feat(cohort): let callers suppress inlined assets; test the vendor path

Add an `include_assets` flag to render_html_form() (default True). When a
page renders more than one cohort form, or already loads Tom Select
itself, callers can pass include_assets=False on the later forms so the
~50KB library isn't inlined more than once; the form markup and the
initializer are still emitted and bind to the page-level Tom Select.

Add tests covering the vendored-asset path: one asserts the library is
inlined and the event selects are tagged (guarding against the assets
being dropped from the wheel or the template variables drifting), and one
asserts include_assets=False suppresses the library while keeping the
form and initializer.

Also correct an over-claim: inlining removes third-party runtime calls
(the production-readiness requirement) but does not by itself satisfy a
strict self-only CSP, which still blocks inline tags without a nonce.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lukemerrett

bitmapist/cohort/__init__.py

@@ -82,10 +82,11 @@
 # --- HTML rendering
 
 # Tom Select is vendored (not loaded from a CDN) so the cohort form makes no
-# third-party network calls at runtime and works in offline / CSP-restricted
-# deployments. The assets are inlined into the fragment because the library has
-# no static-serving mechanism of its own -- consumers just embed the string
-# returned by render_html_form().
+# third-party network calls at runtime and works offline. The assets are inlined
+# into the fragment because the library has no static-serving mechanism of its
+# own -- consumers just embed the string returned by render_html_form(). Note
+# that inline tags still require the host's CSP to permit inline script/style
+# (or that callers pass include_assets=False and load Tom Select themselves).
 _TOM_SELECT_CSS = "tmpl/vendor/tom-select-2.3.1.default.min.css"
 _TOM_SELECT_JS = "tmpl/vendor/tom-select-2.3.1.complete.min.js"
 
@@ -115,6 +116,7 @@ def render_html_form(
     num_results: int = 31,
     num_of_rows: int = 12,
     start_date: Optional[str] = None,
+    include_assets: bool = True,
 ):
     """
     Render a HTML form that can be used to query the data in bitmapist.
@@ -129,6 +131,11 @@ def render_html_form(
     :param :select1b What is the current selected filter (extra, optional)
     :param :select2 What is the current selected filter (second)
     :param :select2b What is the current selected filter (extra, optional)
+    :param :include_assets Whether to inline the vendored Tom Select CSS/JS into
+        the fragment. Defaults to `True`. Set to `False` when rendering more than
+        one form on a page, or when the host page already loads Tom Select, to
+        avoid shipping the library more than once. The searchable dropdowns still
+        initialize as long as Tom Select is available on the page.
 
     """
     # mandatory
@@ -159,8 +166,11 @@ def render_html_form(
             num_results=int(num_results),
             num_of_rows=int(num_of_rows),
             start_date=start_date,
-            tom_select_css=_read_vendor_asset(_TOM_SELECT_CSS),
-            tom_select_js=_read_vendor_asset(_TOM_SELECT_JS),
+            include_assets=include_assets,
+            tom_select_css=_read_vendor_asset(_TOM_SELECT_CSS)
+            if include_assets
+            else "",
+            tom_select_js=_read_vendor_asset(_TOM_SELECT_JS) if include_assets else "",
         )
     )
 

bitmapist/cohort/tmpl/form_data.mako

@@ -1,9 +1,17 @@
 <%doc>
     Tom Select 2.3.1 is vendored and inlined (see bitmapist/cohort/tmpl/vendor/)
     rather than loaded from a CDN, so the cohort form makes no third-party
-    network calls at runtime and works in offline / CSP-restricted deployments.
+    network calls at runtime and works offline.
+
+    Emitting the library is gated on `include_assets` so a caller that renders
+    more than one cohort form on a page (or already loads Tom Select itself)
+    can suppress the duplicated CSS/JS by passing include_assets=False on the
+    later forms. The small initializer below is always emitted and no-ops if
+    the library isn't present.
 </%doc>
+%if include_assets:
 <style>${ tom_select_css | n }</style>
+%endif
 
 <style>
 .cohort_form dd {
@@ -102,7 +110,9 @@
     The library is inlined here, after the form markup, so the browser can
     render the form before parsing/executing ~50KB of JS.
 </%doc>
+%if include_assets:
 <script>${ tom_select_js | n }</script>
+%endif
 
 <script>
     // Turn the event dropdowns into searchable selects. With hundreds of

test/test_cohort.py

@@ -3,7 +3,7 @@
 import pytest
 
 from bitmapist import mark_event
-from bitmapist.cohort import _weeks_events_fn, get_dates_data
+from bitmapist.cohort import _weeks_events_fn, get_dates_data, render_html_form
 
 
 @pytest.fixture
@@ -88,3 +88,34 @@ def test_weeks_events_fn_iso_year_boundary():
 
     # Both dates should produce the same week event
     assert event.redis_key == event2.redis_key
+
+
+def test_render_html_form_inlines_vendored_assets():
+    """The vendored Tom Select library ships in the package and is inlined.
+
+    Guards against a silent packaging/integration regression: if the vendored
+    assets are dropped from the wheel, the on-disk path resolution breaks, or
+    the template variables stop lining up, this fails instead of the public
+    API raising at call time.
+    """
+    html = render_html_form(action_url="/", selections1=[("Active", "active")])
+    assert "Tom Select v2.3.1" in html  # vendored library JS inlined
+    assert "cohort-event-select" in html  # event selects tagged for enhancement
+    assert "new TomSelect" in html  # initializer present
+
+
+def test_render_html_form_can_suppress_assets():
+    """include_assets=False omits the bundled library so it isn't shipped twice.
+
+    Lets a caller rendering more than one cohort form on a page (or a host that
+    already loads Tom Select) avoid duplicating the library, while the form and
+    its initializer are still emitted.
+    """
+    html = render_html_form(
+        action_url="/",
+        selections1=[("Active", "active")],
+        include_assets=False,
+    )
+    assert "Tom Select v2.3.1" not in html  # library not re-emitted
+    assert "cohort-event-select" in html  # form still rendered
+    assert "new TomSelect" in html  # initializer still present (uses page-level lib)