Issue 1242 url preview

app/common/gristUrls.ts

@@ -107,6 +107,7 @@ export const commonUrls = {
   formulaSheet: 'https://support.getgrist.com/formula-cheat-sheet',
   formulas: 'https://support.getgrist.com/formulas',
   forms: 'https://www.getgrist.com/forms/?utm_source=grist-forms&utm_medium=grist-forms&utm_campaign=forms-footer',
+  openGraphPreviewImage: 'https://grist-static.com/icons/opengraph-preview-image.png',
 
   gristLabsCustomWidgets: 'https://gristlabs.github.io/grist-widget/',
   gristLabsWidgetRepository: 'https://github.com/gristlabs/grist-widget/releases/download/latest/manifest.json',

app/server/lib/sendAppPage.ts

@@ -1,4 +1,5 @@
 import {
+  commonUrls,
   Features,
   getContactSupportUrl,
   getFreeCoachingCallUrl,
@@ -24,9 +25,22 @@ import * as fse from 'fs-extra';
 import * as handlebars from 'handlebars';
 import jsesc from 'jsesc';
 import * as path from 'path';
-import difference = require('lodash/difference');
+import difference from 'lodash/difference';
 
-const translate = (req: express.Request, key: string, args?: any) => req.t(`sendAppPage.${key}`, args);
+const { escapeExpression } = handlebars.Utils;
+
+/**
+ * Return the translation given the key, but also ensure that the return value is HTML-escaped
+ * in order to avoid possible script injection (that we don't need in any case).
+ *
+ * @param req
+ * @param key The key of the translation (which will be prefixed by `sendAppPage`)
+ * @param args The args to pass to the translation string (optional)
+ */
+function translateEscaped(req: express.Request, key: string, args?: any) {
+  const translation = req.t(`sendAppPage.${key}`, args)?.toString();
+  return translation ? escapeExpression(translation) : translation;
+}
 
 export interface ISendAppPageOptions {
   path: string;        // Ignored if .content is present (set to "" for clarity).
@@ -174,8 +188,8 @@ export function makeSendAppPage({ server, staticDir, tag, testLogin, baseDomain
     ).join('\n');
     const content = fileContent
       .replace("<!-- INSERT WARNING -->", warning)
-      .replace("<!-- INSERT TITLE -->", getPageTitle(req, config))
-      .replace("<!-- INSERT META -->", getPageMetadataHtmlSnippet(config))
+      .replace("<!-- INSERT TITLE -->", getDocName(config) ?? escapeExpression(translateEscaped(req, 'Loading')))
+      .replace("<!-- INSERT META -->", getPageMetadataHtmlSnippet(req, config))
       .replace("<!-- INSERT TITLE SUFFIX -->", getPageTitleSuffix(server.getGristConfig()))
       .replace("<!-- INSERT BASE -->", `<base href="${staticBaseUrl}">` + tagManagerSnippet)
       .replace("<!-- INSERT LOCALE -->", preloads)
@@ -264,18 +278,15 @@ function configuredPageTitleSuffix() {
 }
 
 /**
- * Returns a page title suitable for inserting into an HTML title element.
- *
- * Currently returns the document name if the page being requested is for a document, or
- * a placeholder, "Loading...", that's updated in the client once the page has loaded.
+ * Returns the doc name.
  *
  * Note: The string returned is escaped and safe to insert into HTML.
+ *
  */
-function getPageTitle(req: express.Request, config: GristLoadConfig): string {
+function getDocName(config: GristLoadConfig): string|null {
   const maybeDoc = getDocFromConfig(config);
-  if (!maybeDoc) { return translate(req, 'Loading') + "..."; }
 
-  return handlebars.Utils.escapeExpression(maybeDoc.name);
+  return maybeDoc && escapeExpression(maybeDoc.name);
 }
 
 /**
@@ -286,25 +297,30 @@ function getPageTitle(req: express.Request, config: GristLoadConfig): string {
  *
  * Note: The string returned is escaped and safe to insert into HTML.
  */
-function getPageMetadataHtmlSnippet(config: GristLoadConfig): string {
+function getPageMetadataHtmlSnippet(req: express.Request, config: GristLoadConfig): string {
   const metadataElements: string[] = [];
   const maybeDoc = getDocFromConfig(config);
 
-  const description = maybeDoc?.options?.description;
-  if (description) {
-    const content = handlebars.Utils.escapeExpression(description);
-    metadataElements.push(`<meta name="description" content="${content}">`);
-    metadataElements.push(`<meta property="og:description" content="${content}">`);
-    metadataElements.push(`<meta name="twitter:description" content="${content}">`);
-  }
+  metadataElements.push('<meta property="og:type" content="website">');
+  metadataElements.push('<meta name="twitter:card" content="summary_large_image">');
 
-  const icon = maybeDoc?.options?.icon;
-  if (icon) {
-    const content = handlebars.Utils.escapeExpression(icon);
-    metadataElements.push(`<meta name="thumbnail" content="${content}">`);
-    metadataElements.push(`<meta property="og:image" content="${content}">`);
-    metadataElements.push(`<meta name="twitter:image" content="${content}">`);
-  }
+  const description = maybeDoc?.options?.description ?
+    escapeExpression(maybeDoc.options.description) :
+    translateEscaped(req, 'og-description');
+  metadataElements.push(`<meta name="description" content="${description}">`);
+  metadataElements.push(`<meta property="og:description" content="${description}">`);
+  metadataElements.push(`<meta name="twitter:description" content="${description}">`);
+
+  const image = escapeExpression(maybeDoc?.options?.icon ?? commonUrls.openGraphPreviewImage);
+  metadataElements.push(`<meta name="thumbnail" content="${image}">`);
+  metadataElements.push(`<meta property="og:image" content="${image}">`);
+  metadataElements.push(`<meta name="twitter:image" content="${image}">`);
+
+  const maybeDocTitle = getDocName(config);
+  const title = maybeDocTitle ? maybeDocTitle + getPageTitleSuffix(config) : translateEscaped(req, 'og-title');
+  // NB: We don't generate the content of the <title> tag here.
+  metadataElements.push(`<meta property="og:title" content="${title}">`);
+  metadataElements.push(`<meta name="twitter:title" content="${title}">`);
 
   return metadataElements.join('\n');
 }

static/locales/en.server.json

@@ -1,6 +1,8 @@
 {
   "sendAppPage": {
-    "Loading": "Loading"
+    "Loading": "Loading...",
+    "og-description": "A modern, open source spreadsheet that goes beyond the grid",
+    "og-title": "Grist, the evolution of spreadsheets"
   },
   "oidc": {
     "emailNotVerifiedError": "Please verify your email with the identity provider, and log in again."

static/locales/fr.server.json

@@ -1,5 +1,5 @@
 {
   "sendAppPage": {
-    "Loading": "Chargement"
+    "Loading": "Chargement..."
   }
 }

test/nbrowser/HomeIntro.ts

@@ -29,6 +29,7 @@ describe('HomeIntro', function() {
     });
 
     it('should should intro screen for anon', () => testIntroScreen({anon: true, team: false}));
+    it('should should set meta tags for URL previews', testMetaTags);
     it('should not show Other Sites section', testOtherSitesSection);
     it('should allow create/import from intro screen', testCreateImport.bind(null, false));
     it('should link to examples page from the intro', testExamplesPage);
@@ -129,6 +130,22 @@ describe('HomeIntro', function() {
     }
   }
 
+  async function testMetaTags() {
+    const expectedTitle = 'Grist, the evolution of spreadsheets';
+    assert.equal(await driver.find('meta[name="twitter:title"]').getAttribute('content'), expectedTitle);
+    assert.equal(await driver.find('meta[property="og:title"]').getAttribute('content'), expectedTitle);
+
+    const expectedDescription = 'A modern, open source spreadsheet that goes beyond the grid';
+    assert.equal(await driver.find('meta[name="description"]').getAttribute('content'), expectedDescription);
+    assert.equal(await driver.find('meta[name="twitter:description"]').getAttribute('content'), expectedDescription);
+    assert.equal(await driver.find('meta[property="og:description"]').getAttribute('content'), expectedDescription);
+
+    const gristIconFileName = 'opengraph-preview-image.png';
+    assert.include(await driver.find('meta[name="thumbnail"]').getAttribute('content'), gristIconFileName);
+    assert.include(await driver.find('meta[name="twitter:image"]').getAttribute('content'), gristIconFileName);
+    assert.include(await driver.find('meta[property="og:image"]').getAttribute('content'), gristIconFileName);
+  }
+
   async function testCreateImport(isLoggedIn: boolean) {
     await checkIntroButtons(isLoggedIn);
 

test/nbrowser/NewDocument.ntest.js

@@ -18,7 +18,22 @@ describe('NewDocument.ntest', function() {
     this.timeout(10000);
     await gu.actions.createNewDoc('Untitled');
     assert.equal(await gu.actions.getDocTitle(), 'Untitled');
-    assert.equal(await driver.getTitle(), 'Untitled - Grist');
+
+    const expectedTitle = 'Untitled - Grist';
+    assert.equal(await driver.getTitle(), expectedTitle);
+    assert.equal(await driver.find('meta[name="twitter:title"]').getAttribute('content'), expectedTitle);
+    assert.equal(await driver.find('meta[property="og:title"]').getAttribute('content'), expectedTitle);
+
+    const expectedDescription = 'A modern, open source spreadsheet that goes beyond the grid';
+    assert.equal(await driver.find('meta[name="description"]').getAttribute('content'), expectedDescription);
+    assert.equal(await driver.find('meta[name="twitter:description"]').getAttribute('content'), expectedDescription);
+    assert.equal(await driver.find('meta[property="og:description"]').getAttribute('content'), expectedDescription);
+
+    const gristIconFileName = 'opengraph-preview-image.png';
+    assert.include(await driver.find('meta[name="thumbnail"]').getAttribute('content'), gristIconFileName);
+    assert.include(await driver.find('meta[name="twitter:image"]').getAttribute('content'), gristIconFileName);
+    assert.include(await driver.find('meta[property="og:image"]').getAttribute('content'), gristIconFileName);
+
     assert.equal(await $('.active_section .test-viewsection-title').wait().text(), 'TABLE1');
     await gu.waitForServer();
   });