Release: merge development into beta - #630
Open
github-actions[bot] wants to merge 11 commits into
Open
github-actions[bot] wants to merge 11 commits into
github-actions[bot] wants to merge 11 commits into
Conversation
The renderer in nc-vue could not fetch a feed. It read a consumer-supplied `itemsEndpoint`, and LaunchPad was the only app that ever supplied one — so in every other app the form collected feed URLs that nothing could load, and the widget sat there empty with no error. The feed path is entirely ours already: NewsWidgetService, FeedRefreshService, the feed cache table and its background job. The widget belongs with them. LaunchPad already had its own `NewsWidget.vue` — 617 lines, still passing its spec, orphaned when the communal CnNewsWidget superseded it. Revived rather than porting a second copy: it calls our own endpoint directly. The form had no local equivalent, so CnNewsWidgetForm is ported as NewsWidgetForm, moved to the `launchpad` translation domain and to this repo's lint conventions. `news` is now registered in widgetRegistry.js alongside clock/weather, after the shared-catalog import so it replaces the communal entry while nc-vue still ships one. The content shape is unchanged, so placements authored against the communal form keep rendering. The `itemsEndpoint` injection in widgetDataAdapters.js is dropped — the renderer owns its endpoint now, and leaving it would bind an unused function onto the root element. Comments in WidgetRenderer and ContainerChild that described that seam updated with it.
…260913184413 chore(sync): carry beta back into development
…etForm Prettier had not been run on the new file, and its computed properties/methods were missing the per-method @SPEC tag the rest of the form components carry, which the CI spec-coverage gate requires.
…permission level as its user (#632) * fix(roles): let a signed-in user read their own role GET /api/me/role exists so a user can learn their own LaunchPad role (REQ-ROLE-006: "any authenticated user"), but its action was seeded admin-only, so every user it exists for got HTTP 403 and only admins, whose answer is always "admin", could call it. It returns only the caller's own role, so opening it to @ALL widens nothing. Fresh installs take it from the seed. Existing installs get it from baseline revision 2, which applies ONLY what it added: re-applying the whole baseline would re-broaden every action an admin has since set back to admin-only, because such an entry looks exactly like the pristine default. * test(permissions): pin what each permission level allows, and add principal helpers Nothing tested the rules that decide whether one user may change another's dashboard. PermissionServiceLevelsTest pins them at the service: view_only permits nothing but reading, add_only everything but removing a compulsory widget, full that too, metadata follows ownership rather than level, and a stranger is refused whatever the level says. support/principals.ts provisions accounts over basic auth with an explicit header, because password confirmation expires thirty minutes after login and a session-provisioned account starts 403ing purely because the suite ran late. * test(e2e): probe each permission level as the user who has it, and prove the probe is that user dashboard-permission-levels.spec.ts shares an admin dashboard with a throwaway account at view_only, add_only and full, and checks every refusal three ways: the exact 403, a re-read as admin proving nothing landed, and a control where the same write succeeds for a principal who may make it. Every account and dashboard it creates is removed in afterAll. principals.ts sends basic credentials on every request and carries no storage state, because Playwright only sends httpCredentials after a 401 and an inherited admin session cookie means that challenge never comes: a view-only probe then runs as the admin. assertActingAs() makes that a failed precondition instead of a permission result. The context gets a 60 s budget since every call authenticates from scratch. * test(rbac): count get-my-role as ordinary user surface, not an administrative action ddbe076 opened admin.get-my-role to @ALL because REQ-ROLE-006 says any authenticated user may read their own role, and getMyRole() only ever answers for the caller. ActionAuthBaselineTest still listed it as admin-only, so the full suite failed on the branch. It now sits in BASELINE_ACTIONS, where reverting the seed to admin-only fails the suite.
rubenvdlinde
requested review from
SudoThijn,
WilcoLouwerse,
bbrands02,
remko48 and
rjzondervan
as code owners
September 14, 2026 09:04
…its compulsory flag (#634) * test(enterprise-security): one verdict per scenario, all never built The spec carried a single blanket exclusion over 15 scenarios. Each now carries its own reason. The widget id appears in no commit on any branch under src, lib, appinfo or templates, so every scenario is honestly unbuildable rather than untested, and each reason says what is missing. * fix(role-layout): seed a new user from their role layout, once, with its compulsory flag Four defects, each measured on a live instance with PostgreSQL before the fix. 1. The seeding never ran: getEffectiveDashboard() resolved the instance-wide default group dashboard, seeded on install since #361, before it reached tryCreateFromTemplate(). A user in a group with layout defaults resolved to the shared dashboard and owned nothing. The role path is now tried first, and only for a user who actually has layout defaults. 2. The second user ever to auto-provision got HTTP 500 'Slug must be unique among siblings': root slugs share one namespace across owners and every auto-provisioned dashboard is named 'My Dashboard'. The slug now carries the owner. 3. The hardcoded tile/tile/tile/files set was created on top of the role layout, though the comment beside it called it a fallback. It is a fallback now. 4. isCompulsory was dropped while seeding, so a compulsory role widget arrived removable. REQ-RFP-002 names it. * test(db): pin the role layout seeding against a real database A new user whose group carries RoleLayoutDefault rows is seeded from them, once, with the compulsory flag kept, and a second auto-provisioned user no longer collides on the root slug. Each assertion names one of the four defects fixed in 4782cf9. * fix(phpcs): give tryCreateFromTemplate() its docblock back uniqueRootSlugFor() was inserted between the docblock and the method it documents, which left tryCreateFromTemplate() undocumented and phpcs reporting an error in lib. * fix(role-layout): keep getEffectiveDashboard() under the NPath limit, and never return undefined placements Two findings from the full suite, both introduced on this branch. phpmd: the role layout step added two branches inline and took getEffectiveDashboard() to an NPath of 432 against a threshold of 200. It now lives in resolveRoleLayoutOrDefaultGroupDashboard(), which the method takes as the single step the default group lookup already was. phpstan: tryCreateFromTemplate() started $seeded at false, so with no RoleFeaturePermissionService neither the > 0 nor the === 0 branch ran and $placements was undefined. It starts at 0, the int the seeder returns, and $placements starts empty.
Drops the now-false REQ-NEWS-003 @SPEC anchor from buildRendererExtraProps (it only handles Files now; the requirement's real coverage is server-side in NewsWidgetService), fixes the ContainerChild class docblock that still listed news among the injected data-source widgets, and adds validate() test coverage for NewsWidgetForm (empty URL, non-http(s) URL, blank metadata field key).
feat(news): take ownership of the news widget from nc-vue
…637) Opens the launchpad half of the dossiq competitor parity programme. Cluster 12 of the round 4 discovery sweep: nine candidates built, two recorded as already shipped by iframe-embed-widget and dashboards.
…riq's registry (#641) * docs(openspec): adopt the connection registry for launchpad's six outside connections * feat(connections): declare launchpad's six outside connections for integriq * feat(connections): an Integrations page over integriq's connection registry * feat(connections): report what launchpad's outbound calls met, and refresh after a registry save * test(connections): run the six callers with the real reporter behind them * test(connections): a feed fetch reports only the host, and the spec names the tests that exist * test(connections): an e2e spec for the Integrations page, and integriq in the CI instance * test(connections): close three mutants the reporter tests let through * style(connections): wrap long test lines, and drop a nullsafe call that cannot see null
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR to sync development changes to beta for beta release.
Merging this PR will trigger the beta release workflow.