Remove jQuery throttle-debounce dependency

[hlfan]

iD already throttles its hash updates. Hooking into this allows dropping the vendored dependency, leaving only leaflet-related ones.

[HolgerJeromin]

Can we have instead a (throttled) event from iD on its parent like?

window.parent?.postMessage('id-hash-update', '*' /* This is no sensitive data, so ok to allow all targets */);

[HolgerJeromin]

My favorite solution would be here in this repo in one file window.addEventListener("message", ... and in the id repo window.parent?.postMessage('id-hash-update', '*');

[hlfan]

Yeah that would be nice, or exposing iD's lodash utilities similarly to d3.

@tyrasd which option do you think would be more in-scope for the iD repo?

[hlfan]

Yeah that would be nice, or exposing iD's lodash utilities similarly to d3.

which option do you think would be more in-scope for the iD repo?

Or @k-yle, maybe you have an idea?

[k-yle]

Or @k-yle, maybe you have an idea?

I would suggest adding a new event to iD's coreContext, and emitting that event whenever we call history.replaceState()¹.

Then you don't need to override history.replaceState in this repo, and you can remove jQuery.throttle since iD already thottles history.replaceState by 500ms.

Footnotes

1. which is unfortunately copy-pasted many times in iD, that should probably be cleaning up at some point 🤷 ↩

[HolgerJeromin]

I would suggest adding a new event to iD's coreContext, and emitting that event whenever we call history.replaceState()

I have no intern view what this event is, but custom events are not always walk through the iframe barrier, while postMessage do.

[hlfan]

We are currently using parent. for that anyway.

[hlfan]

Does the second change actually make anything simpler? It certainly increases the amount of code...

I'll revisit this change in a separate pr to sandbox the iD frame as per the security report.