Release: merge development into beta

.coverage-baseline

@@ -0,0 +1 @@
+55.79

.doriath-csp.mjs

@@ -0,0 +1,16 @@
+import { chromium } from '@playwright/test'
+const BASE='http://localhost:8088'
+const b=await chromium.launch(); const c=await b.newContext(); const p=await c.newPage()
+let csp=null
+p.on('response',r=>{ if(r.url().endsWith('/apps/doriath/') || r.url().includes('/apps/doriath/#')) { const h=r.headers(); if(h['content-security-policy']) csp=h['content-security-policy'] } })
+await p.goto(`${BASE}/index.php/login`,{waitUntil:'domcontentloaded'})
+await p.locator('input[name="user"]').fill('admin'); await p.locator('input[name="password"]').fill('admin')
+await p.locator('button[type="submit"]').first().click(); await p.waitForSelector('#header',{timeout:30000})
+const resp = await p.goto(`${BASE}/index.php/apps/doriath/`,{waitUntil:'domcontentloaded'})
+const h = resp.headers()['content-security-policy'] || '(none)'
+console.log('CSP on the doriath SPA page:')
+console.log(h)
+console.log()
+console.log("contains 'wasm-unsafe-eval':", h.includes('wasm-unsafe-eval'))
+console.log("contains 'unsafe-eval':", /(?<!wasm-)unsafe-eval/.test(h))
+await b.close()

.doriath-detail.mjs

@@ -0,0 +1,30 @@
+import { chromium } from '@playwright/test'
+const BASE='http://localhost:8088'
+const b=await chromium.launch(); const c=await b.newContext(); const p=await c.newPage()
+const errs=[]; p.on('pageerror',e=>errs.push(String(e).slice(0,200)))
+p.on('console',m=>{if(m.type()==='error')errs.push('c:'+m.text().slice(0,160))})
+await p.goto(`${BASE}/index.php/login`,{waitUntil:'domcontentloaded'})
+await p.locator('input[name="user"]').fill('admin'); await p.locator('input[name="password"]').fill('admin')
+await p.locator('button[type="submit"]').first().click(); await p.waitForSelector('#header',{timeout:30000})
+await p.goto(`${BASE}/index.php/apps/doriath/`,{waitUntil:'domcontentloaded'}); await p.waitForTimeout(3000)
+await p.locator('.lock-screen input[type="password"]').first().fill('Oj',{force:true}); await p.waitForTimeout(400)
+await p.evaluate(()=>{const bs=[...document.querySelectorAll('.lock-screen button')];const u=bs.find(b=>/Unlock/i.test(b.textContent||''));if(u)u.click()})
+await p.waitForTimeout(4000)
+await p.evaluate(()=>{const as=[...document.querySelectorAll('.app-navigation a')];const v=as.find(a=>/Vault/i.test(a.textContent||''));if(v)v.click()})
+await p.waitForTimeout(3000)
+errs.length=0
+const rows = await p.locator('.secret-list-item, [data-testid="secret-row"]').count()
+console.log('secret rows:', rows)
+await p.evaluate(()=>{const r=document.querySelector('.secret-list-item');if(r)r.click()})
+await p.waitForTimeout(3500)
+console.log('url:',p.url())
+const probe = await p.evaluate(()=>({
+  detail: !!document.querySelector('.secret-detail'),
+  pwField: document.querySelectorAll('.secret-detail .doriath-password-field').length,
+  pwInput: document.querySelectorAll('.secret-detail .doriath-password-field input').length,
+  anyInput: document.querySelectorAll('.secret-detail input').length,
+  detailText: (document.querySelector('.secret-detail')?.innerText||'').slice(0,200)
+}))
+console.log(JSON.stringify(probe,null,1))
+console.log('errors:', errs.slice(0,5))
+await b.close()

.doriath-href.mjs

@@ -0,0 +1,17 @@
+import { chromium } from '@playwright/test'
+const BASE='http://localhost:8088'
+const b=await chromium.launch(); const c=await b.newContext(); const p=await c.newPage()
+await p.goto(`${BASE}/index.php/login`,{waitUntil:'domcontentloaded'})
+await p.locator('input[name="user"]').fill('admin')
+await p.locator('input[name="password"]').fill('admin')
+await p.locator('button[type="submit"]').first().click()
+await p.waitForSelector('#header',{timeout:30000})
+await p.goto(`${BASE}/index.php/apps/doriath/`,{waitUntil:'domcontentloaded'})
+await p.waitForTimeout(4000)
+const r = await p.evaluate(() => {
+  const nav = document.querySelector('.app-navigation')
+  const as = nav ? Array.from(nav.querySelectorAll('a')) : []
+  return { navPresent: !!nav, hrefs: as.slice(0,10).map(a => a.getAttribute('href')), texts: as.slice(0,10).map(a=>(a.textContent||'').trim().slice(0,20)) }
+})
+console.log(JSON.stringify(r,null,1))
+await b.close()

.doriath-nav.mjs

@@ -0,0 +1,23 @@
+import { chromium } from '@playwright/test'
+const BASE='http://localhost:8088'
+const b=await chromium.launch(); const c=await b.newContext(); const p=await c.newPage()
+await p.goto(`${BASE}/index.php/login`,{waitUntil:'domcontentloaded'})
+await p.locator('input[name="user"]').fill('admin')
+await p.locator('input[name="password"]').fill('admin')
+await p.locator('button[type="submit"]').first().click()
+await p.waitForSelector('#header',{timeout:30000})
+await p.goto(`${BASE}/index.php/apps/doriath/`,{waitUntil:'domcontentloaded'})
+await p.waitForTimeout(3000)
+// unlock with the seeded dev master password
+await p.locator('.lock-screen input[type="password"]').first().fill('Oj',{force:true})
+await p.waitForTimeout(400)
+await p.evaluate(()=>{const bs=[...document.querySelectorAll('.lock-screen button')];const u=bs.find(b=>/Unlock/i.test(b.textContent||''));if(u)u.click()})
+await p.waitForTimeout(4000)
+console.log('after unlock, lock-screen count:', await p.locator('.lock-screen').count())
+console.log('url:', p.url())
+// click the Vault nav entry natively and see if the route changes
+await p.evaluate(()=>{const as=[...document.querySelectorAll('.app-navigation a')];const v=as.find(a=>/Vault/i.test(a.textContent||''));if(v)v.click()})
+await p.waitForTimeout(2500)
+console.log('after clicking Vault -> url:', p.url())
+console.log('secret-list present:', await p.locator('[data-testid="secret-list-view"], .secret-list-view').count())
+await b.close()

.doriath-neterr.mjs

@@ -0,0 +1,17 @@
+import { chromium } from '@playwright/test'
+const BASE = 'http://localhost:8088'
+const b = await chromium.launch(); const c = await b.newContext(); const p = await c.newPage()
+const bad = []
+p.on('response', r => { if (r.status() >= 400) bad.push(`${r.status()} ${r.request().method()} ${r.url()}`) })
+await p.goto(`${BASE}/index.php/login`, { waitUntil: 'domcontentloaded' })
+await p.locator('input[name="user"]').fill('admin')
+await p.locator('input[name="password"]').fill('admin')
+await p.locator('button[type="submit"]').first().click()
+await p.waitForSelector('#header', { timeout: 30000 })
+bad.length = 0
+await p.goto(`${BASE}/index.php/apps/doriath/`, { waitUntil: 'domcontentloaded' })
+await p.waitForTimeout(6000)
+console.log('--- failing requests on app root ---')
+bad.forEach(x => console.log(x))
+console.log('--- doriath-owned failures:', bad.filter(x => x.includes('/doriath')).length)
+await b.close()

.doriath-share.mjs

@@ -0,0 +1,30 @@
+import { chromium } from '@playwright/test'
+const BASE='http://localhost:8088'
+const b=await chromium.launch(); const c=await b.newContext(); const p=await c.newPage()
+const errs=[]; const reqs=[]
+p.on('pageerror',e=>errs.push('PE:'+String(e).slice(0,220)))
+p.on('console',m=>{if(m.type()==='error')errs.push('C:'+m.text().slice(0,220))})
+p.on('response',r=>{if(r.url().includes('/doriath/'))reqs.push(`${r.status()} ${r.request().method()} ${r.url().replace(BASE,'')}`)})
+await p.goto(`${BASE}/index.php/login`,{waitUntil:'domcontentloaded'})
+await p.locator('input[name="user"]').fill('admin'); await p.locator('input[name="password"]').fill('admin')
+await p.locator('button[type="submit"]').first().click(); await p.waitForSelector('#header',{timeout:30000})
+await p.goto(`${BASE}/index.php/apps/doriath/`,{waitUntil:'domcontentloaded'}); await p.waitForTimeout(2500)
+await p.locator('.lock-screen input[type="password"]').first().fill('Oj',{force:true}); await p.waitForTimeout(400)
+await p.evaluate(()=>{const bs=[...document.querySelectorAll('.lock-screen button')];const u=bs.find(b=>/Unlock/i.test(b.textContent||''));if(u)u.click()})
+await p.waitForTimeout(3500)
+await p.evaluate(()=>{const as=[...document.querySelectorAll('.app-navigation a')];const v=as.find(a=>/Vault/i.test(a.textContent||''));if(v)v.click()})
+await p.waitForTimeout(2500)
+await p.evaluate(()=>{const r=document.querySelector('.secret-list-item');if(r)r.click()})
+await p.waitForTimeout(2500)
+await p.evaluate(()=>{const bs=[...document.querySelectorAll('.secret-detail__actions button')];const s=bs.find(b=>/Share/i.test(b.textContent||''));if(s)s.click()})
+await p.waitForTimeout(2000)
+console.log('share-dialog present:', await p.locator('.share-dialog').count())
+const btns = await p.evaluate(()=>[...document.querySelectorAll('body button')].map(b=>(b.textContent||'').trim()).filter(Boolean).slice(0,25))
+console.log('buttons:', JSON.stringify(btns))
+errs.length=0; reqs.length=0
+await p.evaluate(()=>{const bs=[...document.querySelectorAll('body button')];const s=bs.find(b=>/Create link/i.test(b.textContent||''));if(s)s.click(); else console.error('NO CREATE LINK BUTTON')})
+await p.waitForTimeout(5000)
+console.log('reveal present:', await p.locator('.share-dialog__reveal').count())
+console.log('requests:', reqs)
+console.log('errors:', errs.slice(0,6))
+await b.close()

.editorconfig

@@ -0,0 +1,36 @@
+# https://editorconfig.org
+
+# SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = tab
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size = 2
+indent_style = space
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.svg]
+insert_final_newline = false
+
+[package*.json]
+indent_size = 2
+indent_style = space
+
+[build/psalm-baseline.xml]
+indent_size = 2
+indent_style = space
+
+[config/*config.php]
+indent_size = 2
+indent_style = space

.forgejo/workflows/pre-merge-check-strict.yaml

@@ -32,6 +32,10 @@ jobs:
           apt-get install -y --no-install-recommends \
             git curl ca-certificates gnupg jq unzip zip \
             libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
           docker-php-ext-install -j"$(nproc)" zip gd
           curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
 

.forgejo/workflows/tests.yml

@@ -75,6 +75,10 @@ jobs:
           apt-get install -y --no-install-recommends \
             git curl ca-certificates gnupg jq unzip zip \
             libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
           docker-php-ext-install -j"$(nproc)" zip gd
           curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
 
@@ -105,6 +109,30 @@ jobs:
       - name: Assert every t() source string is in l10n/en.json
         run: node tests/l10n/check-l10n.js
 
+  # ---------------------------------------------------------------------------
+  # HARD GATE 3 — frontend unit suite (Vitest, OFFLINE; no NC needed).
+  #
+  # Runs the pure-logic Vitest suite under tests/vitest/** (Pinia store
+  # state transitions, util/formatter calc, form-validation mappers, and any
+  # offline component mounts). These need no DOM/NC runtime — @nextcloud/* and
+  # @conduction/nextcloud-vue are aliased to deterministic stubs in
+  # vitest.config.js. Always gating.
+  # ---------------------------------------------------------------------------
+  frontend-unit:
+    name: Frontend unit (Vitest — ${{ inputs.app-id }})
+    runs-on: codeberg-medium
+    container:
+      image: node:${{ inputs.node-version }}
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Install npm deps
+        run: npm ci --legacy-peer-deps || npm install --legacy-peer-deps
+
+      - name: Run Vitest unit suite
+        run: npm run test:unit
+
   # ---------------------------------------------------------------------------
   # COVERAGE GATE A — PHPUnit COVERAGE RATCHET (PCOV clover line coverage).
   # Fails a PR that drops backend coverage below tests/.coverage-baseline.json
@@ -125,6 +153,10 @@ jobs:
           apt-get install -y --no-install-recommends \
             git curl ca-certificates gnupg jq unzip zip \
             libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
           docker-php-ext-install -j"$(nproc)" zip gd
           curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
 

.git-blame-ignore-revs

@@ -0,0 +1,16 @@
+# Revisions to skip in `git blame`.
+#
+# Enable locally, once:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# GitHub reads this file automatically. Your terminal does not, until you run
+# the line above.
+#
+# Only ever add commits that change formatting and NOTHING else. A commit listed
+# here becomes invisible to blame, so a behaviour change hidden inside one would
+# be very hard to find later.
+
+# style: reformat with nextcloud/coding-standard — whitespace only
+# The fleet-wide move from a PEAR-derived PHPCS ruleset (4 spaces, next-line
+# braces) to Nextcloud's own standard (tabs, same-line braces).
+8f2ab30687aaf70359a4c7383765e8144232a0ba

.githooks/pre-commit

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Committed pre-commit hook (activated via `git config core.hooksPath .githooks`,
+# which `npm install` / `composer install` set automatically — see package.json
+# "prepare" and composer.json "post-install-cmd").
+#
+# Regenerates docs/features.json whenever staged changes touch openspec/specs/
+# or the features overlay, so the commercial capability list can never go
+# stale. CI (features-check / features-extract) only VERIFIES — generation
+# happens here, before the commit, never in the pipeline.
+#
+# Best-effort by design: any failure only warns and never blocks the commit —
+# the CI gate is the enforcement backstop.
+
+if git diff --cached --name-only | grep -qE "^openspec/(specs/|features\.overlay\.json)"; then
+  CACHE=".git/extract-features.py"
+  # Fetch the canonical script (single source of truth in ConductionNL/.github);
+  # fall back to a previously cached copy when offline.
+  curl -sf --max-time 10 \
+    https://raw.githubusercontent.com/ConductionNL/.github/main/scripts/extract-features.py \
+    -o "$CACHE" 2>/dev/null || true
+
+  if [ -f "$CACHE" ]; then
+    if command -v python3 >/dev/null 2>&1; then PY="python3";
+    elif command -v py >/dev/null 2>&1; then PY="py -3";
+    else PY="python"; fi
+
+    if $PY "$CACHE" --app-root . >/dev/null 2>&1; then
+      git add docs/features.json
+      echo "pre-commit: docs/features.json regenerated from openspec/specs/."
+    else
+      echo "pre-commit: WARNING — could not regenerate docs/features.json (python or pyyaml missing?). CI features-check will verify." >&2
+    fi
+  else
+    echo "pre-commit: WARNING — could not fetch extract-features.py (offline?). CI features-check will verify." >&2
+  fi
+fi
+
+exit 0

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+
+# This repo had no dependabot.yml at all — Dependabot was not configured for
+# any ecosystem. Scoped narrowly here to what the fleet-wide composer
+# cooldown rollout needs: a composer entry meeting the floor new gate 93
+# (composer-cooldown-config) enforces. Adding npm/github-actions coverage
+# for this repo is a separate decision, not folded in here.
+updates:
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 2
+      include:
+        - "*"
+      exclude:
+        - "conduction/*"

.github/workflows/branch-protection.yml

@@ -4,7 +4,11 @@ on:
   pull_request:
     branches: [main, beta]
 
+permissions: {}
+
 jobs:
-  protect:
-    uses: Conduction/.github/.github/workflows/branch-protection.yml@main
-    secrets: inherit
+  # Job id must stay `branch-protection` so the check reports as
+  # `branch-protection / check-branch`, which is the context name the org
+  # ruleset requires.
+  branch-protection:
+    uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main