Develop Canvas to SPA - #7
Open
albertoelias123 wants to merge 1727 commits into
Open
Conversation
* release/6.0.33: doc cleanup api documentation and dependency upgrades compiled assets asset update
v6.0.33 stable release * tag 'v6.0.33':
* 'develop' of github.com:austintoddj/canvas: Apply fixes from StyleCI (#992)
* release/6.0.34: cleanup canvas-ui fixes asset updates Apply fixes from StyleCI (#992) append the read time attribute to posts escape the '$' for both bash and sed fix the proxies issue app and asset url rewrites updating the .env links fixes to the gitpod environment
v6.0.34 stable release * tag 'v6.0.34':
Create SECURITY.md
* release/6.0.35: compile assets updates to repo docs Apply fixes from StyleCI (#1003) Create SECURITY.md
v6.0.35 stable release * tag 'v6.0.35':
* release/6.0.36: use Composer v2.0 on prebuilds updating dependencies
v6.0.36 stable release * tag 'v6.0.36':
…lerts-31 Harden SEO HTML stripping against malformed/unclosed script/style tags
…lerts-34 Fix double-unescaping of HTML entities in stripHtml
Deletes non-informative scaffold, section, and signature-restating comments from PHP and React files, including routes, controllers, requests, UI components, and context modules. This keeps only meaningful domain/tooling comments and improves readability without changing runtime behavior.
Adds explicit `: JsonResponse` return types to the `destroy` methods in `PostController`, `TagController`, and `TopicController` to align method signatures with their actual JSON responses and improve type safety.
Commits AGENTS.md (agent operating rules) by removing it from .gitignore. Updates composer.lock with latest dependency versions: Laravel Framework v13.23.0, Guzzle 7.15.2, Symfony 8.1.2 components, Laravel Pint v1.30.0, PHPStan 2.2.7, and various Symfony polyfill bumps to v1.41.0.
Make PostLifecycle support tests deterministic by freezing Carbon time and using relative publish dates (`now()->subDays(2)`, `now()->addWeek()`). Dataset cases are now wrapped in closures so snapshots are built at execution time, avoiding Pest load-time evaluation that could misclassify live vs scheduled visibility.
Simplifies timezone option computation by removing unnecessary useMemo calls. listTimezoneOptions reads the active dictionary which is already updated on locale switch via CanvasProvider, so memoization adds no value here.
Introduces a dedicated `docs/` host manual with new pages for installation, configuration, authorization, Canvas UI, content, and webhooks, plus a docs index and moved readme image asset. Trims `readme.md` back to a lightweight install overview, refocuses `UPGRADE.md` on breaking-change guidance with links into docs, updates CONTRIBUTING/AGENTS to codify docs ownership, removes the old stub headless guide, and adds an architecture test to ensure the required docs page set remains present.
Give the admin SPA a desktop icon rail: collapse the left nav to a narrow column, keep labels available via tooltips, and play one-shot micro-animations on nav icons. Preference persists in localStorage; mobile stays a full-width drawer. Sidebar chrome - Add useSidebarCollapsed (localStorage key canvas-sidebar-collapsed) and SidebarChromeContext (collapsed vs rail at lg+) - Drive SidebarLayout width/padding transitions and rail-aware SidebarItem/Label/Header/Footer chrome - Port collapse/expand toggle into Layout; hide recent posts and text labels when rail is active - Add Tooltip (portal + placement) for rail nav labels and the collapse control Nav icons & motion - Add sidebar-nav-icons with per-route morph targets - CSS keyframes for rotate/tile/search/posts/mountains/stack/users/awning; honor prefers-reduced-motion i18n, tests & assets - Add nav.collapse / expand (+ aria sidebar) keys across all 17 locales - Vitest coverage for collapse persistence, rail chrome, and tooltip - Rebuild committed resources/dist; package-lock refresh Also - Dashboard “New post” header action uses IconPlus - Docs/AGENTS/UPGRADE table column alignment (formatting only)
Record editorial content snapshots for posts (publish, schedule, update, leave-editor, restore) instead of every autosave, and surface them in the post editor with compare, rename, and restore. Backend - Add canvas_post_revisions migration, PostRevision model/factory, and revisions() on Post - Add PostRevisionController routes for list, show, create, rename, and restore - Record checkpoints via RecordPostRevision + RevisionReason from PostController store (skip live pending autosaves) - Extend PostAuthor with forUserId / mapByUserIds for revision actors without N+1 Frontend - Version history drawer with day grouping, named filter, rename, restore, and title/body diff - Leave-editor checkpoint hook (SPA navigation / tab close) and posts API client types - History control on PostEditorLayout; icon-only stats/settings chrome with tooltips - Tooltip: show on :focus-visible only; dismiss on pointer down so drawer close doesn’t re-open tips i18n & assets - Version history strings across all 17 locales - Rebuild committed resources/dist assets Tests - Pest: PostRevisionController and RecordPostRevision - Vitest: revision history/diff, leave checkpoint, history drawer/control, tooltip focus behavior
Wraps ListRowActionButton and ListRowActionLink with a Tooltip component so row action icons show concise hover tips, while keeping the descriptive aria-label for screen readers. Adds common.delete_aria lang key across all 17 locales and threads label/tooltip props through the Posts, Users, Organize, and Dashboard pages. Rebuilds dist assets and adds a Vitest test covering the new tooltip behavior.
Fire PostPublished (and outbound webhooks) when a scheduled post’s published_at elapses, without requiring another editor save. Hosts still need the Laravel scheduler every minute. - Add canvas:announce-scheduled: chunk live posts missing published_notified_at, lock rows, and dispatch via PostLifecycleEvents::dispatchScheduledWentLive - Add published_notified_at column + index; backfill existing live posts so the first tick does not re-announce - Sync the marker on normal lifecycle writes (set when live, clear when leaving live); hide the column on Post - Add PostSnapshot::asScheduled so classification still sees scheduled → live when the row is already public by the clock - Register the command every minute regardless of CANVAS_MAIL_ENABLED; keep digest gated on mail - Document the command, scheduler table, and corrected webhook behavior in installation/configuration/content/webhooks - Cover announce idempotency, drafts/future schedules, human-publish marker, and schedule registration in Pest - Add internal 7.1 release plan and smoke checklist for this workstream
Give admins visibility into outbound webhook attempts and a safe way to retry failures, instead of relying on queue logs alone. Lifecycle and test deliveries create size-capped history rows (no signing secrets), and hosts can prune old rows on a schedule. Backend - Add canvas_webhook_deliveries migration, model, factory, and status enum - Create pending rows from DispatchOutboundWebhooks and test send; update attempts/outcome in DeliverWebhookJob - Add admin list/show/retry API under integrations (manage-integrations) - Add canvas:prune-webhook-deliveries (30-day default) and weekly schedule registration Admin SPA - Show recent deliveries in the Webhooks drawer with expand detail and retry - Wire integrations API helpers; rebuild resources/dist - Correct scheduled-publish note and add delivery-history copy (all locales) Docs & tests - Document history, retry, and retention in docs/webhooks.md - Update 7.1 release plan and smoke checklist for PR2 - Cover success/failure/retry/prune and delivery helpers with Pest and Vitest
Ship a Calendar page so editors can scan scheduled and published posts by month, with a lean range API, role-aware scope, and full i18n. Backend - Add GET api/calendar/posts with from/to range validation (max 92 days) - Return lean post payloads (id, title, slug, published_at, featured_image, status, author) - Scope mine vs all via canViewAllPosts; only non-null published_at (drafts excluded) - Mark status as scheduled vs published relative to now SPA - Month grid with prev/next/today, day panel, post → editor navigation - Distinct styling for scheduled vs published; mine/all scope when permitted - Sidebar + command palette entry with calendar nav icon animation - Date helpers, calendarApi client, and TypeScript types i18n, tests, dist, docs - Calendar strings across all 17 locales - Pest coverage for range, scope, and permissions; Vitest for month helpers - Rebuild committed resources/dist assets - Mark PR3 complete in 7.1 release plan and expand smoke checklist
Store why each checkpoint was recorded, cap growth at 50 rows per post, and document restore vs pending so version history is production-ready. Backend - Add nullable reason column and cast RevisionReason on PostRevision - Persist reason on every RecordPostRevision create; expose it on lean API payloads - Prune-on-write plus canvas:prune-post-revisions (default keep 50); weekly schedule Admin SPA - Show localized reason (and author) on history rows - i18n reason labels in all locales; rebuild resources/dist Docs & tests - content.md: checkpoints, restore vs pending, leave, public readers, retention - installation/configuration: prune command and scheduler - Pest coverage for reason, restore/leave, prune; Vitest for reason helpers - Mark PR4 complete in the 7.1 release plan and smoke checklist
Move Unsplash, AI, and webhooks from overlay drawers to dedicated routes with a card-based hub, and tighten calendar, posts list, and delivery-history UX for the 7.1 admin polish pass.
Integrations
- Add /integrations/{unsplash,ai,webhooks} routes and page shells with shared IntegrationPageLayout
- Replace IntegrationRow drawers on the index with IntegrationCard grid links
- Refit configure/disconnect UI for page layout; expand webhook delivery history with status and event filters
- Stabilize setIntegrationFlags so unchanged flags do not recreate boot/t and retrigger loads
Calendar & posts
- Keep the month grid when a month is empty; mobile status dots, denser previews, keyboard month nav, and Today pulse
- Add calendarIndexPath helper and a “View calendar” link from the drafts posts list
- Improve posts list filters and row layout on small screens
Navigation & misc UI
- Scroll the document to top on pathname change in AnimatedOutlet
- Layout/a11y polish for media drawers, version history, analytics lists, and related components
i18n, docs & smoke
- Update all 17 locales (new settings/filter copy; prune unused keys)
- Document AGENTS dead-key rules; refresh 7.1 plan/smoke checklist and host install/config/content tables
- Assert 7.1 tables and schedule:list commands in install-smoke
Tests & build
- Vitest coverage for integrations layout, calendar, scroll-to-top, webhooks panel, and related UI
- Playwright specs for calendar and version history; Pest filter for webhook deliveries by event
- Rebuild and commit resources/dist
Surface the tip revision on post show/store so the History control can show relative last-edit copy (by you / by name / time only) instead of a static label. Unseen badges stay deferred; this is tooltip and accessible name only. Backend - Add PostLastRevision helper for the newest checkpoint (id, user_id, created_at, display author; no body) - Attach last_revision on PostController and PostRevisionController payloads - Cover tip selection, null when empty, and body omission in Pest Frontend - Add lastEditTooltip helper and wire lastRevision through Editor and PostEditorLayout - Use last-edit strings for history tooltip and aria-label; fall back when no tip - Vitest for copy cases and layout accessible name i18n - Add editor.history_last_edit* keys in en and every locale Polish - Strip sidebar nav icon morph animations and related CSS - Shorten default tooltip delay (160ms → 50ms)
Stop the calendar Playwright journey from scanning months for title chips (only three chips show per day, so later posts never appear). Drive from the schedule wire payload and deep-link to month/day instead, and wait on the calendar API plus a stable post id hook. Also fix day-panel selection for padding cells: out-of-month days now switch the visible month so the day query is kept. Stabilize the webhooks e2e on the real test endpoint response. Calendar - selectDay advances month for padding cells so day stays selected - data-calendar-post on day-panel rows for reliable open-from-calendar E2E - scheduleForLater returns publishedAt + postId; localDateKeyFromIso helper - calendar spec deep-links and asserts API + panel post id (no month scan) - integrations wait on POST /integrations/webhooks/test, then toast Tests & build - Vitest for out-of-month day selection - Rebuild and commit resources/dist
Reject 6to4, NAT64, and related special-use IPv6 forms that embed or target non-public destinations, unwrap IPv4-mapped addresses, and strip parse_url brackets so IPv6 literals are validated as IPs.
Fix SSRF bypass via IPv6 transition addresses in WebhookUrlValidator
Reject 6to4, NAT64, and related special-use IPv6 forms that embed or target non-public destinations, unwrap IPv4-mapped addresses, and strip parse_url brackets so IPv6 literals are validated as IPs.
* main: Fix SSRF bypass via IPv6 transition addresses in WebhookUrlValidator
Refresh Composer and npm lockfiles to current dependency ranges and rebuild the committed Vite admin assets so the package ships matching hashes. PHP (composer.lock) - Bump laravel/framework 13.24 → 13.25, orchestra/testbench 11.1 → 11.2 - Bump league/commonmark 2.9 → 2.10, nesbot/carbon 3.13.1 → 3.13.2 - Bump laravel/pint 1.30.4 → 1.30.5 and myclabs/deep-copy 1.13 → 1.14 JS (package-lock.json) - Bump TipTap packages 3.29.2 → 3.30.0 - Bump laravel-vite-plugin 3.1.3 → 3.2.0 and typescript-eslint 8.66 → 8.67 - Patch-level testing and tooling updates (jest-dom, user-event, highlight.js, browserslist) Assets - Rebuild resources/dist (new hashed chunks + manifest.json)
Treat Unsplash, AI, and webhooks as Not enabled or Enabled, and probe credentials (or a signed test delivery) before flipping to Enabled. Secrets still persist encrypted; lifecycle webhooks do not fire until a test returns 2xx so HMAC-strict receivers can copy the signing secret first. Backend - Add IntegrationStatus, IntegrationVerifier, and IntegrationVerificationException - Probe Unsplash and AI keys on save (2xx/429 pass; 401/403, timeouts, and unknown models fail without replacing stored secrets) - Persist webhooks.url/secret/events even when the first test fails; mark Enabled only after webhook.test succeeds - Split Webhooks::configured() from hasCredentials()/pending(); leftover pending rows from earlier builds stay Off - Expose status, pending, verify_error, and verified_at on the integrations payload Frontend - Drive cards and page badges from status instead of a configured boolean - Keep webhook secret, deliveries, rotate, and Send test available while credentials are stored but unverified - Show Connecting… while probes run; toast when a save stores credentials but the test fails - Add connecting/pending/verify-failed copy across all 17 locales and rebuild SPA assets Tests & docs - Cover verifier probes, rejected replacements, pending webhooks, and events-only/secret-rotation skipping re-verify - Document the handshake in configuration and webhooks host docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.