET_TITLE=title)
+    app.config.update(SCRIPTS=scripts)
 
     if not verbose:
         log = logging.getLogger("werkzeug")