Expand the MediaWiki:Maps config page beyond Leaflet layers (#927)

* Expand the MediaWiki:Maps config page beyond Leaflet layers

Fixes #926
Follows-up to #925

Generalizes the MediaWiki:Maps config page (added in #925 for Leaflet layers) to expose
most Maps settings, driven by a single declarative schema so that exposing a setting is one
schema entry rather than bespoke code.

## Design

Maps\Config\ConfigSchema lists every exposed setting as a ConfigSetting: page group + key,
the egMaps*/smgQP* setting it overrides, its value type, and its merge strategy. It drives
both save-time validation and read-time application:

* ConfigValidator walks the schema on save (EditFilter hook), rejecting unknown groups/keys
  and per-value type errors.
* EffectiveSettings is the one effective-settings lookup wrapping the PHP settings with the
  schema-translated wiki overlay. It reads the page lazily at parse time, memoizes the
  result, falls back to the PHP settings on any Throwable or when disabled, and ignores wiki
  values that fail their type validation. All exposed-setting consumption sites read through
  it instead of $GLOBALS.

Value types are small reusable objects: boolean, integer, string, enum, enum list, string
list, dimension, positive-number map, pattern, plus the layer-definitions and availability
specials. Wiki values replace the PHP value, except layerDefinitions, availableLayers and
availableOverlays, which merge per name via a MergeStrategy attribute of those entries.

The #925 Leaflet-specific classes were reshaped into this general concept:
LeafletConfigValidator -> ConfigValidator, WikiLeafletConfigSource -> WikiPageConfigSource
(now reads the whole page), CombiningLeafletConfigLookup -> EffectiveSettings;
LeafletConfig/LeafletConfigLookup dissolved into LeafletService reading the effective
settings directly. LeafletLayerContract and AttributionSanitizer are unchanged.

## Exposed and excluded

Groups: general, coordinates, geocoding, semanticMediaWiki, leaflet, googleMaps (see the
README for the full key list). Secrets/API keys, script-injection primitives, the caches and
setup-time switches stay PHP-only, as decided in the issue.

Two settings from the issue's list are deviated from:

* defaultService is excluded. egMapsDefaultService is consumed when MappingServices is
  constructed and when SMW result-format aliases are registered, both during extension setup
  before the config page can be read. Routing it would force a wiki read at setup, defeating
  the lazy design, so it stays PHP-only.
* internationalDirectionLabels is excluded. egMapsInternatDirectionLabels is not read
  anywhere in the code, so exposing it would have no effect.

distanceUnit is validated as a plain string rather than against the effective units: an
unknown default unit self-heals to the first available unit at runtime and cannot hard-fail.

## Security

mapWidth/mapHeight use a strict dimension pattern (they reach inline styles),
googleMaps.language a strict pattern (it reaches the Google API URL), and distance unit names
are restricted to alphanumerics (they reach a regex and rendered output). Layer definitions
keep the #925 hardening unchanged.

## Tests

Table-driven unit tests per value type, schema and validator tests, EffectiveSettings merge,
fallback and memoization tests, and integration spot checks that a wiki-set value lands end
to end. All #925 tests are preserved through the renames.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Reject a trailing newline in the config value patterns

The dimension, distance-unit-name and Google Maps language patterns anchored
with $, which matches just before a trailing newline. Add the D modifier so a
value with a trailing newline is rejected, keeping these strict patterns fully
strict before their style, URL and regex sinks. Harmless in practice since the
sinks escape or encode, found in review.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Correct README wording about config page key naming

Several page keys are deliberately renamed from their PHP settings
(e.g. pagesWithMapsCategory for egMapsEnableCategory), so the reference
list should not claim the names are the same.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: JeroenDeDauw

DefaultSettings.php

@@ -28,8 +28,9 @@
 
 	// Boolean. Whether Maps configuration may also be set on the MediaWiki:Maps JSON config page,
 	// which is editable only by users with the editinterface and editsitejson rights. When false,
-	// that page is never read and only LocalSettings.php applies. The wiki page currently exposes
-	// the Leaflet layer settings; its values take precedence over LocalSettings.php.
+	// that page is never read and only LocalSettings.php applies. The wiki page exposes most Maps
+	// settings, grouped by service and topic (see the README); its values take precedence over
+	// LocalSettings.php. Secrets, script-injection primitives and setup-time switches stay PHP-only.
 	'egMapsEnableInWikiConfig' => true,
 
 

README.md

@@ -44,28 +44,63 @@ via [Professional.Wiki](https://professional.wiki/). Discounts for work that is
 
 ## On-wiki configuration
 
-Most settings are configured in `LocalSettings.php` (see the
-[configuration documentation](https://maps.extension.wiki/wiki/Configuration)). Wiki administrators
-without server access can also configure the Leaflet layers on the `MediaWiki:Maps` page. It holds
-JSON and, like other site configuration, is editable only by users with the `editinterface` and
-`editsitejson` rights. For example, to add a custom tile layer that authors can then select with the
-`layers` parameter:
+Most settings can be configured in `LocalSettings.php` (see the
+[configuration documentation](https://maps.extension.wiki/wiki/Configuration)) or, for wiki
+administrators without server access, on the `MediaWiki:Maps` page. It holds JSON and, like other
+site configuration, is editable only by users with the `editinterface` and `editsitejson` rights.
+Settings are grouped by service and topic:
 
 ```json
 {
+	"general": {
+		"mapWidth": "100%",
+		"mapHeight": "500px",
+		"distanceUnit": "km"
+	},
+	"coordinates": {
+		"notation": "float",
+		"directional": false
+	},
+	"geocoding": {
+		"service": "google"
+	},
 	"leaflet": {
+		"defaultZoom": 5,
 		"layerDefinitions": {
 			"Historic 1904": {
 				"url": "https://tiles.example.org/historic1904/{z}/{x}/{y}.png",
 				"options": { "attribution": "Historic map tiles", "maxZoom": 18 }
 			}
 		}
+	},
+	"googleMaps": {
+		"zoom": 5,
+		"type": "satellite"
 	}
 }
 ```
 
-The page is validated when saved and combined with `LocalSettings.php`, with the wiki page taking
-precedence. Changes take effect the next time a page with a map is parsed.
+The available groups and keys correspond to `LocalSettings.php` settings:
+
+* **general**: `mapWidth`, `mapHeight`, `defaultTitle`, `defaultLabel`, `resizableByDefault`,
+  `rezoomForKml`, `pagesWithMapsCategory`, `distanceUnits`, `distanceUnit`, `distanceDecimals`
+* **coordinates**: `availableNotations`, `notation`, `directional`
+* **geocoding**: `service` (`geonames`, `google` or `nominatim`)
+* **semanticMediaWiki**: `showTitle`, `hideNamespace`, `template`, `coordinateFormat`,
+  `coordinateDirectional`
+* **leaflet**: `layerDefinitions`, `defaultLayers`, `defaultOverlays`, `availableLayers`,
+  `availableOverlays`, `defaultZoom`
+* **googleMaps**: `zoom`, `type`, `types`, `controls`, `typeControlStyle`, `zoomControlStyle`,
+  `autoInfoWindows`, `layers`, `showPoi`, `language`
+
+The page is validated when saved and combined with `LocalSettings.php`, with the wiki value taking
+precedence. Most settings are replaced wholesale; only `layerDefinitions`, `availableLayers` and
+`availableOverlays` are merged per name, so the wiki only needs to list the entries it changes.
+Changes take effect the next time a page with a map is parsed.
+
+Secrets (API keys), settings that run before a wiki page can be read, and other server-only options
+stay exclusive to `LocalSettings.php`. Set `$egMapsEnableInWikiConfig` to `false` to ignore the page
+entirely.
 
 ## Project status
 

RELEASE-NOTES.md

@@ -7,7 +7,7 @@ different releases and which versions of PHP and MediaWiki they support, see the
 
 Released on TBD.
 
-* Added an on-wiki JSON configuration page at `MediaWiki:Maps` for the Leaflet layer settings (custom layer definitions, the default and available base layers and overlays). It is editable only by administrators and interface administrators, is validated on save, and is combined with `LocalSettings.php` with the wiki page taking precedence. Set `$egMapsEnableInWikiConfig` to `false` to disable it.
+* Added an on-wiki JSON configuration page at `MediaWiki:Maps` exposing most Maps settings, grouped by service and topic (general map, coordinate, geocoding, Semantic MediaWiki, Leaflet and Google Maps options), including the Leaflet custom layer definitions and available layers. It is editable only by administrators and interface administrators, is validated on save, and is combined with `LocalSettings.php` with the wiki page taking precedence. Secrets, script-injection primitives and setup-time settings stay exclusive to `LocalSettings.php`. Set `$egMapsEnableInWikiConfig` to `false` to disable it.
 * Hardened the custom Leaflet layer definitions used by `$egMapsLeafletLayerDefinitions` and the config page (breaking change): the `url` and `errorTileUrl` must be `http(s)` URLs, only an allowlist of Leaflet `options` is kept, and `attribution` is sanitized to plain text and `http(s)` links. Definitions relying on raw HTML attribution or non-allowlisted options need updating.
 
 ## Maps 13.1.0

i18n/en.json

@@ -270,6 +270,15 @@
 	"maps-config-error-invalid-json": "The configuration must be a JSON object.",
 	"maps-config-error-not-object": "The value of \"$1\" must be a JSON object.",
 	"maps-config-error-unknown-key": "Unknown configuration key \"$1\".",
+	"maps-config-error-invalid-boolean": "\"$1\" must be true or false.",
+	"maps-config-error-invalid-integer": "\"$1\" must be a whole number.",
+	"maps-config-error-integer-too-small": "\"$1\" must be $2 or greater.",
+	"maps-config-error-invalid-string": "\"$1\" must be text.",
+	"maps-config-error-invalid-enum": "\"$1\" must be one of: $2.",
+	"maps-config-error-invalid-enum-list": "\"$1\" must be a list containing only: $2.",
+	"maps-config-error-invalid-dimension": "\"$1\" must be a size such as 400, \"400px\" or \"auto\".",
+	"maps-config-error-invalid-number-map": "\"$1\" must be a map of names to positive numbers.",
+	"maps-config-error-invalid-language": "\"$1\" must be a valid language code, such as \"en\" or \"en-GB\".",
 	"maps-config-error-invalid-layer-name": "\"$1\" is not a valid layer name.",
 	"maps-config-error-unknown-layer-key": "Layer \"$1\" has an unknown property \"$2\".",
 	"maps-config-error-invalid-url": "Layer \"$1\" must have a \"url\" that starts with http:// or https://.",

i18n/qqq.json

@@ -246,8 +246,17 @@
 	"maps-validator-message-nodesc": "Indicates that no parameter description is available",
 	"maps-config-invalid": "Heading shown above the list of errors when an edit to the MediaWiki:Maps JSON config page is rejected.",
 	"maps-config-error-invalid-json": "Error shown when the MediaWiki:Maps config is not a JSON object.",
-	"maps-config-error-not-object": "Error shown when a value that must be a JSON object is not. $1 is the location, e.g. \"leaflet\" or \"layerDefinitions\".",
-	"maps-config-error-unknown-key": "Error shown when the config contains an unrecognized key. $1 is the unknown key.",
+	"maps-config-error-not-object": "Error shown when a value that must be a JSON object is not. $1 is the location, e.g. \"general\" or \"leaflet.layerDefinitions\".",
+	"maps-config-error-unknown-key": "Error shown when the config contains an unrecognized group or key. $1 is the unknown key, e.g. \"general\" or \"general.mapWidth\".",
+	"maps-config-error-invalid-boolean": "Error shown when a setting that must be a boolean is not. $1 is the location, e.g. \"general.resizableByDefault\".",
+	"maps-config-error-invalid-integer": "Error shown when a setting that must be a whole number is not. $1 is the location, e.g. \"leaflet.defaultZoom\".",
+	"maps-config-error-integer-too-small": "Error shown when a whole-number setting is below its minimum. $1 is the location, $2 is the minimum.",
+	"maps-config-error-invalid-string": "Error shown when a setting that must be text is not. $1 is the location, e.g. \"general.defaultTitle\".",
+	"maps-config-error-invalid-enum": "Error shown when a setting is not one of its allowed values. $1 is the location, $2 is the comma-separated list of allowed values.",
+	"maps-config-error-invalid-enum-list": "Error shown when a setting is not a list of allowed values. $1 is the location, $2 is the comma-separated list of allowed values.",
+	"maps-config-error-invalid-dimension": "Error shown when a map size setting is not a valid dimension. $1 is the location, e.g. \"general.mapWidth\".",
+	"maps-config-error-invalid-number-map": "Error shown when the distance units setting is not a map of names to positive numbers. $1 is the location.",
+	"maps-config-error-invalid-language": "Error shown when the Google Maps language setting is not a valid language code. $1 is the location.",
 	"maps-config-error-invalid-layer-name": "Error shown when a custom Leaflet layer has an invalid name. $1 is the name.",
 	"maps-config-error-unknown-layer-key": "Error shown when a custom Leaflet layer definition has an unrecognized property. $1 is the layer name, $2 is the property.",
 	"maps-config-error-invalid-url": "Error shown when a custom Leaflet layer has no valid url. $1 is the layer name.",

src/CombiningLeafletConfigLookup.php

@@ -0,0 +1,32 @@
+<?php
+
+declare( strict_types = 1 );
+
+namespace Maps\Config;
+
+/**
+ * A map of layer names to booleans, used for the available base layers and overlays. Merged per
+ * name with the PHP settings rather than replaced, so the wiki only needs to list the layers it
+ * changes.
+ */
+class AvailabilityType implements ConfigType {
+
+	public function validate( mixed $value, string $location ): array {
+		return $this->isAvailabilityMap( $value ) ? [] : [ [ 'maps-config-error-invalid-availability', $location ] ];
+	}
+
+	private function isAvailabilityMap( mixed $value ): bool {
+		if ( !is_array( $value ) || ( $value !== [] && array_is_list( $value ) ) ) {
+			return false;
+		}
+
+		foreach ( $value as $enabled ) {
+			if ( !is_bool( $enabled ) ) {
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+}

src/Config/AvailabilityType.php

@@ -0,0 +1,13 @@
+<?php
+
+declare( strict_types = 1 );
+
+namespace Maps\Config;
+
+class BooleanType implements ConfigType {
+
+	public function validate( mixed $value, string $location ): array {
+		return is_bool( $value ) ? [] : [ [ 'maps-config-error-invalid-boolean', $location ] ];
+	}
+
+}