header style tweaks, deemphasizing it a bit

the new way to do the links without adding links to images is probably
dumb and/or missing some stuff, but it works and does what I want, and I
think I like the old look of the colors better, so time to try it and
see if it sticks still

CONTRIBUTING.md

@@ -0,0 +1,76 @@
+# How to Contribute
+
+incorporeal-cms is a personal project seeking to implement a simpler, cleaner form of what would
+commonly be called a "CMS". I appreciate any help in making it better.
+
+incorporeal-cms is made available under the GNU Affero General Public License version 3, or any
+later version.
+
+## Opening Issues
+
+Issues should be posted to my Gitea instance at
+<https://git.incorporeal.org/bss/incorporeal-cms/issues>. I'm not too picky about format, but I
+recommend starting the title with "Improvement:", "Bug:", or similar, so I can do a high level of
+prioritization.
+
+## Contributions
+
+I don't expect contributors to sign up for my personal Gitea in order to send contributions, but it
+of course makes it easier. If you wish to go this route, please sign up at
+<https://git.incorporeal.org/bss/incorporeal-cms> and fork the project. People planning on
+contributing often are also welcome to request access to the project directly.
+
+Otherwise, contact me via any means you know to reach me at, or <bss@incorporeal.org>, to discuss
+your change and to tell me how to pull your changes.
+
+### Guidelines for Patches, etc.
+
+* Cloning
+    * Clone the project. I would advise using a pull-based workflow where I have access to the hosted
+      repository --- using my Gitea, cloning to a public GitHub, etc. --- rather than doing this over
+      email, but that works too if we must.
+    * Make your contributions in a new branch, generally off of `master`.
+    * Send me a pull request when you're ready, and we'll go through a code review.
+* Code:
+    * Keep in mind that I strive for simplicity in the software. It serves files and renders
+      Markdown, that's pretty much it. Features around that function are good; otherwise, I need
+      convincing.
+    * Follow the style precedent set in the code. Do **not** use Black, or otherwise reformat existing
+      code. I like it the way it is and don't need a militant tool making bad decisions about what is
+      readable.
+    * `tox` should run cleanly, of course.
+    * Almost any change should include unit tests, and also functional tests if they provide a feature
+      to the CMS functionality. For defects, include unit tests that fail on the unfixed codebase, so I
+      know exactly what's happening.
+* Commits:
+    * Squash tiny commits if you'd like. I prefer commits that make one atomic conceptual change
+      that doesn't affect the rest of the code, assembling multiple of those commits into larger
+      changes.
+    * Follow something like [Chris Beams's post](https://chris.beams.io/posts/git-commit/) on
+      formatting a good commit message.
+    * Please make sure your Author contact information is stable, in case I need to reach you.
+    * Consider cryptographically signing (`git commit -S`) your commits.
+
+### Custody of Contributions
+
+I do not request the copyright of contributions be assigned to me or to the project, and I require no
+provision that I be allowed to relicense your contributions. My personal oath is to maintain
+inbound=outbound in my open source projects, and the expectation is authors are responsible for their
+contributions.
+
+I am following the *spirit* of the [Developer Certificate of Origin](https://developercertificate.org/),
+but in a simplified fashion:
+
+By making a contribution to this project, you certify that:
+
+1. The contribution was created by you and you have the right to submit it under the open source license
+   indicated in the LICENSE file; or
+2. The contribution is based upon previous work that is covered under an appropriate open source license
+   compatible with the license indicated in the LICENSE file, and you have the right to contribute that
+   work with or without modifications, under the terms of that same open source license; or
+3. The contribution was provided directly to you by some other person who certified points 1, 2, or 3, and
+   you have not modified it.
+
+In the event of point 3, your commit **must** include the Signed-off-by line(s) as a chain of custody,
+via `git commit -s`. For points 1 and 2, your commit with accurate Author information doubles as direct
+custody.

README.md

@@ -1,3 +1,66 @@
 # incorporeal-cms
 
-Software that makes incorporeal.org go.
+Software that makes simple Markdown content go.
+
+## Installation and Usage
+
+I recommend getting a release from <https://git.incorporeal.org/bss/incorporeal-cms/releases> and
+installing the Python package in a virtualenv. Something like the following should suffice:
+
+```
+% cd ~/site
+% virtualenv --python=python3.8 env-py3.8
+% source env-py3.8/bin/activate
+% pip install -U pip
+% pip install ~/incorporeal_cms-1.3.0-py3-none-any.whl
+% pip install -U gunicorn
+% gunicorn -w 5 -t 60 -b 127.0.0.1:10000 --reload 'incorporealcms:create_app()'
+```
+
+This will get the CMS up and running, and listening on the specified port. The application is
+further configured within `env-py3.8/var/incorporealcms-instance/config.py`, and content is served
+out of `env-py3.8/var/incorporealcms-instance/pages/`.
+
+## Serving a Site
+
+Put content inside `env-py3.8/var/incorporealcms-instance/pages/` and go.
+
+* Markdown files (ending in `.md`) are rendered via Python-Markdown if they are accessed without the
+  suffix (i.e., `post.md` should be referred to as `/post` to get it to render as Markdown.
+* Directory paths (e.g. `/dir/`) can be rendered with a `/dir/index.md` file.
+* Symlinks to files are treated as redirects to the destination content.
+* Request paths with file suffixes are not rendered and served directly, so images, etc., can be
+  referenced naturally, and even the unrendered Markdown can be served as a text file via e.g.
+  `/post.md`.
+
+Care is taken to not serve content above the `pages/` dir, even via symlink.
+
+## Configuration
+
+I've tried to keep the software agnostic to my personal domains, logos, etc. There are some settings
+you are probably interested in tweaking, by specifying new values in
+`incorporealcms-instance/config.py`:
+
+* `TITLE_SUFFIX` is appended to the title of every page, separated from other title content by a
+  dash.
+* `CONTACT_EMAIL` is referred to in error templates.
+* `FAVICON` supplies the image used in browser tabs and that kind of thing.
+
+If I missed anything, please let me know.
+
+## Author and Licensing
+
+Written by and copyright Brian S. Stephan (bss@incorporeal.org).
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published
+by the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.

incorporealcms/config.py

@@ -32,10 +32,9 @@ class Config(object):
         },
     }
 
-    MARKDOWN_EXTENSIONS = ['extra', 'mdx_linkify', 'sane_lists', 'smarty', 'tables']
+    MARKDOWN_EXTENSIONS = ['extra', 'incorporealcms.mdx.figures', 'sane_lists', 'smarty', 'toc']
     MARKDOWN_EXTENSION_CONFIGS = {
         'extra': {
-            'attr_list': {},
             'footnotes': {
                 'UNIQUE_IDS': True,
             },
@@ -52,7 +51,7 @@ class Config(object):
 
     # customizations
     DEFAULT_PAGE_STYLE = 'light'
-    TITLE_SUFFIX = 'incorporeal.org'
+    TITLE_SUFFIX = 'example.com'
-    CONTACT_EMAIL = 'bss@incorporeal.org'
+    CONTACT_EMAIL = 'admin@example.com'
 
-    # specify FAVICON in your instance config.py to override the suou icon
+    # specify FAVICON in your instance config.py to override the provided icon

incorporealcms/mdx/__init__.py

@@ -0,0 +1 @@
+"""Markdown extensions."""

incorporealcms/mdx/figures.py

@@ -0,0 +1,60 @@
+"""Create generic figures with captions."""
+import re
+from xml.etree.ElementTree import SubElement
+
+import markdown
+
+
+class FigureExtension(markdown.Extension):
+    """Wrap the markdown prepcoressor."""
+
+    def extendMarkdown(self, md):
+        """Add FigureBlockProcessor to the Markdown instance."""
+        md.parser.blockprocessors.register(FigureBlockProcessor(md.parser), 'figure', 100)
+
+
+class FigureBlockProcessor(markdown.blockprocessors.BlockProcessor):
+    """Process figures."""
+
+    # |> thing to put in the figure
+    # |: optional caption for the figure
+    # optional whatever else, like maybe an attr_list
+    figure_regex = re.compile(r'^[ ]{0,3}\|>[ ]{0,3}(?P<content>[^\n]*)')
+    caption_regex = re.compile(r'^[ ]{0,3}\|:[ ]{0,3}(?P<caption>[^\n]*)')
+
+    def test(self, parent, block):
+        """Determine if we should process this block."""
+        lines = block.split('\n')
+        return bool(self.figure_regex.search(lines[0]))
+
+    def run(self, parent, blocks):
+        """Replace the top block with HTML."""
+        block = blocks.pop(0)
+        lines = block.split('\n')
+
+        # consume line and create a figure
+        figure_match = self.figure_regex.search(lines[0])
+        lines.pop(0)
+        content = figure_match.group('content')
+        figure = SubElement(parent, 'figure')
+        figure.text = content
+        if lines:
+            if caption_match := self.caption_regex.search(lines[0]):
+                # consume line and add the caption as a child of the figure
+                lines.pop(0)
+                caption = caption_match.group('caption')
+                figcaption = SubElement(figure, 'figcaption')
+                figcaption.text = caption
+        if lines:
+            # other lines are mysteries, might be attr_list, so re-append
+            # make sure there's a child to hang the rest (which is maybe an attr_list?) off of
+            # this is probably a bad hack
+            if not len(list(figure)):
+                SubElement(figure, 'span')
+            rest = '\n'.join(lines)
+            figure[-1].tail = f'\n{rest}'
+
+
+def makeExtension(*args, **kwargs):
+    """Provide the extension to the markdown extension loader."""
+    return FigureExtension(*args, **kwargs)

incorporealcms/mdx/pydot.py

@@ -0,0 +1,54 @@
+"""Serve dot diagrams inline."""
+import base64
+import logging
+import re
+
+import markdown
+import pydot
+
+logger = logging.getLogger(__name__)
+
+
+class InlinePydot(markdown.Extension):
+    """Wrap the markdown prepcoressor."""
+
+    def extendMarkdown(self, md):
+        """Add InlinePydotPreprocessor to the Markdown instance."""
+        md.preprocessors.register(InlinePydotPreprocessor(md), 'dot_block', 100)
+
+
+class InlinePydotPreprocessor(markdown.preprocessors.Preprocessor):
+    """Identify dot codeblocks and run them through pydot."""
+
+    BLOCK_RE = re.compile(r'~~~{\s+pydot:(?P<filename>[^\s]+)\s+}\n(?P<content>.*?)~~~', re.DOTALL)
+
+    def run(self, lines):
+        """Match and generate diagrams from dot code blocks."""
+        text = '\n'.join(lines)
+        out = text
+        for block_match in self.BLOCK_RE.finditer(text):
+            filename = block_match.group(1)
+            dot_string = block_match.group(2)
+            logger.debug("matched markdown block: %s", dot_string)
+            logger.debug("match start/end: %s/%s", block_match.start(), block_match.end())
+
+            # use pydot to turn the text into pydot
+            graphs = pydot.graph_from_dot_data(dot_string)
+            if not graphs:
+                logger.debug("some kind of issue with parsed 'dot' %s", dot_string)
+                raise ValueError("error parsing dot text!")
+
+            # encode the image and provide as an inline image in markdown
+            encoded_image = base64.b64encode(graphs[0].create_png()).decode('ascii')
+            data_path = f'data:image/png;base64,{encoded_image}'
+            inline_image = f'![{filename}]({data_path})'
+
+            # replace the image in the output markdown
+            out = out.replace(block_match.group(0), inline_image)
+
+        return out.split('\n')
+
+
+def makeExtension(*args, **kwargs):
+    """Provide the extension to the markdown extension loader."""
+    return InlinePydot(*args, **kwargs)

incorporealcms/pages.py

@@ -7,7 +7,6 @@ import re
 from flask import Blueprint, Markup, abort
 from flask import current_app as app
 from flask import redirect, request, send_from_directory
-from tzlocal import get_localzone
 
 from incorporealcms.lib import get_meta_str, init_md, render
 
@@ -27,7 +26,7 @@ def display_page(path):
     except PermissionError:
         abort(400)
     except IsADirectoryError:
-        return redirect(f'{path}/', code=301)
+        return redirect(f'/{path}/', code=301)
     except FileNotFoundError:
         abort(404)
 
@@ -39,33 +38,57 @@ def display_page(path):
         logger.debug("redirect path: '%s'", redirect_path)
         return redirect(redirect_path, code=301)
     elif render_type == 'markdown':
-        try:
+        logger.debug("treating path '%s' as markdown '%s'", path, resolved_path)
-            with app.open_instance_resource(resolved_path, 'r') as entry_file:
+        return handle_markdown_file_path(resolved_path)
-                mtime = datetime.datetime.fromtimestamp(os.path.getmtime(entry_file.name), get_localzone())
-                entry = entry_file.read()
-        except OSError:
-            logger.exception("resolved path '%s' could not be opened!", resolved_path)
-            abort(500)
-        else:
-            md = init_md()
-            content = Markup(md.convert(entry))
-            logger.debug("file metadata: %s", md.Meta)
-
-            parent_navs = generate_parent_navs(resolved_path)
-
-            page_name = (get_meta_str(md, 'title') if md.Meta.get('title') else
-                         f'/{instance_resource_path_to_request_path(resolved_path)}')
-            page_title = f'{page_name} - {app.config["TITLE_SUFFIX"]}' if page_name else app.config['TITLE_SUFFIX']
-            logger.debug("title (potentially derived): %s", page_title)
-
-            return render('base.html', title=page_title, description=get_meta_str(md, 'description'),
-                          image=get_meta_str(md, 'image'), base_url=request.base_url, content=content,
-                          navs=parent_navs, mtime=mtime.strftime('%Y-%m-%d %H:%M:%S %Z'))
     else:
         logger.exception("unsupported render_type '%s'!?", render_type)
         abort(500)
 
 
+def handle_markdown_file_path(resolved_path):
+    """Given a location on disk, attempt to open it and render the markdown within."""
+    try:
+        logger.debug("opening resolved path '%s'", resolved_path)
+        with app.open_instance_resource(resolved_path, 'r') as entry_file:
+            mtime = datetime.datetime.fromtimestamp(os.path.getmtime(entry_file.name), tz=datetime.timezone.utc)
+            entry = entry_file.read()
+        logger.debug("resolved path '%s' read", resolved_path)
+    except OSError:
+        logger.exception("resolved path '%s' could not be opened!", resolved_path)
+        abort(500)
+    else:
+        try:
+            md = init_md()
+            content = Markup(md.convert(entry))
+        except ValueError:
+            logger.exception("error parsing/rendering markdown!")
+            abort(500)
+        except TypeError:
+            logger.exception("error loading/rendering markdown!")
+            abort(500)
+
+        logger.debug("file metadata: %s", md.Meta)
+
+        parent_navs = generate_parent_navs(resolved_path)
+
+        page_name = (get_meta_str(md, 'title') if md.Meta.get('title') else
+                     f'/{instance_resource_path_to_request_path(resolved_path)}')
+        page_title = f'{page_name} - {app.config["TITLE_SUFFIX"]}' if page_name else app.config['TITLE_SUFFIX']
+        logger.debug("title (potentially derived): %s", page_title)
+
+        template = get_meta_str(md, 'template') if md.Meta.get('template') else 'base.html'
+
+        # check if this has a HTTP redirect
+        redirect_url = get_meta_str(md, 'redirect') if md.Meta.get('redirect') else None
+        if redirect_url:
+            logger.debug("redirecting via meta tag to '%s'", redirect_url)
+            return redirect(redirect_url, code=301)
+
+        return render(template, title=page_title, description=get_meta_str(md, 'description'),
+                      image=get_meta_str(md, 'image'), base_url=request.base_url, content=content,
+                      navs=parent_navs, mtime=mtime.strftime('%Y-%m-%d %H:%M:%S %Z'))
+
+
 def request_path_to_instance_resource_path(path):
     """Turn a request URL path to the full page path.
 

incorporealcms/static/css/base.css

@@ -11,54 +11,22 @@ body {
     -webkit-text-size-adjust: 100%;
 }
 
+.site-wrap-normal-width {
+    max-width: 65pc;
+}
+
+.site-wrap-double-width {
+    max-width: 130pc;
+}
+
 .site-wrap {
-    max-width: 70pc;
     min-height: 100vh;
     margin: 0;
     margin-left: auto;
     margin-right: auto;
 }
 
-h1 {
+a {
-    font-size: 2em;
-}
-
-h2 {
-    font-size: 1.5em;
-}
-
-h3 {
-    font-size: 1.25em;
-}
-
-h4 {
-    font-size: 1.17em;
-}
-
-h5 {
-    font-size: 1em;
-}
-
-h6 {
-    font-size: .83em;
-}
-
-a:link {
-    font-weight: bold;
-    text-decoration: none;
-}
-
-a:visited {
-    font-weight: bold;
-    text-decoration: none;
-}
-
-a:hover {
-    font-weight: bold;
-    text-decoration: none;
-}
-
-a:active {
     font-weight: bold;
     text-decoration: none;
 }
@@ -66,8 +34,9 @@ a:active {
 div.header {
     display: flex;
     justify-content: space-between;
-    font-size: 0.75em;
+    font-size: 0.8em;
-    padding: 0.25em 0.5em;
+    padding: 1rem 1rem;
+    padding-bottom: 0;
 }
 
 div.header a {
@@ -76,9 +45,12 @@ div.header a {
 
 div.content {
     font-size: 11pt;
+    padding: 0 1rem;
+    line-height: 1.6em;
+}
 
-    padding: 0 1em;
+div.content p {
-    line-height: 1.5em;
+    margin: 1.25em 0;
 }
 
 sup, sub {
@@ -91,12 +63,13 @@ sub {
 }
 
 footer {
+    clear: both;
     display: block;
     font-size: 75%;
     color: #999;
     padding: 0 1em;
     padding-bottom: 16px;
-    margin-top: 15px;
+    margin-top: 30px;
 }
 
 table {
@@ -132,6 +105,10 @@ img {
     max-width: 50% !important;
 }
 
+.img-75 {
+    max-width: 75% !important;
+}
+
 .img-center {
     display: block;
     margin-left: auto;
@@ -148,39 +125,26 @@ img {
     margin-left: 1em;
 }
 
-.img-frame {
-    padding: 5px;
-}
-
-/* For screens with width smaller than 400px */
-.figure-left .figure-right {
-    max-width: 95%;
-    float: none;
-    margin-left: 10px;
-    margin-right: 10px;
-}
-
-/* For larger screens */
-@media only screen and (min-width: 400px) {
-    .figure-left {
-        float: left;
-        margin-top: 0;
-        margin-left: 0;
-    }
-
-    .figure-right {
-        float: right;
-        margin-top: 0;
-        margin-right: 0;
-    }
-}
-
 figure {
-    max-width: 400px;
     padding: 5px;
-    margin: 10px;
+    margin: 0;
-    margin-top: 0;
     margin-bottom: 5px;
+    text-align: center;
+    max-width: 30%;
+    min-width: 10em;
+    display: inline-block;
+}
+
+figure.right {
+    float: right;
+    margin-left: 10px;
+    display: block;
+}
+
+figure.left {
+    float: left;
+    margin-right: 10px;
+    display: block;
 }
 
 figure img {
@@ -189,19 +153,8 @@ figure img {
 }
 
 figcaption {
-    font-family: "Times New Roman", serif;
-    color: #777777;
     text-align: center;
-    font-style: italic;
+    font-size: 0.9em;
-    line-height: 1.3em;
-    margin-top: 5px;
-}
-
-.thumbnail-image {
-    width: 150px;
-    height: auto;
-    margin: 5px;
-    display: inline;
 }
 
 .footnote {

incorporealcms/static/css/dark.css

@@ -1,47 +1,38 @@
+/* common styling via the base.css, used in light and dark */
 @import '/static/css/base.css';
 
 html {
-    color: #CCC;
+    color: #DDD;
 }
 
 body {
-    background: black;
-}
-
-strong {
-    color: #EEE;
-}
-
-.site-wrap {
     background: #111;
-
-    border: 1px solid #222;
-    border-top: none;
-    border-bottom: none;
 }
 
 h1, h2, h3, h4, h5, h6 {
     color: #B31D15;
 }
 
-a:link, a:visited {
+p a, ul a, ol a {
-    color: #EEE;
+    color: #DDD;
-    border-bottom: 1px dotted #EEE;
+    border-bottom: 1px solid #DDD;
 }
 
-a:hover, a:active {
+p a:hover, ul a:hover, ol a:hover {
     color: #B31D15;
-    border-bottom: 1px dotted #B31D15;
+    border-bottom: 1px solid #B31D15;
 }
 
-div.header {
+div.site-wrap {
-    background: #222;
+    background: black;
-    border-bottom: 1px solid #222;
-    color: #BBB;
 }
 
-div.header a {
+div.header, div.header a {
-    color: #BBB;
+    color: #555;
+}
+
+div.header a:hover, div.header a:active {
+    border-bottom: 1px solid #555;
 }
 
 table, th, td {
@@ -57,16 +48,11 @@ blockquote {
     border: 1px solid #222;
 }
 
-.img-frame {
+figure {
     background-color: rgba(255, 255, 255, 0.1);
     border: 1px solid #333;
 }
 
-figure {
-    background: #222;
-    border: 1px solid #333;
-}
-
 figcaption {
-    color: #BBB;
+    color: #AAAAAA;
 }

incorporealcms/static/css/light.css

@@ -1,3 +1,4 @@
+/* common styling via the base.css, used in light and dark */
 @import '/static/css/base.css';
 
 html {
@@ -5,68 +6,53 @@ html {
 }
 
 body {
-    background: #999;
+    background: #EEE;
-}
-
-strong {
-    color: #111;
-}
-
-.site-wrap {
-    background: white;
-
-    border: 1px solid #ddd;
-    border-top: none;
-    border-bottom: none;
 }
 
 h1, h2, h3, h4, h5, h6 {
     color: #811610;
 }
 
-a:link, a:visited {
+p a, ul a, ol a {
-    color: #111;
+    color: #222;
-    border-bottom: 1px dotted #111;
+    border-bottom: 1px solid #222;
 }
 
-a:hover, a:active {
+p a:hover, ul a:hover, ol a:hover {
     color: #811610;
-    border-bottom: 1px dotted #811610;
+    border-bottom: 1px solid #811610;
 }
 
-div.header {
+div.site-wrap {
-    background: #EEE;
+    background: white;
-    border-bottom: 1px solid #CCC;
-    color: #666;
 }
 
-div.header a {
+div.header, div.header a {
-    color: #666;
+    color: #AAA;
+}
+
+div.header a:hover, div.header a:active {
+    border-bottom: 1px solid #AAA;
 }
 
 table, th, td {
-    border: 1px solid #ccc;
+    border: 1px solid #CCC;
 }
 
 th {
-    background: #eee;
+    background: #CCC;
 }
 
 blockquote {
     background-color: rgba(120, 120, 120, 0.1);
-    border: 1px solid #CCC;
+    border: 1px solid #DDD;
-}
-
-.img-frame {
-    background-color: rgba(0, 0, 0, 0.1);
-    border: 1px solid #BBB;
 }
 
 figure {
-    background: #EFEFEF;
+    background-color: rgba(0, 0, 0, 0.1);
-    border: 1px solid #CCCCCC;
+    border: 1px solid #CCC;
 }
 
 figcaption {
-    color: #777777;
+    color: #666666;
 }

incorporealcms/static/css/plain.css

@@ -1,3 +1,8 @@
+/* specify almost no styling, just fix some image and nav rendering */
+div.header {
+    display: flex;
+    justify-content: space-between;
+}
 
 .img-25 {
     max-width: 25% !important;
@@ -6,3 +11,23 @@
 .img-50 {
     max-width: 50% !important;
 }
+
+.img-75 {
+    max-width: 75% !important;
+}
+
+.img-center {
+    display: block;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+.img-left {
+    float: left;
+    margin-right: 1em;
+}
+
+.img-right {
+    float: right;
+    margin-left: 1em;
+}

incorporealcms/templates/404.html

@@ -10,7 +10,7 @@
 <div class="content">
     <h1>NOT FOUND</h1>
     <p>Sorry, <b><tt>{{ request.path }}</tt></b> does not seem to exist, at least not anymore.</p>
-    <p>It's possible you followed a dead link on this site, in which case I would appreciate it if you could email me via:
+    <p>It's possible you followed a dead link on this site, in which case I would appreciate it if you could email me at
     {{ config.CONTACT_EMAIL }} and I can take a look. I make an effort to symlink old content to its new location,
     so old links and URLs should, generally speaking, work.</p>
     <p>Otherwise, I suggest you go <a href="/">to the index</a> and navigate your way (hopefully) to what

incorporealcms/templates/base-wide.html

@@ -0,0 +1,2 @@
+{% extends "base.html" %}
+{% block site_class %}class="site-wrap site-wrap-double-width"{% endblock %}

incorporealcms/templates/base.html

@@ -10,7 +10,7 @@
 <link rel="stylesheet" href="{{ url_for('static', filename=user_style) }}">
 <link rel="icon" href="{% if config.FAVICON %}{{ config.FAVICON }}{% else %}{{ url_for('static', filename='img/favicon.png') }}{% endif %}">
 
-<div class="site-wrap">
+<div {% block site_class %}class="site-wrap site-wrap-normal-width"{% endblock %}>
     {% block header %}
     <div class="header">
         <div class="nav">

requirements/requirements-dev.in

@@ -1,11 +1,12 @@
 -r requirements.in
 
 # testing runner, test reporting, packages used during testing (e.g. requests-mock), etc.
+pydot
 pytest
 pytest-cov
 
 # linting and other static code analysis
-bandit==1.6.2               # pinned because 1.7.0 wasn't running right in tox
+bandit
 dlint
 flake8
 flake8-blind-except
@@ -16,6 +17,7 @@ flake8-fixme
 flake8-isort
 flake8-logging-format
 flake8-mutable
+safety                      # check requirements file for issues
 
 # maintenance utilities and tox
 pip-tools                   # pip-compile

requirements/requirements-dev.txt

@@ -1,32 +1,44 @@
 #
-# This file is autogenerated by pip-compile
+# This file is autogenerated by pip-compile with python 3.10
 # To update, run:
 #
 #    pip-compile --output-file=requirements/requirements-dev.txt requirements/requirements-dev.in
 #
-appdirs==1.4.4
+attrs==21.4.0
-    # via virtualenv
-attrs==20.3.0
     # via pytest
-bandit==1.6.2
+bandit==1.7.4
     # via -r requirements/requirements-dev.in
-bleach==3.3.0
+certifi==2022.5.18.1
-    # via mdx-linkify
+    # via requests
-click==7.1.2
+charset-normalizer==2.0.12
+    # via requests
+click==8.1.3
     # via
     #   flask
     #   pip-tools
-coverage==5.5
+    #   safety
+coverage[toml]==6.4
     # via pytest-cov
-distlib==0.3.1
+distlib==0.3.4
     # via virtualenv
-dlint==0.11.0
+dlint==0.12.0
     # via -r requirements/requirements-dev.in
-filelock==3.0.12
+dparse==0.5.1
+    # via safety
+filelock==3.7.0
     # via
     #   tox
     #   virtualenv
-flake8-blind-except==0.2.0
+flake8==4.0.1
+    # via
+    #   -r requirements/requirements-dev.in
+    #   dlint
+    #   flake8-builtins
+    #   flake8-docstrings
+    #   flake8-executable
+    #   flake8-isort
+    #   flake8-mutable
+flake8-blind-except==0.2.1
     # via -r requirements/requirements-dev.in
 flake8-builtins==1.5.3
     # via -r requirements/requirements-dev.in
@@ -36,119 +48,121 @@ flake8-executable==2.1.1
     # via -r requirements/requirements-dev.in
 flake8-fixme==1.1.1
     # via -r requirements/requirements-dev.in
-flake8-isort==4.0.0
+flake8-isort==4.1.1
     # via -r requirements/requirements-dev.in
 flake8-logging-format==0.6.0
     # via -r requirements/requirements-dev.in
 flake8-mutable==1.2.0
     # via -r requirements/requirements-dev.in
-flake8==3.9.1
+flask==2.1.2
-    # via
-    #   -r requirements/requirements-dev.in
-    #   dlint
-    #   flake8-builtins
-    #   flake8-docstrings
-    #   flake8-executable
-    #   flake8-isort
-    #   flake8-mutable
-flask==1.1.2
     # via -r requirements/requirements.in
-gitdb==4.0.7
+gitdb==4.0.9
     # via gitpython
-gitpython==3.1.14
+gitpython==3.1.27
     # via bandit
+idna==3.3
+    # via requests
 iniconfig==1.1.1
     # via pytest
-isort==5.8.0
+isort==5.10.1
     # via flake8-isort
-itsdangerous==1.1.0
+itsdangerous==2.1.2
     # via flask
-jinja2==2.11.3
+jinja2==3.1.2
     # via flask
-markdown==3.3.4
+markdown==3.3.7
-    # via
+    # via -r requirements/requirements.in
-    #   -r requirements/requirements.in
+markupsafe==2.1.1
-    #   mdx-linkify
-markupsafe==1.1.1
     # via jinja2
 mccabe==0.6.1
     # via flake8
-mdx-linkify==2.1
+packaging==21.3
-    # via -r requirements/requirements.in
-packaging==20.9
     # via
-    #   bleach
+    #   dparse
     #   pytest
+    #   safety
     #   tox
-pbr==5.5.1
+pbr==5.9.0
     # via stevedore
-pep517==0.10.0
+pep517==0.12.0
     # via pip-tools
-pip-tools==6.1.0
+pip-tools==6.6.2
     # via -r requirements/requirements-dev.in
-pluggy==0.13.1
+platformdirs==2.5.2
+    # via virtualenv
+pluggy==1.0.0
     # via
     #   pytest
     #   tox
-py==1.10.0
+py==1.11.0
     # via
     #   pytest
     #   tox
-pycodestyle==2.7.0
+pycodestyle==2.8.0
     # via flake8
-pydocstyle==6.0.0
+pydocstyle==6.1.1
     # via flake8-docstrings
-pyflakes==2.3.1
+pydot==1.4.2
-    # via flake8
-pyparsing==2.4.7
-    # via packaging
-pytest-cov==2.11.1
     # via -r requirements/requirements-dev.in
-pytest==6.2.3
+pyflakes==2.4.0
+    # via flake8
+pyparsing==3.0.9
+    # via
+    #   packaging
+    #   pydot
+pytest==7.1.2
     # via
     #   -r requirements/requirements-dev.in
     #   pytest-cov
-pytz==2021.1
+pytest-cov==3.0.0
-    # via tzlocal
+    # via -r requirements/requirements-dev.in
-pyyaml==5.4.1
+pyyaml==6.0
-    # via bandit
-six==1.15.0
     # via
     #   bandit
-    #   bleach
+    #   dparse
+requests==2.27.1
+    # via safety
+safety==1.10.3
+    # via -r requirements/requirements-dev.in
+six==1.16.0
+    # via
     #   tox
     #   virtualenv
-smmap==4.0.0
+smmap==5.0.0
     # via gitdb
-snowballstemmer==2.1.0
+snowballstemmer==2.2.0
     # via pydocstyle
-stevedore==3.3.0
+stevedore==3.5.0
     # via bandit
-testfixtures==6.17.1
+testfixtures==6.18.5
     # via flake8-isort
 toml==0.10.2
     # via
+    #   dparse
+    #   tox
+tomli==2.0.1
+    # via
+    #   coverage
     #   pep517
     #   pytest
-    #   tox
+tox==3.25.0
-tox-wheel==0.6.0
-    # via -r requirements/requirements-dev.in
-tox==3.23.0
     # via
     #   -r requirements/requirements-dev.in
     #   tox-wheel
-tzlocal==2.1
+tox-wheel==0.7.0
-    # via -r requirements/requirements.in
-versioneer==0.19
     # via -r requirements/requirements-dev.in
-virtualenv==20.4.3
+urllib3==1.26.9
+    # via requests
+versioneer==0.22
+    # via -r requirements/requirements-dev.in
+virtualenv==20.14.1
     # via tox
-webencodings==0.5.1
+werkzeug==2.1.2
-    # via bleach
-werkzeug==1.0.1
     # via flask
-wheel==0.36.2
+wheel==0.37.1
-    # via tox-wheel
+    # via
+    #   pip-tools
+    #   tox-wheel
 
 # The following packages are considered to be unsafe in a requirements file:
 # pip

requirements/requirements.in

@@ -1,4 +1,2 @@
 Flask                       # general purpose web service and web server stuff
 Markdown                    # markdown rendering in templates
-mdx-linkify                 # convert URLs in the text to clickable links
-tzlocal                     # identifying system's local timezone

requirements/requirements.txt

@@ -1,38 +1,20 @@
 #
-# This file is autogenerated by pip-compile
+# This file is autogenerated by pip-compile with python 3.10
 # To update, run:
 #
 #    pip-compile --output-file=requirements/requirements.txt requirements/requirements.in
 #
-bleach==3.3.0
+click==8.1.3
-    # via mdx-linkify
-click==7.1.2
     # via flask
-flask==1.1.2
+flask==2.1.2
     # via -r requirements/requirements.in
-itsdangerous==1.1.0
+itsdangerous==2.1.2
     # via flask
-jinja2==2.11.3
+jinja2==3.1.2
     # via flask
-markdown==3.3.4
+markdown==3.3.7
-    # via
+    # via -r requirements/requirements.in
-    #   -r requirements/requirements.in
+markupsafe==2.1.1
-    #   mdx-linkify
-markupsafe==1.1.1
     # via jinja2
-mdx-linkify==2.1
+werkzeug==2.1.2
-    # via -r requirements/requirements.in
-packaging==20.9
-    # via bleach
-pyparsing==2.4.7
-    # via packaging
-pytz==2021.1
-    # via tzlocal
-six==1.15.0
-    # via bleach
-tzlocal==2.1
-    # via -r requirements/requirements.in
-webencodings==0.5.1
-    # via bleach
-werkzeug==1.0.1
     # via flask

setup.py

@@ -18,13 +18,19 @@ setup(
     name='incorporeal-cms',
     description='Flask project for running https://suou.net (and eventually others).',
     url='https://git.incorporeal.org/bss/incorporeal-cms',
-    license='GPL3',
     author='Brian S. Stephan',
     author_email='bss@incorporeal.org',
+    license='AGPLv3+',
+    classifiers=[
+        'License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)',
+    ],
     version=versioneer.get_version(),
     cmdclass=versioneer.get_cmdclass(),
     packages=find_packages(),
     include_package_data=True,
     zip_safe=False,
     install_requires=extract_requires(),
+    extras_require={
+        'dot': ['pydot'],
+    },
 )

tests/functional_markdown_tests.py

@@ -0,0 +1,63 @@
+"""Test graphviz functionality."""
+import os
+
+from incorporealcms import create_app
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+
+
+def app_with_pydot():
+    """Create the test app, including the pydot extension."""
+    return create_app(instance_path=os.path.join(HERE, 'instance'),
+                      test_config={'MARKDOWN_EXTENSIONS': ['incorporealcms.mdx.pydot']})
+
+
+def test_functional_initialization():
+    """Test initialization with the graphviz config."""
+    app = app_with_pydot()
+    assert app is not None
+
+
+def test_graphviz_is_rendered():
+    """Initialize the app with the graphviz extension and ensure it does something."""
+    app = app_with_pydot()
+    client = app.test_client()
+
+    response = client.get('/test-graphviz')
+    assert response.status_code == 200
+    assert b'~~~pydot' not in response.data
+    assert b'data:image/png;base64' in response.data
+
+
+def test_two_graphviz_are_rendered():
+    """Test two images are rendered."""
+    app = app_with_pydot()
+    client = app.test_client()
+
+    response = client.get('/test-two-graphviz')
+    assert response.status_code == 200
+    assert b'~~~pydot' not in response.data
+    assert b'data:image/png;base64' in response.data
+
+
+def test_invalid_graphviz_is_not_rendered():
+    """Check that invalid graphviz doesn't blow things up."""
+    app = app_with_pydot()
+    client = app.test_client()
+
+    response = client.get('/test-invalid-graphviz')
+    assert response.status_code == 500
+    assert b'INTERNAL SERVER ERROR' in response.data
+
+
+def test_figures_are_rendered(client):
+    """Test that a page with my figure syntax renders as expected."""
+    response = client.get('/figures')
+    assert response.status_code == 200
+    assert (b'<figure class="right"><img alt="fancy captioned logo" src="bss-square-no-bg.png" />'
+            b'<figcaption>this is my cool logo!</figcaption></figure>') in response.data
+    assert (b'<figure><img alt="vanilla captioned logo" src="bss-square-no-bg.png" />'
+            b'<figcaption>this is my cool logo without an attr!</figcaption>\n</figure>') in response.data
+    assert (b'<figure class="left"><img alt="fancy logo" src="bss-square-no-bg.png" />'
+            b'<span></span></figure>') in response.data
+    assert b'<figure><img alt="just a logo" src="bss-square-no-bg.png" /></figure>' in response.data

tests/functional_tests.py

@@ -7,7 +7,7 @@ def test_page_that_exists(client):
     """Test that the app can serve a basic file at the index."""
     response = client.get('/')
     assert response.status_code == 200
-    assert b'<h1>test index</h1>' in response.data
+    assert b'<h1 id="test-index">test index</h1>' in response.data
 
 
 def test_direct_file_that_exists(client):
@@ -23,7 +23,7 @@ def test_page_that_doesnt_exist(client):
     assert response.status_code == 404
     assert b'<b><tt>/ohuesthaoeusth</tt></b> does not seem to exist' in response.data
     # test the contact email config
-    assert b'bss@incorporeal.org' in response.data
+    assert b'admin@example.com' in response.data
 
 
 def test_files_outside_pages_do_not_get_served(client):
@@ -39,7 +39,7 @@ def test_internal_server_error_serves_error_page(client):
     assert response.status_code == 500
     assert b'INTERNAL SERVER ERROR' in response.data
     # test the contact email config
-    assert b'bss@incorporeal.org' in response.data
+    assert b'admin@example.com' in response.data
 
 
 def test_oserror_is_500(client, app):
@@ -70,28 +70,28 @@ def test_page_with_title_metadata(client):
     """Test that a page with title metadata has its title written."""
     response = client.get('/')
     assert response.status_code == 200
-    assert b'<title>Index - incorporeal.org</title>' in response.data
+    assert b'<title>Index - example.com</title>' in response.data
 
 
 def test_page_without_title_metadata(client):
     """Test that a page without title metadata gets the default title."""
     response = client.get('/no-title')
     assert response.status_code == 200
-    assert b'<title>/no-title - incorporeal.org</title>' in response.data
+    assert b'<title>/no-title - example.com</title>' in response.data
 
 
 def test_page_in_subdir_without_title_metadata(client):
     """Test that the title-less page display is as expected."""
     response = client.get('/subdir//page-no-title')
     assert response.status_code == 200
-    assert b'<title>/subdir/page-no-title - incorporeal.org</title>' in response.data
+    assert b'<title>/subdir/page-no-title - example.com</title>' in response.data
 
 
 def test_page_with_card_metadata(client):
     """Test that a page with opengraph metadata."""
     response = client.get('/more-metadata')
     assert response.status_code == 200
-    assert b'<meta property="og:title" content="title for the page - incorporeal.org">' in response.data
+    assert b'<meta property="og:title" content="title for the page - example.com">' in response.data
     assert b'<meta property="og:description" content="description of this page made even longer">' in response.data
     assert b'<meta property="og:image" content="http://buh.com/test.img">' in response.data
 
@@ -100,7 +100,7 @@ def test_page_with_card_title_even_when_no_metadata(client):
     """Test that a page without metadata still has a card with the derived title."""
     response = client.get('/no-title')
     assert response.status_code == 200
-    assert b'<meta property="og:title" content="/no-title - incorporeal.org">' in response.data
+    assert b'<meta property="og:title" content="/no-title - example.com">' in response.data
     assert b'<meta property="og:description"' not in response.data
     assert b'<meta property="og:image"' not in response.data
 
@@ -109,7 +109,14 @@ def test_page_with_forced_empty_title_just_shows_suffix(client):
     """Test that if a page specifies a blank Title meta tag explicitly, only the suffix is used in the title."""
     response = client.get('/forced-no-title')
     assert response.status_code == 200
-    assert b'<title>incorporeal.org</title>' in response.data
+    assert b'<title>example.com</title>' in response.data
+
+
+def test_page_with_redirect_meta_url_redirects(client):
+    """Test that if a page specifies a URL to redirect to, that the site serves up a 301."""
+    response = client.get('/redirect')
+    assert response.status_code == 301
+    assert response.location == 'http://www.google.com/'
 
 
 def test_page_has_modified_timestamp(client):
@@ -127,32 +134,32 @@ def test_that_page_request_redirects_to_directory(client):
     """
     response = client.get('/subdir')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/subdir/'
+    assert response.location == '/subdir/'
 
 
 def test_that_request_to_symlink_redirects_markdown(client):
     """Test that a request to /foo redirects to /what-foo-points-at."""
     response = client.get('/symlink-to-no-title')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/no-title'
+    assert response.location == '/no-title'
 
 
 def test_that_request_to_symlink_redirects_file(client):
     """Test that a request to /foo.txt redirects to /what-foo-points-at.txt."""
     response = client.get('/symlink-to-foo.txt')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/foo.txt'
+    assert response.location == '/foo.txt'
 
 
 def test_that_request_to_symlink_redirects_directory(client):
     """Test that a request to /foo/ redirects to /what-foo-points-at/."""
     response = client.get('/symlink-to-subdir/')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/subdir'
+    assert response.location == '/subdir'
     # sadly, this location also redirects
     response = client.get('/subdir')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/subdir/'
+    assert response.location == '/subdir/'
     # but we do get there
     response = client.get('/subdir/')
     assert response.status_code == 200
@@ -162,7 +169,7 @@ def test_that_request_to_symlink_redirects_subdirectory(client):
     """Test that a request to /foo/bar redirects to /what-foo-points-at/bar."""
     response = client.get('/symlink-to-subdir/page-no-title')
     assert response.status_code == 301
-    assert response.location == 'http://localhost/subdir/page-no-title'
+    assert response.location == '/subdir/page-no-title'
     response = client.get('/subdir/page-no-title')
     assert response.status_code == 200
 
@@ -193,3 +200,13 @@ def test_setting_selected_style_includes_cookie(client):
     assert b'dark.css' in response.data
     assert b'light.css' not in response.data
     assert style_cookie.value == 'dark'
+
+
+def test_pages_can_supply_alternate_templates(client):
+    """Test that pages can supply templates other than the default."""
+    response = client.get('/')
+    assert b'class="site-wrap site-wrap-normal-width"' in response.data
+    assert b'class="site-wrap site-wrap-double-width"' not in response.data
+    response = client.get('/custom-template')
+    assert b'class="site-wrap site-wrap-normal-width"' not in response.data
+    assert b'class="site-wrap site-wrap-double-width"' in response.data

tests/instance/config.py

@@ -15,6 +15,10 @@ LOGGING = {
         },
     },
     'loggers': {
+        'incorporealcms.mdx': {
+            'level': 'DEBUG',
+            'handlers': ['console'],
+        },
         'incorporealcms.pages': {
             'level': 'DEBUG',
             'handlers': ['console'],

tests/instance/pages/custom-template.md

@@ -0,0 +1,3 @@
+Template:           base-wide.html
+
+testttttttttt

tests/instance/pages/figures.md

@@ -0,0 +1,13 @@
+# test of figures
+
+|> ![fancy captioned logo](bss-square-no-bg.png)
+|: this is my cool logo!
+{: .right }
+
+|> ![vanilla captioned logo](bss-square-no-bg.png)
+|: this is my cool logo without an attr!
+
+|> ![fancy logo](bss-square-no-bg.png)
+{: .left }
+
+|> ![just a logo](bss-square-no-bg.png)

tests/instance/pages/redirect.md

@@ -0,0 +1 @@
+Redirect:           http://www.google.com/

tests/instance/pages/test-graphviz.md

@@ -0,0 +1,12 @@
+# test
+
+test
+~~~{ pydot:attack-plan }
+digraph G {
+    rankdir=LR
+    Earth
+    Mars
+    Earth -> Mars
+}
+~~~
+more test

tests/instance/pages/test-invalid-graphviz.md

@@ -0,0 +1,11 @@
+# test
+
+test
+~~~{ pydot:attack-plan }
+    rankdir=LR
+    Earth
+    Mars
+    Earth -> Mars
+}
+~~~
+more test

tests/instance/pages/test-two-graphviz.md

@@ -0,0 +1,25 @@
+# test
+
+test
+
+~~~{ pydot:attack-plan }
+digraph G {
+    rankdir=LR
+    Earth
+    Mars
+    Earth -> Mars
+}
+~~~
+
+more test
+
+~~~{ pydot:new-attack-plan }
+digraph H {
+    rankdir=LR
+    Venus
+    Mars
+    Venus -> Mars
+}
+~~~
+
+done

tests/test_factory.py

@@ -20,7 +20,7 @@ def test_markdown_meta_extension_always():
     client = app.test_client()
     response = client.get('/')
     assert response.status_code == 200
-    assert b'<title>Index - incorporeal.org</title>' in response.data
+    assert b'<title>Index - example.com</title>' in response.data
 
 
 def test_custom_markdown_extensions_work():
@@ -68,3 +68,12 @@ def test_favicon_override():
     response = client.get('/no-title')
     assert response.status_code == 200
     assert b'<link rel="icon" href="/media/foo.png">' in response.data
+
+
+def test_misconfigured_markdown_extensions():
+    """Test that a misconfigured markdown extensions leads to a 500 at render time."""
+    instance_path = os.path.join(HERE, 'instance')
+    app = create_app(instance_path=instance_path, test_config={'MARKDOWN_EXTENSIONS': 'WRONG'})
+    client = app.test_client()
+    response = client.get('/no-title')
+    assert response.status_code == 500

tests/test_pages.py

@@ -9,19 +9,19 @@ from incorporealcms.pages import (generate_parent_navs, instance_resource_path_t
 def test_generate_page_navs_index(app):
     """Test that the index page has navs to the root (itself)."""
     with app.app_context():
-        assert generate_parent_navs('pages/index.md') == [('incorporeal.org', '/')]
+        assert generate_parent_navs('pages/index.md') == [('example.com', '/')]
 
 
 def test_generate_page_navs_subdir_index(app):
     """Test that dir pages have navs to the root and themselves."""
     with app.app_context():
-        assert generate_parent_navs('pages/subdir/index.md') == [('incorporeal.org', '/'), ('subdir', '/subdir/')]
+        assert generate_parent_navs('pages/subdir/index.md') == [('example.com', '/'), ('subdir', '/subdir/')]
 
 
 def test_generate_page_navs_subdir_real_page(app):
     """Test that real pages have navs to the root, their parent, and themselves."""
     with app.app_context():
-        assert generate_parent_navs('pages/subdir/page.md') == [('incorporeal.org', '/'), ('subdir', '/subdir/'),
+        assert generate_parent_navs('pages/subdir/page.md') == [('example.com', '/'), ('subdir', '/subdir/'),
                                                                 ('Page', '/subdir/page')]
 
 
@@ -29,7 +29,7 @@ def test_generate_page_navs_subdir_with_title_parsing_real_page(app):
     """Test that title metadata is used in the nav text."""
     with app.app_context():
         assert generate_parent_navs('pages/subdir-with-title/page.md') == [
-            ('incorporeal.org', '/'),
+            ('example.com', '/'),
             ('SUB!', '/subdir-with-title/'),
             ('page', '/subdir-with-title/page')
         ]
@@ -39,7 +39,7 @@ def test_generate_page_navs_subdir_with_no_index(app):
     """Test that breadcrumbs still generate even if a subdir doesn't have an index.md."""
     with app.app_context():
         assert generate_parent_navs('pages/no-index-dir/page.md') == [
-            ('incorporeal.org', '/'),
+            ('example.com', '/'),
             ('/no-index-dir/', '/no-index-dir/'),
             ('page', '/no-index-dir/page')
         ]

tox.ini

@@ -4,7 +4,7 @@
 # and then run "tox" from this directory.
 
 [tox]
-envlist = begin,py37,py38,coverage,security,lint,bundle
+envlist = begin,py38,py39,py310,coverage,security,lint,bundle
 
 [testenv]
 # build a wheel and test it
@@ -31,12 +31,17 @@ deps = setuptools
 skip_install = true
 commands = coverage erase
 
-[testenv:py37]
+[testenv:py38]
 # run pytest with coverage
 commands =
     pytest --cov-append --cov={envsitepackagesdir}/incorporealcms/ --cov-branch
 
-[testenv:py38]
+[testenv:py39]
+# run pytest with coverage
+commands =
+    pytest --cov-append --cov={envsitepackagesdir}/incorporealcms/ --cov-branch
+
+[testenv:py310]
 # run pytest with coverage
 commands =
     pytest --cov-append --cov={envsitepackagesdir}/incorporealcms/ --cov-branch
@@ -53,6 +58,7 @@ commands =
 # again it seems the most valuable here to run against the packaged code
 commands =
     bandit {envsitepackagesdir}/incorporealcms/ -r
+    safety check -r requirements/requirements-dev.txt
 
 [testenv:lint]
 # run style checks
@@ -74,12 +80,6 @@ source =
 [coverage:run]
 branch = True
 
-# redundant with pytest --cov above, but this tricks the coverage.xml report into
-# using the full path, otherwise files with the same name in different paths
-# get clobbered. maybe appends would fix this, IDK
-include =
-    .tox/**/incorporealcms/
-
 omit =
     **/_version.py