add scripts from cli (#680)

* add scripts from cli

* add warning when including scripts

* flake8 fixes

* confirm scripts injection

client/index_template.html

@@ -1,35 +1,42 @@
 <!DOCTYPE html>
 <html lang="en">
-  <head>
+<head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>cellxgene</title>
     <link href="https://fonts.googleapis.com/css?family=Roboto+Condensed:400,400i,700" rel="stylesheet">
     <style>
-      html, body, p, h1, h2, h3, h4, h5, h6, span, button, input, label, text, div {
+        html, body, p, h1, h2, h3, h4, h5, h6, span, button, input, label, text, div {
-        font-family: 'Roboto Condensed','Helvetica Neue','Helvetica','Arial',sans-serif;
+            font-family: 'Roboto Condensed', 'Helvetica Neue', 'Helvetica', 'Arial', sans-serif;
-        font-size: 14px;
+            font-size: 14px;
-      }
+        }
-      body {
-        margin: 0;
-        padding: 0;
-      }
 
-      * {
+        body {
-        box-sizing: border-box;
+            margin: 0;
-      }
+            padding: 0;
+        }
+
+        * {
+            box-sizing: border-box;
+        }
     </style>
-  </head>
-  <body>
-<script type="text/javascript">
-window.CELLXGENE = {};
-window.CELLXGENE.API = {
-  prefix: window.location.href + "api/",
-  version: "v0.2/"
-};
-</script>
-    <noscript>If you're seeing this message, that means <strong>JavaScript has been disabled on your browser</strong>, please <strong>enable JS</strong> to make this app work.</noscript>
 
-    <div id="root"></div>
+</head>
-  </body>
+<body>
+<script type="text/javascript">
+  window.CELLXGENE = {};
+  window.CELLXGENE.API = {
+    prefix: window.location.href + "api/",
+    version: "v0.2/"
+  };
+</script>
+<noscript>If you're seeing this message, that means <strong>JavaScript has been disabled on your browser</strong>,
+    please <strong>enable JS</strong> to make this app work.
+</noscript>
+
+<div id="root"></div>
+{% for script in SCRIPTS %}
+<script type="text/javascript" src="{{script | safe}}"></script>
+{% endfor %}
+</body>
 </html>

server/app/web/webapp.py

@@ -8,7 +8,8 @@ bp = Blueprint("webapp", __name__, template_folder="templates")
 @bp.route("/")
 def index():
     dataset_title = current_app.config["DATASET_TITLE"]
-    return render_template("index.html", datasetTitle=dataset_title)
+    scripts = current_app.config["SCRIPTS"]
+    return render_template("index.html", datasetTitle=dataset_title, SCRIPTS=scripts)
 
 
 @bp.route("/favicon.png")

server/cli/launch.py

@@ -66,20 +66,28 @@ from server.app.util.utils import custom_format_warning
     show_default=True,
     help="Relative expression cutoff used when selecting top N differentially expressed genes",
 )
+@click.option(
+    "--scripts",
+    default=[],
+    multiple=True,
+    help="Additional script files to include in html page",
+    show_default=True,
+)
 def launch(
-    data,
+        data,
-    layout,
+        layout,
-    diffexp,
+        diffexp,
-    title,
+        title,
-    verbose,
+        verbose,
-    debug,
+        debug,
-    obs_names,
+        obs_names,
-    var_names,
+        var_names,
-    open_browser,
+        open_browser,
-    port,
+        port,
-    host,
+        host,
-    max_category_items,
+        max_category_items,
-    diffexp_lfc_cutoff,
+        diffexp_lfc_cutoff,
+        scripts,
 ):
     """Launch the cellxgene data viewer.
     This web app lets you explore single-cell expression data.
@@ -106,6 +114,19 @@ def launch(
     else:
         warnings.formatwarning = custom_format_warning
 
+    if scripts:
+        click.echo(r"""
+/ / /\ \ \__ _ _ __ _ __ (_)_ __   __ _
+\ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+ \  /\  / (_| | |  | | | | | | | | (_| |
+  \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+                                  |___/
+The --scripts flag is intended for developers to include google analytics etc. You could be opening yourself to a
+security risk by including the --scripts flag. Make sure you trust the scripts that you are including.
+        """)
+        scripts_pretty = ", ".join(scripts)
+        click.confirm(f"Are you sure you want to inject these scripts: {scripts_pretty}?", abort=True)
+
     if not verbose:
         sys.tracebacklimit = 0
 
@@ -121,6 +142,7 @@ def launch(
 
     app = server.create_app()
     app.config.update(DATASET_TITLE=title)
+    app.config.update(SCRIPTS=scripts)
 
     if not verbose:
         log = logging.getLogger("werkzeug")