docs(cdn): add sri hashes

docs/acetate.config.js

@@ -5,7 +5,47 @@ const _ = require("lodash");
 
 const IS_DEV = process.env.ENV !== "prod";
 
+const pkgVersion = process.env.npm_package_version;
+const request = require("request");
+const sriToolbox = require("sri-toolbox");
+
+const packages = [
+  "auth",
+  "common",
+  "feature-service",
+  "feature-service-admin",
+  "geocoder",
+  "groups",
+  "items",
+  "request",
+  "routing",
+  "sharing",
+  "users"
+];
+
+const sriHashes = {};
+
+generateSriHashes = () => {
+  packages.forEach(pkg => {
+    const url = `http://unpkg.com/@esri/arcgis-rest-${pkg}@${pkgVersion}/dist/umd/${pkg}.umd.min.js`;
+    request(url, (err, res, body) => {
+      if (err) {
+        sriHashes[pkg] = "SRI_HASH_FAILED";
+      } else {
+        sriHashes[pkg] = sriToolbox.generate({
+          algorithms: ["sha384"]
+        }, body);
+      }
+    });
+  });
+};
+
 module.exports = function(acetate) {
+  /**
+   * Generate SRI hashes for dist minified js files.
+   */
+  generateSriHashes();
+
   /**
    * Load all .html and markdown pages in the `src` folder, assigning them a
    * default layout.
@@ -212,6 +252,35 @@ module.exports = function(acetate) {
     }@${package.version}/dist/umd/${package.name.replace("@esri/arcgis-rest-", "")}.umd.min.js"></script>`;
   });
 
+  acetate.helper("scriptTagSRI", function(context, package) {
+   const hash = sriHashes[package.name.replace("@esri/arcgis-rest-", "")] || null;
+   if (hash) {
+     // if file request failed on doc deploy return basic script tag
+     if (hash === "SRI_HASH_FAILED") {
+       return `<script src="https://unpkg.com/${
+         package.name
+       }@${
+         package.version
+       }/dist/umd/${
+         package.name.replace("@esri/arcgis-rest-", "")
+       }.umd.min.js"></script>`;
+     } else {
+       return `<script src="https://unpkg.com/${
+         package.name
+       }@${
+         package.version
+       }/dist/umd/${
+         package.name.replace("@esri/arcgis-rest-", "")
+       }.umd.min.js" integrity="${
+         hash
+       }" crossorigin="anonymous"></script>`;
+     }
+   } else {
+     // common-types has no browser
+     return `This is a development package. Not avaiable via CDN.`;
+   }
+ });
+
   acetate.helper("npmInstallCmd", function(context, package) {
     const peers = package.peerDependencies
       ? Object.keys(package.peerDependencies).map(

docs/src/api/_package.html

@@ -5,6 +5,8 @@ <h2 class="font-size--1 trailer-half">npm install:</h2>
 <pre><code>{% npmInstallCmd pkg %}</code></pre>
 <h2 class="font-size--1 trailer-half">CDN:</h2>
 <pre><code>{% scriptTag pkg %}</code></pre>
+<h2 class="font-size--1 trailer-half">SRI:</h2>
+<pre><code>{% scriptTagSRI pkg %}</code></pre>
 <hr class="leader-half trailer-half">
 <ul class="list-plain package-contents">
 {% for declaration in declarations %}

package.json

@@ -53,6 +53,7 @@
     "rollup-plugin-uglify": "^3.0.0",
     "shelljs": "^0.7.8",
     "slug": "^0.9.1",
+    "sri-toolbox": "0.2.0",
     "ts-node": "^3.3.0",
     "tslint": "^5.11.0",
     "tslint-config-prettier": "^1.6.0",