collavre 0.23.0 → 0.24.0

data/app/controllers/collavre/concerns/slide_viewable.rb

@@ -134,45 +134,21 @@ module Collavre
         result
       end
 
-      # Mirrors the access check in Creative#children_with_permission, but
-      # operates on a pre-fetched set of candidate children so the work
-      # collapses to a fixed number of queries instead of one per parent.
+      # Mirrors the access check in Creative#children_with_permission via the
+      # single PermissionFilter read path: the deny-invariant (owner wins, user
+      # entry incl. no_access beats public) is served by #readable_ids, and the
+      # "a user always sees their own children" listing policy is preserved as an
+      # explicit union — identical to children_with_permission's shape, including
+      # the owned-shell-with-unreadable-origin case readable_ids gates out.
       def accessible_child_ids(candidate_ids, candidate_children, user)
         return Set.new if candidate_ids.empty?
 
-        min_rank = CreativeShare.permissions["read"]
-        accessible = Set.new
+        filter = Collavre::Creatives::PermissionFilter.new(user: user)
+        accessible = filter.readable_ids(candidate_ids, min_permission: :read).to_set
 
         if user
-          user_entries = CreativeSharesCache
-            .where(creative_id: candidate_ids, user_id: user.id)
-            .pluck(:creative_id, :permission)
-
-          user_has_entry = Set.new
-          user_entries.each do |cid, perm|
-            user_has_entry << cid
-            perm_rank = CreativeSharesCache.permissions[perm]
-            if perm_rank && perm_rank >= min_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
-              accessible << cid
-            end
-          end
-
-          public_accessible = CreativeSharesCache
-            .where(creative_id: candidate_ids, user_id: nil)
-            .where("permission >= ?", min_rank)
-            .where.not(permission: :no_access)
-            .pluck(:creative_id)
-          accessible.merge(public_accessible.reject { |cid| user_has_entry.include?(cid) })
-
           owned_ids = candidate_children.select { |c| c.user_id == user.id }.map(&:id)
           accessible.merge(owned_ids)
-        else
-          public_accessible = CreativeSharesCache
-            .where(creative_id: candidate_ids, user_id: nil)
-            .where("permission >= ?", min_rank)
-            .where.not(permission: :no_access)
-            .pluck(:creative_id)
-          accessible.merge(public_accessible)
         end
 
         accessible

data/app/controllers/collavre/creatives_controller.rb

@@ -6,8 +6,15 @@ module Collavre
     include Collavre::Concerns::Shareable
     include Collavre::CreativePermissionGuard
 
-    # TODO: for not for security reasons for this Collavre app, we don't expose to public, later it should be controlled by roles for each Creatives
-    # Removed unauthenticated access to index and show actions
+    # Authorization for these read actions is not open-to-public: each action
+    # enforces per-Creative read access via has_permission?(Current.user, :read)
+    # (index/children go through Creatives::IndexQuery, which permission-filters;
+    # show/slide_view/export_markdown check has_permission? directly). Anonymous
+    # requests only ever see Creatives whose share grants public read. Requiring
+    # a login for all reads is gated by SystemSetting.creatives_login_required?
+    # via enforce_creatives_login_policy below. A broader per-Creative role model
+    # (beyond the read/feedback/write/admin share levels) is a product decision
+    # tracked separately and intentionally deferred.
     allow_unauthenticated_access only: %i[ index children export_markdown show slide_view ]
     before_action :enforce_creatives_login_policy, only: %i[ index children export_markdown show slide_view ]
     before_action :set_creative, only: %i[ show edit update destroy parent_suggestions slide_view request_permission unconvert contexts update_contexts update_metadata archive unarchive trigger_action ]
@@ -39,7 +46,7 @@ module Collavre
           else
             {}
           end
-          index_result = ::Creatives::IndexQuery.new(user: Current.user, params: params.to_unsafe_h).call
+          index_result = ::Creatives::IndexQuery.new(user: Current.user, params: index_query_params).call
           @creatives = index_result.creatives || []
           @parent_creative = index_result.parent_creative
           @shared_creative = index_result.shared_creative
@@ -407,7 +414,7 @@ module Collavre
       # concurrent markdown edit. "editor" must be reserved too: dropping it would erase the "rich"
       # authoring flag and make a Lexical-authored creative reopen in the advanced textarea.
       current_data = creative.data || {}
-      %w[markdown_source content_type editor].each do |key|
+      Collavre::Creative.reserved_metadata_keys.each do |key|
         if current_data.key?(key)
           new_data[key] = current_data[key]
         else
@@ -557,6 +564,19 @@ module Collavre
         params.require(:creative).permit(:description, :progress, :parent_id, :sequence, :origin_id, :markdown_source, :content_type_input, :markdown_editor)
       end
 
+      # Whitelist of query parameters consumed by Creatives::IndexQuery and its
+      # FilterPipeline. Passing an explicitly permitted hash (rather than
+      # params.to_unsafe_h) keeps arbitrary client-supplied keys out of the
+      # query layer while preserving every filter the index endpoint supports.
+      def index_query_params
+        params.permit(
+          :id, :simple, :search, :search_mode, :comment, :has_comments,
+          :min_progress, :max_progress, :due_before, :due_after, :has_due_date,
+          :assignee_id, :unassigned, :show_archived, :page, :per_page,
+          tags: []
+        ).to_h
+      end
+
       def any_filter_active?
         params[:tags].present? ||
           params[:min_progress].present? ||
@@ -572,102 +592,15 @@ module Collavre
           params[:show_archived].present?
       end
 
+      # Thin delegator to Creatives::CreativeTreeSerializer. Kept as a controller
+      # method (rather than inlining the service call at the index call site) so
+      # the picker test that drives serialization via controller.send(:serialize_creatives, ...)
+      # keeps exercising the same seam.
       def serialize_creatives(collection)
-        if params[:simple].present?
-          # Preload origins so effective_origin (used per linked-shell row in both
-          # children_presence_set and the origin_id mapping below) resolves from
-          # memory instead of firing a query per shell. Only browse can hold shells;
-          # search is scoped to origin_id: nil, so this is a no-op there.
-          ActiveRecord::Associations::Preloader.new(records: collection.to_a, associations: :origin).call
-          children_ids = children_presence_set(collection)
-          searching = params[:search].present?
-          breadcrumbs = searching ? ::Creatives::BreadcrumbResolver.new(collection.map(&:id), user: Current.user, include_archived: params[:show_archived].present?).call : {}
-          # For hits routed through a linked shell, the path to expand in the
-          # user's own tree (local folders -> shell) so a breadcrumb jump can
-          # reach a shell nested under a collapsed folder.
-          reveal_paths = searching ? ::Creatives::RevealPathResolver.new(collection.map(&:id), user: Current.user, include_archived: params[:show_archived].present?).call : {}
-          collection.map do |c|
-            item = {
-              id: c.id,
-              description: c.effective_description(nil, false),
-              progress: c.progress,
-              has_children: children_ids.include?(c.id)
-            }
-            reveal = reveal_paths[c.id]
-            path = breadcrumbs[c.id]
-            if path.present?
-              item[:path] = mask_unreachable_crumbs(path, reveal)
-            end
-            item[:reveal_path] = reveal if reveal.present?
-            # For linked shells, expose the effective origin id so the picker can
-            # map a search breadcrumb (origin ids) back to the rendered shell node.
-            item[:origin_id] = c.effective_origin.id if c.origin_id
-            item
-          end
-        else
-          collection.map { |c| { id: c.id, description: c.effective_description, progress: c.progress } }
-        end
-      end
-
-      # A breadcrumb jump expands the tree from a rendered root (or, for a shared
-      # subtree, a linked shell) down to the clicked crumb. If an ancestor above a
-      # crumb is itself unrenderable (unreadable, or archived while archived rows
-      # aren't shown) and no linked shell re-roots the path at/below it, the
-      # descendant can't be expanded either — so mask it too. BreadcrumbResolver
-      # masks the unrenderable ancestor itself; this masks everything downstream of
-      # it on the plain origin chain, matching exactly what the tree can render.
-      #
-      # `reveal` is RevealPathResolver's per-origin map: a crumb whose origin id is
-      # a key re-roots navigation through its own shell (the client anchors at the
-      # nearest reveal entry at/above the clicked crumb), so it clears the block for
-      # itself and its descendants regardless of an archived/unreadable origin
-      # above it.
-      def mask_unreachable_crumbs(path, reveal)
-        blocked = false
-        path.map do |crumb|
-          if reveal&.key?(crumb[:id])
-            blocked = false
-            crumb
-          elsif crumb[:restricted]
-            blocked = true
-            crumb
-          elsif blocked
-            crumb.merge(restricted: true, description: nil)
-          else
-            crumb
-          end
-        end
-      end
-
-      # Batched "does this node have a child the user can actually browse to?"
-      # lookup so the picker tree renders expand toggles without an N+1.
-      #
-      # Must match exactly what expanding the node shows (IndexQuery#handle_id_query
-      # -> children_with_permission, minus archived unless show_archived), or the
-      # toggle either hides a reachable subtree or opens to an empty branch (and
-      # leaks that hidden children exist). Two alignments are needed:
-      #   1. Linked shells (origin_id set) store children under the effective
-      #      origin (redirect_parent_to_origin + children->origin migration), so
-      #      resolve each row to its effective origin before the lookup.
-      #   2. Apply the same archived + read-permission filters as the browse path.
-      def children_presence_set(collection)
-        return Set.new if collection.empty?
-
-        origin_id_by_id = collection.to_h { |c| [ c.id, c.effective_origin.id ] }
-
-        candidates = Creative.where(parent_id: origin_id_by_id.values.uniq)
-        candidates = candidates.where(archived_at: nil) unless params[:show_archived]
-        child_rows = candidates.pluck(:id, :parent_id) # [child_id, origin_id]
-        return Set.new if child_rows.empty?
-
-        readable = ::Creatives::PermissionFilter
-          .new(user: Current.user).readable_ids(child_rows.map(&:first)).to_set
-        origins_with_visible_children = child_rows
-          .each_with_object(Set.new) { |(child_id, origin_id), set| set << origin_id if readable.include?(child_id) }
-
-        collection.each_with_object(Set.new) do |c, set|
-          set << c.id if origins_with_visible_children.include?(origin_id_by_id[c.id])
-        end
+        # Fully-qualified name: this newly extracted service is not registered in
+        # config/initializers/collavre_model_aliases.rb, so the top-level
+        # ::Creatives::* alias used by the older sibling services is unavailable.
+        Collavre::Creatives::CreativeTreeSerializer.new(user: Current.user, params: params).serialize(collection)
       end
 
       def reorderer

data/app/controllers/collavre/inbox_items_controller.rb

@@ -38,12 +38,18 @@ module Collavre
     end
 
     def update
-      if @inbox_item.owner == Current.user
-        @inbox_item.update(state: params[:state])
-        head :no_content
-      else
+      unless @inbox_item.owner == Current.user
         head :forbidden
+        return
       end
+
+      unless InboxItem.states.key?(params[:state].to_s)
+        head :unprocessable_entity
+        return
+      end
+
+      @inbox_item.update(state: params[:state])
+      head :no_content
     end
 
     def destroy

data/app/controllers/collavre/landing_controller.rb

@@ -2,7 +2,10 @@ module Collavre
   class LandingController < ApplicationController
     allow_unauthenticated_access
 
-    def show
-    end
+    # The demo video/poster URLs live in config/locales/landing.*.yml as full
+    # absolute URLs pointing at the hosted assets. Nothing to resolve here — the
+    # view reads them directly, so the landing page has no dependency on the
+    # Creatives model and the URLs work from any environment (preview included).
+    def show; end
   end
 end

data/app/controllers/collavre/topics_controller.rb

@@ -145,6 +145,11 @@ module Collavre
         topic.update!(creative: target_creative)
       end
 
+      # update_all above skips counter-cache callbacks, so recompute
+      # comments_count on both sides after re-parenting the comments.
+      Creative.reset_counters(source_creative.id, :comments)
+      Creative.reset_counters(target_creative.id, :comments)
+
       broadcast_topic_event("deleted", topic_id: topic.id)
       broadcast_topic_event("created", creative: target_creative, topic: topic.slice(:id, :name))
 

data/app/controllers/concerns/collavre/api/authenticatable.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Api
+    module Authenticatable
+      extend ActiveSupport::Concern
+
+      private
+
+      def extract_bearer_token
+        auth_header = request.headers["Authorization"]
+        return nil unless auth_header&.start_with?("Bearer ")
+
+        auth_header.sub("Bearer ", "")
+      end
+
+      # Resolves the bearer token to a user via Doorkeeper, sets
+      # Collavre::Current.user, and returns the user. Returns nil (without
+      # rendering) when the token is blank/invalid/inaccessible or the user
+      # is missing — callers own the error response, because the two API
+      # engines render different error envelopes.
+      def find_user_by_bearer_token(token)
+        return nil if token.blank?
+
+        access_token = Doorkeeper::AccessToken.by_token(token)
+        return nil unless access_token&.accessible?
+
+        user = Collavre::User.find_by(id: access_token.resource_owner_id)
+        return nil unless user
+
+        Collavre::Current.user = user
+        user
+      end
+
+      def current_user
+        Collavre::Current.user
+      end
+    end
+  end
+end

data/app/errors/collavre/api_error.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Collavre
+  # Raised inside collavre-core API v1 controllers to produce the canonical
+  # single-message JSON envelope `{ error: "<message>" }` at a chosen status,
+  # via the rescue_from in Collavre::Api::V1::BaseController.
+  #
+  # NOTE: this is the collavre-core `{error: "str"}` shape only. It is NOT for
+  # the 422 validation-array shape `{errors: [...]}` (client retry contract),
+  # nor the OpenAI-nested shape in collavre_completion_api. Do not route those
+  # through this class.
+  class ApiError < StandardError
+    attr_reader :status
+
+    def initialize(message, status: :unprocessable_entity)
+      super(message)
+      @status = status
+    end
+  end
+end

data/app/helpers/collavre/creatives_helper.rb

@@ -18,14 +18,25 @@ module Collavre
     end
 
     def render_creative_tags(creative)
-      labels = creative.tags&.includes(:label)&.map(&:label)&.compact
+      # The browse tree preloads tags -> label per level; `includes` on an
+      # already-loaded association builds a fresh relation and re-queries it,
+      # which would reinstate the N+1 this is called from.
+      labels = if creative.tags.loaded?
+        creative.tags.map(&:label).compact
+      else
+        creative.tags&.includes(:label)&.map(&:label)&.compact
+      end
       return "" if labels&.empty?
       content_tag(:div, class: "creative-tags", style: "display: none;") do
         render_tags(labels, "unstyled-link", true)
       end
     end
 
-    def render_creative_progress(creative, select_mode: false, has_children: nil)
+    # `can_write`, `can_feedback` and `unread_count` let a caller rendering many
+    # creatives at once (the browse tree) resolve them in batch and hand them in.
+    # Left nil, each is resolved for this creative alone — correct, but a query
+    # per node. Single-creative call sites take that path.
+    def render_creative_progress(creative, select_mode: false, has_children: nil, can_write: nil, can_feedback: nil, unread_count: nil)
       progress_value = if params[:tags].present?
         tag_ids = Array(params[:tags]).map(&:to_s)
         creative.filtered_progress || creative.progress_for_tags(tag_ids) || 0
@@ -33,15 +44,15 @@ module Collavre
         creative.progress
       end
 
+      can_feedback = creative.has_permission?(Current.user, :feedback) if can_feedback.nil?
+
       content_tag(:div, class: "creative-row-end") do
         comment_part = if creative.archived?
           safe_join([])
-        elsif creative.has_permission?(Current.user, :feedback)
+        elsif can_feedback
           origin = creative.effective_origin
-          comments_count = origin.comments.size
-          pointer = CommentReadPointer.find_by(user: Current.user, creative: origin)
-          last_read_id = pointer&.last_read_comment_id
-          unread_count = last_read_id ? origin.comments.where("id > ? and private = ?", last_read_id, false).count : comments_count
+          comments_count = origin.comments_count
+          unread_count = unread_count_for(origin, comments_count) if unread_count.nil?
           if Current.user && CommentPresenceStore.list(origin.id).include?(Current.user.id)
             unread_count = 0
           end
@@ -70,7 +81,7 @@ module Collavre
           safe_join([])
         end
         is_leaf = has_children.nil? ? !creative.children.exists? : !has_children
-        can_write = creative.has_permission?(Current.user, :write)
+        can_write = creative.has_permission?(Current.user, :write) if can_write.nil?
         progress_part = if is_leaf && can_write && !select_mode
           render_progress_toggle(creative, progress_value)
         else
@@ -86,6 +97,17 @@ module Collavre
       end
     end
 
+    # Unread comments on `origin` for the current user. With no read pointer,
+    # every comment is unread. Batched by CommentBadgeIndex for the browse tree;
+    # this is the single-creative path.
+    def unread_count_for(origin, comments_count)
+      pointer = CommentReadPointer.find_by(user: Current.user, creative: origin)
+      last_read_id = pointer&.last_read_comment_id
+      return comments_count unless last_read_id
+
+      origin.comments.where("id > ? and private = ?", last_read_id, false).count
+    end
+
     def render_progress_toggle(creative, value)
       complete = value == 1
       new_value = complete ? 0 : 1

data/app/javascript/components/InlineLexicalEditor.jsx

@@ -15,7 +15,6 @@ import { HeadingNode, QuoteNode, $isHeadingNode, $isQuoteNode } from "@lexical/r
 import {
   CodeNode,
   CodeHighlightNode,
-  $createCodeNode,
   $isCodeNode,
   registerCodeHighlighting
 } from "@lexical/code"
@@ -56,6 +55,7 @@ import AttachmentCleanupPlugin from "./plugins/attachment_cleanup_plugin"
 import MarkdownShortcutsPlugin from "./plugins/markdown_shortcuts_plugin"
 import ListTabIndentPlugin from "./plugins/list_tab_indent_plugin"
 import { syncLexicalStyleAttributes } from "../lib/lexical/style_attributes"
+import { $toggleCodeBlockForSelection } from "../lib/lexical/code_block_toggle"
 import { lexicalHtmlConfig, normalizeColoredContainers } from "../lib/lexical/color_import"
 import { minimizeContentHtml } from "../lib/lexical/minimize_html"
 import { ensureTrailingParagraph, registerTrailingParagraph } from "../lib/lexical/trailing_paragraph"
@@ -682,39 +682,7 @@ function Toolbar() {
 
   const toggleCodeBlock = useCallback(() => {
     editor.update(() => {
-      const selection = $getSelection()
-      if (!$isRangeSelection(selection)) return
-
-      const anchorNode = selection.anchor.getNode()
-      const topLevel = anchorNode.getTopLevelElement()
-      if (!topLevel) return
-
-      if ($isCodeNode(topLevel)) {
-        const textContent = topLevel.getTextContent()
-        const lines = textContent.split("\n")
-        const firstParagraph = $createParagraphNode()
-        firstParagraph.append($createTextNode(lines[0] || ""))
-        topLevel.replace(firstParagraph)
-        let previous = firstParagraph
-        for (let index = 1; index < lines.length; index += 1) {
-          const paragraph = $createParagraphNode()
-          paragraph.append($createTextNode(lines[index]))
-          previous.insertAfter(paragraph)
-          previous = paragraph
-        }
-        firstParagraph.selectEnd()
-        return
-      }
-
-      if (topLevel.getType?.() !== "paragraph") {
-        return
-      }
-
-      const codeNode = $createCodeNode()
-      const content = topLevel.getTextContent()
-      codeNode.append($createTextNode(content || ""))
-      topLevel.replace(codeNode)
-      codeNode.selectEnd()
+      $toggleCodeBlockForSelection()
     })
   }, [editor])
 

data/app/javascript/components/__tests__/creative_tree_row_parent_id.test.js

@@ -0,0 +1,87 @@
+/**
+ * Regression: parentId single source of truth.
+ *
+ * The tree row component used to render `data-parent-id=${this.parentId ?? nothing}`,
+ * which OMITTED the attribute whenever parentId was null. `addNew` derives a new
+ * sibling's parent from `prev.dataset.parentId`, so an absent attribute produced an
+ * `undefined` parent downstream and lost the real parent for newly-added siblings.
+ *
+ * The single convention: `data-parent-id` is ALWAYS emitted on `.creative-tree`.
+ * A non-empty value is the parent id; "" means "root / no parent". This mirrors the
+ * dynamic-creation path (`dataset.parentId = parentId || ''`).
+ */
+
+// The component calls `customElements.define(...)` at module-eval time and reads
+// `customElements` as a bare global. The jest environment only exposes it on
+// `window`, so bridge it before importing the component.
+beforeAll(() => {
+  if (typeof globalThis.customElements === "undefined") {
+    globalThis.customElements = window.customElements;
+  }
+});
+
+async function mountRow(props) {
+  await import("../creative_tree_row.js");
+  const el = document.createElement("creative-tree-row");
+  Object.assign(el, props);
+  document.body.appendChild(el);
+  await el.updateComplete;
+  return el;
+}
+
+// The `.creative-tree` element is what the editor reads via `tree.dataset.parentId`.
+function treeOf(el) {
+  return el.querySelector(".creative-tree");
+}
+
+afterEach(() => {
+  document.body.innerHTML = "";
+});
+
+describe("creative-tree-row parentId convention", () => {
+  test("non-title row under a page-title parent keeps the parent id", async () => {
+    const el = await mountRow({ creativeId: "8", parentId: "5", level: 2 });
+    const tree = treeOf(el);
+
+    // The attribute is always present and carries the real parent id — this is
+    // exactly what addNew reads (`prev.dataset.parentId`) when deriving a sibling.
+    expect(tree.hasAttribute("data-parent-id")).toBe(true);
+    expect(tree.dataset.parentId).toBe("5");
+  });
+
+  test("root row emits an explicit empty marker instead of omitting the attribute", async () => {
+    const el = await mountRow({ creativeId: "5", parentId: null, level: 1 });
+    const tree = treeOf(el);
+
+    // Before the fix this attribute was omitted (ambiguous root vs unknown).
+    expect(tree.hasAttribute("data-parent-id")).toBe(true);
+    expect(tree.dataset.parentId).toBe("");
+  });
+
+  test("title row preserves its own parent (nested page) instead of dropping it", async () => {
+    const el = await mountRow({ creativeId: "5", parentId: "2", isTitle: true });
+    const tree = treeOf(el);
+
+    expect(tree.classList.contains("creative-tree-title")).toBe(true);
+    expect(tree.hasAttribute("data-parent-id")).toBe(true);
+    expect(tree.dataset.parentId).toBe("2");
+  });
+
+  test("root title row emits explicit empty marker", async () => {
+    const el = await mountRow({ creativeId: "5", parentId: null, isTitle: true });
+    const tree = treeOf(el);
+
+    expect(tree.hasAttribute("data-parent-id")).toBe(true);
+    expect(tree.dataset.parentId).toBe("");
+  });
+
+  test("addNew sibling derivation reads the correct parent from a page-title child", async () => {
+    // Simulate the editor's else-branch derivation: parentId = prev.dataset.parentId
+    // for a child row that lives under a page-title parent (id 5).
+    const child = await mountRow({ creativeId: "8", parentId: "5", level: 2 });
+    const prev = treeOf(child);
+
+    const derivedParentId = prev.dataset.parentId || "";
+    expect(derivedParentId).toBe("5"); // sibling inherits the page-title parent
+  });
+});

data/app/javascript/components/creative_tree_row.js

@@ -208,6 +208,12 @@ class CreativeTreeRow extends LitElement {
     if (this._progressToggle) this._progressToggle.addEventListener("click", this._handleProgressToggle, { passive: false });
   }
 
+  // parentId convention (single source of truth): `data-parent-id` is ALWAYS
+  // emitted on the `.creative-tree` element. A non-empty value is the parent
+  // creative id; an empty string ("") means "root / no parent". This mirrors
+  // the dynamic-creation path (`dataset.parentId = parentId || ''`) so readers
+  // never have to disambiguate an *absent* attribute (unknown) from a real
+  // root, which previously dropped the parent for newly-added siblings.
   render() {
     if (this.isTitle) {
       return this._renderTitle();
@@ -224,7 +230,7 @@ class CreativeTreeRow extends LitElement {
         class="creative-tree"
         id=${this.domId ?? nothing}
         data-id=${this.creativeId ?? nothing}
-        data-parent-id=${this.parentId ?? nothing}
+        data-parent-id=${this.parentId ?? ""}
         data-level=${this.level ?? nothing}
         draggable=${draggableAttr}
         data-action=${dragActions}
@@ -250,7 +256,7 @@ class CreativeTreeRow extends LitElement {
         class="creative-tree creative-tree-title"
         id=${this.domId ?? nothing}
         data-id=${this.creativeId ?? nothing}
-        data-parent-id=${this.parentId ?? nothing}
+        data-parent-id=${this.parentId ?? ""}
       >
         <div class="creative-row" style="background-color: transparent;" data-creatives--select-mode-target="row">
           <div class="creative-row-start" style="align-items: center;">

data/app/javascript/components/plugins/markdown_shortcuts_plugin.jsx

@@ -6,16 +6,19 @@ import {
   ORDERED_LIST,
   CODE
 } from "@lexical/markdown"
+import { registerCodeFenceShortcut } from "../../lib/lexical/code_fence_shortcut"
 
 /**
  * Markdown-style shortcuts for the creative inline editor:
  *
  * - "* " / "- " / "+ " at line start → unordered list
  * - "1. " (any number) at line start → ordered list
- * - "```" + space at line start → code block
+ * - "```" (optionally "```lang") on its own line → code block
  *
- * These fire on text change (not on Enter), so they don't conflict
- * with the Enter→addNew() shortcut on desktop.
+ * The list transformers fire on text change. The built-in CODE transformer
+ * needs "``` " (trailing space); registerCodeFenceShortcut adds the Enter path,
+ * converting a "```" (or "```lang") line to a code block when Enter is pressed —
+ * so the language can be typed before the fence commits.
  */
 const CREATIVE_MARKDOWN_TRANSFORMERS = [
   UNORDERED_LIST,
@@ -27,7 +30,15 @@ export default function MarkdownShortcutsPlugin() {
   const [editor] = useLexicalComposerContext()
 
   useEffect(() => {
-    return registerMarkdownShortcuts(editor, CREATIVE_MARKDOWN_TRANSFORMERS)
+    const unregisterShortcuts = registerMarkdownShortcuts(
+      editor,
+      CREATIVE_MARKDOWN_TRANSFORMERS
+    )
+    const unregisterFence = registerCodeFenceShortcut(editor)
+    return () => {
+      unregisterShortcuts()
+      unregisterFence()
+    }
   }, [editor])
 
   return null