274 Commits

Author SHA1 Message Date
Tom Hykel ff6d46b067 Merge pull request #23720 from opf/task/69498-documents-admin-page-type-button-has-a-w
[STC-563] Fix label of new document type button in admin
2026-06-13 17:19:35 +02:00
Tomas Hykel 48b2f9d3ac [OP-18996] fix: Do not adjust capitalization of new document types 2026-06-12 16:20:40 +02:00
Tomas Hykel 4ecd255b59 fix: Documents admin page: "+Type" button has a wrong label ("+Add") (WP #69498) 2026-06-12 13:17:09 +00:00
Oliver Günther d851d25524 Merge remote-tracking branch 'origin/release/17.5' into dev 2026-06-10 11:29:44 +02:00
Kabiru Mwenja bb317278ba Merge pull request #23582 from opf/bug/stc-811-documents-pagination-breaks-upon-filtering-the-list
[STC-811] Fix pagination for filtered Documents & Reserved identifiers
2026-06-09 14:32:29 +03:00
ulferts db815d0d22 Merge remote-tracking branch 'origin/dev' into merge-release/17.5-20260609045502 2026-06-09 09:32:19 +02:00
Wieland Lindenthal 9763ebfeed Fix vertical content jumps in BlockNote editor (#23609)
Fix vertical content jumps in the BlockNote editor on selection

BlockNote 0.51 puts the className we pass to <BlockNoteView>
(`block-note-editor-container`) onto BOTH the outer `.bn-container`
wrapper AND an inner wrapper that does NOT carry `.bn-container`. With
the previous selector matching by class name alone, every rule cascaded
onto both nesting levels — most importantly `display: flex`,
`flex-direction: column-reverse` and `gap: 10px`.

Two flex layouts stacked one inside the other meant that whenever the
side menu / drag handle plugin views re-rendered (which happens every
time the selection moves or the mouse leaves the editor), both layout
calcs ran and the inner wrapper's gap shifted the visible content by a
few pixels.

Tightening the selector to `.block-note-editor-container.bn-container`
restricts the rules to the outer wrapper only; the inner wrapper falls
back to defaults (`display: block`, no gap) and stops contributing to
the layout.

Refs https://community.openproject.org/wp/STC-779

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-09 06:36:17 +02:00
Tomas Hykel 285f3381a9 [STC-811] Fix pagination for filtered Documents & Reserved identifiers 2026-06-05 14:18:05 +02:00
Kabiru Mwenja f12fc7551f Migrate remaining mailers to format_mail_html / format_mail_text (#23387)
The view-helper migration introduced by the parent PR now covers the
remaining mailer surfaces: UserMailer (`message_posted`, `news_added`,
`news_comment_added`), ProjectMailer (`project_created`),
ProjectArtifactsMailer (`creation_wizard_submitted`), MemberMailer
(`added_project`, `updated_project`, `updated_global`), AnnouncementMailer
(`announce`), DocumentsMailer (`document_added`), and the shared mailer
layout (`localized_emails_header`, `localized_emails_footer`).

Sites drop the `static_html: true` / `only_path: false` / `plain_text: true`
boilerplate; `render_mode:` pinning lives in the helper.

The layout previously called `OpenProject::TextFormatting::Renderer.format_text`
directly, bypassing the helper layer. The empty visibility cache (no
current_user-scoped preload at layout time) is handled by the existing
fallback in `LinkHandlers::WorkPackages#text_only?` — covered by a new
sanity spec in `user_mailer_spec.rb` that exercises the header path with
a WP reference and asserts plain-text formatted_id rendering.

Per-bucket regression coverage added: absolute-URL and formatted_id
assertions across both classic and semantic identifier modes, mirroring
the WorkPackageMailer spec pattern.
2026-05-28 12:48:43 +03:00
ihordubas99 6e59a19769 fix: remove overflow auto from bn-editor to prevent card border clipping 2026-05-19 14:27:50 +03:00
Ivan Kuchin bd7a0cfde1 Merge pull request #22930 from opf/fix-multiple-equality-non-equailty-filters
fix multiple equality, non equality filters
2026-05-07 15:52:07 +02:00
Alexander Brandon Coles e8767481e9 [#70166] Fix accessibility errors found by ERB Lint (#21503)
* Fix GitHub/NoTitleAttribute, LinkHasHref errors

- Replaces `title` attribute with `aria-label` for interactive elements.
- Removes `title` from non-interactive elements.
- Converts `<a>` tags without proper `href` to `<button>` elements,
  using Primer `Button`/`IconButton` where possible.

# Conflicts:
#	app/views/custom_fields/_custom_options.html.erb
#	spec/features/admin/custom_fields/shared_custom_field_expectations.rb
#	spec/features/admin/custom_fields/work_packages/list_spec.rb

* Fix Autocomplete missing errors

* Fix GitHub/NoPositiveTabIndex errors

Removes all positive `tabindex` values.

* Fix Rails/LinkToBlank errors

* Replace toast with Primer Banner on LDAP form

* Add frozen_string_literal

* Ignore erb lint for deprecated files

* Fix linting errors in repository module

* Fix linting errors in budgets and custom actions

* Fix linting errors in member form and 2fa

* Fix linting errors in mcost types and wiki help and storages

* Fix linting errors in multi select filters, ifc viewer, and unsupported browser banner

* Fix failing spec

* Use Primer banner instead of op-toast where ever it is possible

* Use octicon instead of op_icon

* Fix failing tests

* Use no-decoration-on-hover for button links and change the button with only an icon to primer icon button

* Keep webhook response modal activation selector class-based

* use icon button for edit of hourly rate

---------

Co-authored-by: Behrokh Satarnejad <b.satarnejad@openproject.com>
2026-05-07 10:31:10 +02:00
Ivan Kuchin 7756f44acc fix multiple equality, non equality filters 2026-05-05 20:33:25 +02:00
Jan Sandbrink 734b049a8a CSS improvements
Improve visual representation of inline macros, by ensuring
they all use the same CSS attributes and have a reduced vertical padding,
so they don't overlap as much.

We also improved the vertical alignment of the leading icon for these macros.

As a sidefind, we replaced a handcrafted version of the InlineMessage with the
existing InlineMessage component. This also improved alignment of the icon.
2026-04-24 11:17:24 +02:00
Oliver Günther b7516040a9 Merge remote-tracking branch 'origin/release/17.3' into dev 2026-04-21 12:07:33 +02:00
Oliver Günther ef6ba24d90 Prevent moving of projects when using documents update service 2026-04-21 12:06:51 +02:00
Kabiru Mwenja 8c0d0c28b1 Merge pull request #22564 from opf/refinements/72665-collaboration-improvements
Collaboration refinements: require HocuspocusProvider, context-aware error messages
2026-04-01 14:15:39 +03:00
Kabiru Mwenja 5e3dd6a1d1 fix(documents): strip invisible characters from document titles
Documents created with zero-width Unicode characters (e.g. U+200B)
in their titles become unclickable on the index page, making them
hard to manage or delete.

Introduce RemoveInvisibleCharacters normalizer, replacing the former
RemoveAsciiControlCharacters. It strips both ASCII control characters
and Unicode zero-width characters, with each category defined as a
named constant for clarity. Apply it to Document#title and update
existing callers (Project#identifier, CustomField#name).

Add a shared RSpec example "strips invisible characters" to verify
normalization consistently across all three models.
2026-03-31 18:18:41 +03:00
ihordubas99 1e09c24945 Implementation/72687 new connection error restore banner v2 (#22591)
---------

Co-authored-by: Kabiru Mwenja <k.mwenja@openproject.com>
2026-03-31 16:25:18 +03:00
Kabiru Mwenja 8272768057 Remove test-mode fallback, require HocuspocusProvider, add context-aware error messages
Extract non-IndexedDB refinements from PR #22125 so they can ship
independently while IndexedDB offline persistence is evaluated separately.

- Gate collaboration on Setting.real_time_text_collaboration_enabled?
  instead of hardcoding it to true
- Remove the test-mode fallback that created a standalone Y.Doc without
  a provider; HocuspocusProvider is now required for document editing
- Refactor useCollaboration hooks: callback-based timeout with proactive
  cancel on sync, extracted useProviderAuthError hook, JSDoc comments
- Add read/write context-aware connection error messages (readonly users
  see "real-time updates will resume" vs writers see "changes will sync")
- Add blocked offline mode: when the server is unreachable and there is
  no local cache, hide the editor entirely to prevent an empty Y.Doc
  from being synced as authoritative content on reconnect
- Update feature specs to use real hocuspocus shared context instead of
  stubbing collaboration_enabled, add offline blocking tests
2026-03-30 16:43:48 +03:00
Behrokh Satarnejad 7014e13d3e Merge pull request #22475 from opf/71063-create-a-pagination-component-based-on-the-primer-specification
[71063] Update PVC with new Pagination component and Banner styles
2026-03-25 14:02:04 +01:00
Kabiru Mwenja 2e596397bb Clarify websocket address is needed 2026-02-23 12:48:57 +03:00
Kabiru Mwenja b22162ecb0 Unify hocuspocus URL validation error message
Use a single I18n message for all invalid URL cases (wrong scheme
and unparseable URLs) so the contract and component show consistent
text to users.
2026-02-23 12:17:06 +03:00
Kabiru Mwenja ab57760873 Add inline form validation on submit 2026-02-23 12:17:05 +03:00
Kabiru Mwenja 7cfe171690 Use inline field validation for invalid hocuspocus URL
Replace the warning banner approach with Primer's inline field
validation (invalid: / validation_message:) on the hocuspocus URL
text field. This shows the error directly on the field when the
current value uses an unsupported protocol, which works for both
env-var-overridden (read-only) and user-submitted values.
2026-02-23 12:17:05 +03:00
Kabiru Mwenja e8250a7729 Add hocuspocus URL env var sticky error banner validation 2026-02-23 12:17:04 +03:00
Kabiru Mwenja 878906ded4 Add URL scheme validation for hocuspocus server URL
Adds contract-level validation to ensure the collaborative editing
hocuspocus URL only accepts WebSocket protocols (ws://, wss://).
Previously, misconfiguration with https:// would silently cause
Content Security Policy errors at runtime.

https://community.openproject.org/wp/71888
2026-02-23 12:17:04 +03:00
Klaus Zanders a3257f3e59 Merge branch 'dev' into merge-release/17.1-20260218130400 2026-02-18 14:13:12 +01:00
Klaus Zanders a4c5723825 Do not expose invisible users via render_avatars 2026-02-18 12:40:16 +01:00
Klaus Zanders b315153e47 Merge branch 'dev' into merge-release/17.1-20260217115326 2026-02-17 12:54:17 +01:00
Kabiru Mwenja 4daa893d50 Bug/71877 Default document types are recreated after every OpenProject update (#21992)
Fix default document types recreated after every update

The Documents TypeSeeder overrode applicable? with a count <= 3
heuristic that was too permissive: users who deleted unwanted types
dropped below the threshold, causing the seeder to recreate them on
every subsequent update.

Remove the custom applicable? overrides, falling back to ModelSeeder
defaults which only seed when the table is empty. The 17.0 migration
already handles upgrading old DocumentCategory enumerations.

https://community.openproject.org/wp/71877
2026-02-17 12:36:53 +03:00
Klaus Zanders c65c97678e Fix loading in refresh tokens controller 2026-02-10 14:03:19 +01:00
Klaus Zanders ca5e934da9 Merge branch 'dev' into more-visible-scopes 2026-02-10 13:27:01 +01:00
Kabiru Mwenja 7cbc023669 Merge pull request #21738 from opf/bug/70362-documents-token-refresh
Implement auth token refresh for collaborative documents
2026-02-09 18:05:13 +03:00
Klaus Zanders 466a6ac81b Fox more specs and controllers 2026-02-09 15:08:09 +01:00
Klaus Zanders b4dcdf467e Remove generic find methods in controllers 2026-02-09 15:07:52 +01:00
Oliver Günther 6c2b98c449 Merge pull request #21844 from opf/fix/external-link-capture
Use stimulus controller for external link capture
2026-02-03 14:41:17 +01:00
Oliver Günther 1857f25b58 Primerize static link helper and use that for external links consistently 2026-02-03 11:41:43 +01:00
Alexander Brandon Coles d4780dfbb0 [#71327] Do not set draggable=true unless HTML5 DnD
`draggable="true"` enables HTML5 Drag and Drop, which conflicts with the
Dragula-based implementation used by `GenericDragAndDropController`.

https://community.openproject.org/wp/71327
2026-02-02 17:33:41 -03:00
Kabiru Mwenja 2e05672bff Remove unused expires_at attribute from dom 2026-01-26 20:56:12 +03:00
Kabiru Mwenja 6cdab7b170 Remove documents refresh token from oauth route
Documents refresh tokens are not OAuth specifi; they are session bound
and hence do not fit correctly within the "oauth" route
2026-01-26 20:18:48 +03:00
Kabiru Mwenja 170bbbbf5c Revert "Remove unused expires_at field from token refresh flow"
This reverts commit 81549eef51.
2026-01-26 18:36:56 +03:00
Kabiru Mwenja 7d9bea6866 Refine token services 2026-01-22 12:48:34 +03:00
Henriette Darge 017b0a42e3 Remove outdated code 2026-01-22 10:43:39 +01:00
Kabiru Mwenja 3f6fd0284a Merge branch 'dev' into code-maintenance/68833-provide-a-standardized-page-layout-for-full-view-pages-like-document-full-view-2 2026-01-22 11:58:55 +03:00
Kabiru Mwenja 81549eef51 Remove unused expires_at field from token refresh flow 2026-01-21 19:53:34 +03:00
Kabiru Mwenja 56ac78da8d Filter refresh token response to only include relevant fields
Apply least privilege principle: RefreshTokensController now returns
only encrypted_token, expires_at, and expires_in_seconds. Excludes
resource_url and readonly which are only needed for initial page load.
2026-01-21 19:53:23 +03:00
Kabiru Mwenja 08f0c4c8e9 Merge in packaged token payload 2026-01-21 19:26:28 +03:00
Kabiru Mwenja 0bfc130577 Implement OAuth token refresh for collaborative documents
Client proactively refreshes tokens before expiry using session auth,
then sends new token to Hocuspocus server via stateless channel.

Token strategy: 5min access tokens, refresh at 80% lifetime (~4min),
session-based refresh (no refresh tokens needed).

Flow:
```
Client                              OpenProject                         Hocuspocus
  │                                      │                                   │
  │── initial token ─────────────────────┼──────────────────────────────────►│ onAuthenticate
  │                                      │                                   │
  │  [timer: 80% of expiry]              │                                   │
  │                                      │                                   │
  │── POST /documents/{id}/oauth/refresh_token ─►│                           │
  │◄─────────────── {token, expires_at} ─│                                   │
  │                                      │                                   │
  │── sendStateless(REFRESH:<token>) ────┼──────────────────────────────────►│ onStateless
  │                                      │                                   │ (update context.token)
```

* https://community.openproject.org/wp/68460
* https://community.openproject.org/wp/70362
2026-01-21 18:56:02 +03:00
Bruno Pagno 0aff9ebd62 simplify packaging collaborative sign in parameters 2026-01-19 15:07:48 +01:00