which tells the browser to exclude the page from the FLoC calculation.

  For more information regarding FLoC, please visit <https://web.dev/floc>.

Unused dependencies.

Here and below source code format was fixed.

Cache dependencies to speed up workflow run

Add latest Elixir and OTP releases into the matrix

rebar and hex are updated in erlef/setup-elixir action itself, no need to do that again.

Running tests only on master branch does not seem right.

It is hard to read this matrix without line breaks.

Several small updates of CI workflow. Changes are described below.

The connect_params opt wasn't passed through to where it was needed, but put_connect_params/2 works and the API is clear.

Closes #1414.

G'day!

Environment

• Elixir version: Elixir 1.11.4 (compiled with Erlang/OTP 23)
• Phoenix version: 1.5.8
• Phoenix LiveView version: 0.15.4
• NodeJS version: v14.16.0
• NPM version: 6.14.11
• Operating system: macOS
• Browsers you attempted to reproduce this bug on (the more the merrier): mix test
• Does the problem persist after removing "assets/node_modules" and trying again? yes

Actual behavior

Given this test code:

assert {:ok, %View{module: MainView}, <<_::binary>>} =
         live_isolated(conn, MainView, session: %{}, connect_params: %{"param" => value})

When MainView.mount/3 is called with a connected socket, get_connect_params(socket) doesn't return the connect_params from the opts argument to live_isolated/3.

Investigating,LiveView.Static.render/3 returns an {:ok, content, socket_assigns} and the case clause doesn't use the opts argument. If I'm reading it right, the only use of opts is after it's re-bound in the match of the second clause?

# lib/phoenix_live_view/test/live_view_test.ex:220

  defmacro live_isolated(conn, live_view, opts \\ []) do
    quote bind_quoted: binding(), unquote: true do
      unquote(__MODULE__).__isolated__(conn, @endpoint, live_view, opts)
    end
  end

  @doc false
  def __isolated__(conn, endpoint, live_view, opts) do
    put_in(conn.private[:phoenix_endpoint], endpoint || raise("no @endpoint set in test case"))
    |> Plug.Test.init_test_session(%{})
    |> Phoenix.LiveView.Router.fetch_live_flash([])
    |> Phoenix.LiveView.Controller.live_render(live_view, opts)
    |> connect_from_static_token(nil)
  end

# lib/phoenix_live_view/controller.ex:34

  def live_render(%Plug.Conn{} = conn, view, opts \\ []) do
    case LiveView.Static.render(conn, view, opts) do
      {:ok, content, socket_assigns} ->
        conn
        |> Phoenix.Controller.put_view(LiveView.Static)
        |> LiveView.Plug.put_cache_headers()
        |> Phoenix.Controller.render(
          "template.html",
          Map.merge(socket_assigns, %{content: content, live_module: view})
        )

      {:stop, %Socket{redirected: {:redirect, opts}} = socket} ->
        conn
        |> put_flash(LiveView.Utils.get_flash(socket))
        |> Phoenix.Controller.redirect(Map.to_list(opts))

      {:stop, %Socket{redirected: {:live, _, %{to: to}}} = socket} ->
        conn
        |> put_flash(LiveView.Utils.get_flash(socket))
        |> Plug.Conn.put_private(:phoenix_live_redirect, true)
        |> Phoenix.Controller.redirect(to: to)
    end
  end

Workaround

Use Phoenix.LiveViewTest.put_connect_params/2, instead:

assert {:ok, %View{module: MainView}, <<_::binary>>} =
          conn
          |> put_connect_params(%{"param" => value})
          |> live_isolated(conn, MainView, session: %{})

Expected behavior

connect_params works as documented, if I'm reading it right, or is no longer documented.

Thanks @garthk! <3

The connect_params opt wasn't passed through to where it was needed, but put_connect_params/2 works and the API is clear.

Closes #1414.

would you like to work on a PR for Controller.put_permissions_policy/2?

I'd gladly do so. I'd start a new PR and close this one. Thanks for the suggestions!

To be clear, in retrospect I don't think my commit is the way to go, either. It was a "quick change" but I'd rather we were more explicit about the behaviour.

@Awlexus would you like to work on a PR for Controller.put_permissions_policy/2?

Then we can add it to the router template in the installer just above :put_secure_browser_headers. In the future if someone doesn't want it they can just remove it from the pipeline, but adding it will be just as easy for existing installs :)

Thanks @mcrumm, that's the feedback I was hoping for.

the more I read about Permissions-Policy the more it seemed like something that should be a Plug in its own right, something like put_permissions_policy/2

I honestly had only thought of disabling FLoC, but adding proper support for this header would be preferable and I like the approach you mentioned :heart:

Glad too see that there are more people pushing for sane privacy defaults! Should I close this PR in favour your idea?

Forgot to add this in #4268

Thanks!

Hi @Awlexus and thanks for the PR! I am 💯 on this, so much so that I began a similar effort last night (151fdd0d) :)

I stopped short of opening a PR because the more I read about Permissions-Policy the more it seemed like something that should be a Plug in its own right, something like put_permissions_policy/2:

    plug :put_permissions_policy, %{
      "geolocation" => ~w(self "https://foo.com"),
      "camera" => [],
      "fullscreen" => "*"
    }

Then we could default to [{"interest-cohort", []}] and build overrides similarly to put_secure_browser_headers/2. Wdyt?

// @phoenixframework/phoenix-core

Forgot to add this in #4268

As the title says, this pull request tries to disable FLoC on Google Chrome by default when creating a new project. I didn't add any tests yet, because I was ensure whether defining the function to disable this feature would fit into the Phoenix.Endpoint module and would appreciate further feedback. Thanks in advance!

It was added in fall. (Note this is for custom emojo, not regular OS emoji.)

:green_heart: :blue_heart: :purple_heart: :yellow_heart: :heart: