The resolver only treated purely numeric references as work package ids,
so semantic identifiers fell through to a typeahead search and failed.
Route both numeric and semantic ids to the show endpoint instead.
Work package results on the search page build their link through the
acts_as_event url proc, which passed the numeric primary key instead of
the work package's display id. In semantic mode this rendered
/work_packages/<id> even though the row showed the semantic identifier,
unlike Rails URL helpers that already resolve the object via to_param.
Pass display_id so the link follows the same convention everywhere.
Sort WP lists by project identifier, not project_id, in semantic mode
The semantic-mode "ID" sort grouped projects by project_id (insertion
order) before the per-project sequence. Projects added after others
landed below them in the list even when their identifier sorted
alphabetically earlier. Sort by projects.identifier instead so the order
matches the visible "<project identifier>-<sequence>" column.
The projects table is already joined for every work-package list query,
so the new sort term costs no extra round-trip.
The `mentioned` and `watcher_changed` text-mailer bodies surfaced raw
journal markdown — numeric `#42` references stayed numeric in semantic
mode, and `<mention>` envelopes leaked as HTML source.
Introduces `:plain_text` as a sibling format inside the existing Plain
module. The filter chain mirrors the markdown pipeline (markdown,
sanitization, mention, pattern-matcher) and finishes with a new
`PlainTextOutputFilter` that collapses the DOM to text. The
`WorkPackages` link handler and `MentionFilter` get plain-text branches
keyed off `context[:plain_text]` so identifier resolution stays in one
place across rich and plain channels.
Closes https://community.openproject.org/wp/74762
Sort work packages by sequence_number in semantic mode
In semantic mode the visible "ID" is `<project_identifier>-<sequence_number>`,
but the list sort key was the database primary key. A work package moved
between projects keeps its primary key and receives a new sequence number
in the target project, so it could appear above natively-created rows with
higher sequence numbers — e.g. `LARGE-3` above `LARGE-1` and `LARGE-2`.
The "ID" sortable on the work-package query select now resolves at request
time. In semantic mode it returns `(work_packages.project_id, work_packages
.sequence_number)`, backed by the existing partial unique index. In classic
mode it stays `work_packages.id`. The Proc resolution lives in
`WorkPackageSelect#sortable` so every consumer (`Query::SortCriteria`,
group-by composition, the HAL/API sortBy resource) sees the resolved value.
Scope semantic-id resolution through `WorkPackage.visible` so a reference to a
work package outside the current user's visibility falls through to literal
text. Without this, semantic identifiers (guessable, project-prefixed) would
disclose existence: a hidden `#PROJ-1` would resolve and render a mention,
whereas a non-existent `#GHOST-1` would fall through — a discoverable oracle.
Spec pins the new contract; matches the in-app preload pipeline which already
uses `WorkPackage.visible`.
Drop the `to_i.to_s` round-trip on the numeric branch. `numeric_id?` already
verifies the matched string is canonical, so the round-trip is a no-op.
Tighten the alias spec to assert the rendered `data-text` carries the current
identifier, not just that the old one is absent. Trim the `render_link`
comment to the load-bearing claim (defence-in-depth escape).
In semantic mode, the PDF text-macro handler resolves `#PROJ-1`,
`##PROJ-1`, and `###PROJ-1` through `find_by_display_id` and emits a
`<mention>` whose `data-id` carries the display id straight through to
the PDF renderer. Cache misses (unknown identifier, deleted WP) fall
through to literal text. Historical aliases resolve to the current
identifier. Classic mode rejects semantic-shape input — `#PROJ-1` in
a classic-mode export stays literal.
Numeric input keeps its current path: the matcher emits the mention
from the matched id without a DB lookup.
`render_link` HTML-escapes both interpolated values. The matcher
regex (`ID_ROUTE_CONSTRAINT`) already constrains shape to
`\d+|[A-Z][A-Z0-9_]*-\d+`, so the escape is defence-in-depth: a
future caller bypassing the matcher cannot regress into HTML
attribute injection.
The fast-path filter `Links.applicable?` matches `/#[A-Z\d]/` so
semantic-only bodies reach the full regex.
Downstream `Exports::PDF::Common::Markdown#wp_mention_macro` is
updated to `find_by_display_id` in PR 23093. This commit must land
after that PR — otherwise its existing `id[/\d+/]; find_by(id:)`
extracts the trailing digits from `data-id="PROJ-7"` and resolves
to WP id 7.
Tom Hykel