feat(advanced-template-management): implement spec (#153)#186
feat(advanced-template-management): implement spec (#153)#186rubenvdlinde wants to merge 4 commits into
Conversation
Quality Report — ConductionNL/docudesk @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ❌ | ||||
| stylelint | ❌ | ||||
| composer | ✅ | ✅ 108/108 | |||
| npm | ❌ | ❌ | |||
| PHPUnit | ⏭️ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ |
Quality workflow — 2026-05-18 19:16 UTC
Download the full PDF report from the workflow artifacts.
Code Review — Juan Claude van DammeResult: PASS (5 fixed, 0 blocking unfixed, 2 security advisories → Clyde) Fixes applied
Security advisories → Clyde
Checks skipped (environment)
AdvisoriesMCP coverage (advisory) — This app does not yet publish an 🤖 Changes Juan Claude van Damme applied
View full diff · 8 files changed, 119 insertions(+), 7 deletions(-) |
|
📍 [fixed: merge conflict resolved] Kept PR branch version |
| :placeholder="t('docudesk', 'e.g. zaaktype')" /> | ||
| <NcSelect v-model="condOp" | ||
| :options="opOptions" | ||
| :input-label="t('docudesk', 'Operator')" /> |
There was a problem hiding this comment.
[fixed: vue/attribute-hyphenation] :inputLabel → :input-label — Vue attribute binding names must be hyphenated per ESLint rule.
| :label="t('docudesk', 'Field name')" | ||
| :placeholder="t('docudesk', 'e.g. name, address, date')" /> | ||
| <p class="merge-field-dialog__hint"> | ||
| {{ insertHint }} |
There was a problem hiding this comment.
[fixed: vue/no-parsing-error] The Jinja2 placeholder {{ fieldName }} inside a Vue template mustache expression {{ t(..., '… {{ fieldName }} …', ...) }} caused eslint-plugin-vue's parser to see a nested expression start. Moved the string-building to a computed property insertHint — template now reads {{ insertHint }} which is clean.
| contenteditable="true" | ||
| :aria-label="t('docudesk', 'Template content')" | ||
| @input="syncFromEditor" | ||
| v-html="editorHtml" /> |
There was a problem hiding this comment.
[unfixed: SUGGESTION — security escalated to Clyde] vue/no-v-html: v-html on previewHtml can enable XSS if the content is not sanitized. Template preview rendering requires HTML output — security reviewer to confirm sanitization.
| <!-- eslint-disable-next-line vue/no-v-html --> | ||
| <div v-else-if="previewHtml" | ||
| class="template-detail__preview-output" | ||
| v-html="previewHtml" /> |
There was a problem hiding this comment.
[unfixed: SUGGESTION — security escalated to Clyde] vue/no-v-html: v-html on editorHtml binding. Security reviewer to verify source and sanitization of this value.
| try { | ||
| this.previewHtml = await this.templateStore.previewTemplate( | ||
| this.form.content, | ||
| sampleData, |
There was a problem hiding this comment.
[fixed: comma-dangle] Added missing trailing commas in multi-line function call arguments at lines 346, 366, and 397 per ESLint comma-dangle rule.
| <NcSelect v-model="selectedCategory" | ||
| :options="categoryOptions" | ||
| :placeholder="t('docudesk', 'Filter by category')" | ||
| :input-label="t('docudesk', 'Category filter')" |
There was a problem hiding this comment.
[fixed: vue/attribute-hyphenation + comma-dangle] :inputLabel → :input-label; added missing trailing comma at line 106.
…gories, locking (#153) Implements advanced template management features across backend (already implemented) and frontend: full WYSIWYG editor, category/tag filtering, version history, conditional section UI, edit locking, and preview. Adds templateVersion schema to register and comprehensive unit tests for TemplateVersionService and TemplatePreviewService. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Quality Report — ConductionNL/docudesk @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| composer | ✅ | ✅ 108/108 | |||
| npm | ✅ | ✅ 529/529 | |||
| PHPUnit | ✅ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ |
Coverage: 0% (0/10 statements)
Quality workflow — 2026-05-19 03:10 UTC
Download the full PDF report from the workflow artifacts.
Security Review — Clyde BarcodeResult: PASS (1 fixed, 0 unfixed blocking)
Fix applied[fixed: HTML attribute escaping in insertConditionalSection] Out-of-scope inherited debt (informational, non-blocking)
See inline comments for per-finding detail. 🤖 Changes Clyde Barcode applied
View full diff · 1 file changed, 4 insertions(+), 3 deletions(-) |
| document.execCommand('insertText', false, token) | ||
| this.syncFromEditor() | ||
| }, | ||
| insertConditionalSection({ field, op, value }) { |
There was a problem hiding this comment.
[fixed: HTML attribute escaping] Rule: OWASP A03:2021 / CWE-79 — user-controlled field, op, value were interpolated directly into HTML attribute strings passed to document.execCommand('insertHTML'). A value containing " breaks attribute context; event handlers inject DOM XSS persisted in the template content. Fixed by adding an inline esc() helper that encodes &, ", <, > before interpolation. Semgrep self-verify passed post-fix.
rubenvdlinde
force-pushed
the
feature/153/advanced-template-management
branch
from
f4f6ccc to
b292df4
Compare
Quality Report — ConductionNL/docudesk @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ⏭️ | ||||
| phpcs | ⏭️ | ||||
| phpmd | ⏭️ | ||||
| psalm | ⏭️ | ||||
| phpstan | ⏭️ | ||||
| phpmetrics | ⏭️ | ||||
| eslint | ⏭️ | ||||
| stylelint | ⏭️ | ||||
| composer | ⏭️ | ⏭️ | |||
| npm | ⏭️ | ⏭️ | |||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ |
Quality workflow — 2026-05-19 03:19 UTC
Download the full PDF report from the workflow artifacts.
Quality Report — ConductionNL/docudesk @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ❌ | ||||
| stylelint | ✅ | ||||
| composer | ✅ | ✅ 108/108 | |||
| npm | ✅ | ✅ 529/529 | |||
| PHPUnit | ✅ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ |
Coverage: 0% (0/10 statements)
Quality workflow — 2026-05-19 03:24 UTC
Download the full PDF report from the workflow artifacts.
…ache in t() string)
Quality Report — ConductionNL/docudesk @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| composer | ✅ | ✅ 108/108 | |||
| npm | ✅ | ✅ 529/529 | |||
| PHPUnit | ✅ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ |
Coverage: 0% (0/10 statements)
Quality workflow — 2026-05-19 04:04 UTC
Download the full PDF report from the workflow artifacts.
1 participant
Closes #153
Summary
Auto-generated draft PR for OpenSpec change
advanced-template-management.The Hydra builder ran the spec but could not run
gh pr createitself(Phase D+E credential strip — Claude has no
GH_TOKENby design).The entrypoint detected commits on the feature branch with no PR and
created this draft so the reviewer + security + applier can proceed.
Spec Reference
/spec//spec/proposal.mdCommits on this branch
Files changed
lib/Settings/docudesk_register.jsonopenspec/changes/advanced-template-management/design.mdopenspec/changes/advanced-template-management/tasks.mdsrc/dialogs/ConditionalSectionDialog.vuesrc/dialogs/MergeFieldDialog.vuesrc/views/templates/TemplateDetail.vuesrc/views/templates/TemplateIndex.vuetask-audit.jsontests/bootstrap-standalone.phptests/stubs/OpenRegisterStubs.phptests/unit/Service/TemplatePreviewServiceTest.phptests/unit/Service/TemplateVersionServiceTest.phpPR auto-created by Hydra builder entrypoint (
hydra_ensure_pr_exists)because Claude's session closed without running
gh pr create.Reviewer + applier follow as normal.