lato 3.25.0 → 3.26.1

data/app/views/lato/account/_form-web3.html.erb

@@ -30,7 +30,7 @@ user ||= Lato::User.new
       </div>
     <% elsif session[:web3_nonce] %>
       <div class="alert alert-light mb-0">
-        <h4 class="alert-heading">Connecting..</h4>
+        <h3 class="alert-heading h4" role="status"><%= I18n.t('lato.connecting') %></h3>
         <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
           <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
         </div>
@@ -39,13 +39,14 @@ user ||= Lato::User.new
       <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
       <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
       <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, 'Confirm', class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
+      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
 
       <script>
         (async () => {
+          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
           const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
 
-          const nonce = document.getElementById('account_form-web3__nonce').innerText
+          const nonce = document.getElementById('account_form-web3__nonce').textContent
           const inputAddress = document.getElementById('account_form-web3__input-web3_address')
           const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
           const submitButton = document.getElementById('account_form-web3__submit')
@@ -72,7 +73,7 @@ user ||= Lato::User.new
       </script>
     <% else %>
       <div class="alert alert-light mb-0">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_web3_start_title') %></h4>
+        <h3 class="alert-heading h4"><%= I18n.t('lato.account_web3_start_title') %></h3>
         <p>
           <%= raw I18n.t('lato.account_web3_start_description') %>
         </p>

data/app/views/lato/account/_form-webauthn.html.erb

@@ -20,7 +20,7 @@ end
 
     <% if user.webauthn_enabled? %>
       <div class="alert alert-success mb-3">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_webauthn_ready_title') %></h4>
+        <h3 class="alert-heading h4"><%= I18n.t('lato.account_webauthn_ready_title') %></h3>
         <p class="mb-0">
           <%= raw I18n.t('lato.account_webauthn_ready_description') %>
         </p>
@@ -36,7 +36,7 @@ end
       <%= form.hidden_field :webauthn_credential, data: { lato_account_webauthn_target: 'credentialInput' } %>
 
       <div class="alert alert-light mb-3" data-lato-account-webauthn-target="status">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_webauthn_in_progress_title') %></h4>
+        <h3 class="alert-heading h4"><%= I18n.t('lato.account_webauthn_in_progress_title') %></h3>
         <p class="mb-0">
           <%= raw I18n.t('lato.account_webauthn_in_progress_description') %>
         </p>
@@ -53,7 +53,7 @@ end
       </div>
     <% else %>
       <div class="alert alert-light mb-0">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_webauthn_start_title') %></h4>
+        <h3 class="alert-heading h4"><%= I18n.t('lato.account_webauthn_start_title') %></h3>
         <p>
           <%= raw I18n.t('lato.account_webauthn_start_description') %>
         </p>

data/app/views/lato/account/_security-confirmation.html.erb

@@ -1,12 +1,15 @@
+<%# Rendered in several account forms on the same page: suffix ids so each label targets its own field. %>
+<% password_id = form.field_id(:current_password, form.object_id) %>
+<% code_id = form.field_id(:current_authenticator_code, form.object_id) %>
 <div class="mb-3" data-controller="lato-account-security" data-lato-account-security-challenge-url-value="<%= lato.account_security_challenge_path %>" data-lato-account-security-webauthn-value="<%= user.webauthn_enabled? && !user.authenticator_enabled? %>">
-  <%= form.label :current_password, "Current password", class: "form-label" %>
-  <%= form.password_field :current_password, class: "form-control", autocomplete: "current-password" %>
+  <%= form.label :current_password, I18n.t('lato.current_password'), class: "form-label", for: password_id %>
+  <%= form.password_field :current_password, id: password_id, class: "form-control", autocomplete: "current-password" %>
   <% if user.authenticator_enabled? %>
-    <%= form.label :current_authenticator_code, "Current authenticator code", class: "form-label mt-2" %>
-    <%= form.text_field :current_authenticator_code, value: nil, class: "form-control", autocomplete: "one-time-code", inputmode: "numeric" %>
+    <%= form.label :current_authenticator_code, I18n.t('lato.current_authenticator_code'), class: "form-label mt-2", for: code_id %>
+    <%= form.text_field :current_authenticator_code, id: code_id, value: nil, class: "form-control", autocomplete: "one-time-code", inputmode: "numeric" %>
   <% elsif user.webauthn_enabled? %>
     <%= form.hidden_field :current_webauthn_credential, value: nil, data: { lato_account_security_target: "credential" } %>
-    <p class="text-muted mt-2">Confirm with your registered security key when submitting.</p>
+    <p class="text-muted mt-2"><%= I18n.t('lato.security_key_confirmation_help') %></p>
   <% end %>
   <p class="text-danger mt-2" data-lato-account-security-target="error" role="alert"></p>
 </div>

data/app/views/lato/account/index.html.erb

@@ -60,7 +60,7 @@
   </div>
   <div class="card-body">
     <div class="alert alert-warning">
-      <h4 class="alert-heading"><%= I18n.t('lato.warning') %></h4>
+      <h3 class="alert-heading h4"><%= I18n.t('lato.warning') %></h3>
       <p>
         <%= raw I18n.t('lato.account_delete_details') %>
       </p>

data/app/views/lato/authentication/_fields-registration.html.erb

@@ -7,31 +7,32 @@ email_readonly ||= false
 <div class="row">
   <div class="col col-12 col-md-6 mb-3">
     <%= lato_form_item_label form, :first_name %>
-    <%= lato_form_item_input_text form, :first_name, required: true %>
+    <%= lato_form_item_input_text form, :first_name, required: true, autocomplete: 'given-name' %>
   </div>
 
   <div class="col col-12 col-md-6 mb-3">
     <%= lato_form_item_label form, :last_name %>
-    <%= lato_form_item_input_text form, :last_name, required: true %>
+    <%= lato_form_item_input_text form, :last_name, required: true, autocomplete: 'family-name' %>
   </div>
 
   <div class="col col-12 mb-3">
     <%= lato_form_item_label form, :email %>
-    <%= lato_form_item_input_email form, :email, required: true, readonly: email_readonly %>
+    <%= lato_form_item_input_email form, :email, required: true, readonly: email_readonly, autocomplete: 'email' %>
   </div>
 
   <div class="col col-12 col-md-6 mb-3">
     <%= lato_form_item_label form, :password %>
-    <%= lato_form_item_input_password form, :password, required: true %>
+    <%= lato_form_item_input_password form, :password, required: true, autocomplete: 'new-password', minlength: Lato.config.auth_password_min_length, aria: { describedby: form.field_id(:password, :help) } %>
+    <div class="form-text" id="<%= form.field_id(:password, :help) %>"><%= I18n.t('lato.password_requirements', count: Lato.config.auth_password_min_length) %></div>
   </div>
 
   <div class="col col-12 col-md-6 mb-3">
     <%= lato_form_item_label form, :password_confirmation %>
-    <%= lato_form_item_input_password form, :password_confirmation, required: true %>
+    <%= lato_form_item_input_password form, :password_confirmation, required: true, autocomplete: 'new-password' %>
   </div>
 </div>
 
 <div class="mb-3 text-muted" style="font-size: 14px;">
-  <%= lato_form_item_input_check form, :accepted_privacy_policy_version, I18n.t('lato.privacy_policy_checkbox', link: link_to(I18n.t('lato.privacy_policy'), Lato.config.legal_privacy_policy_url, target: '_blank')), required: true %>
-  <%= lato_form_item_input_check form, :accepted_terms_and_conditions_version, I18n.t('lato.terms_and_conditions_checkbox', link: link_to(I18n.t('lato.terms_and_conditions'), Lato.config.legal_terms_and_conditions_url, target: '_blank')), required: true %>
+  <%= lato_form_item_input_check form, :accepted_privacy_policy_version, I18n.t('lato.privacy_policy_checkbox', link: link_to(I18n.t('lato.privacy_policy'), Lato.config.legal_privacy_policy_url, target: '_blank')).html_safe, required: true %>
+  <%= lato_form_item_input_check form, :accepted_terms_and_conditions_version, I18n.t('lato.terms_and_conditions_checkbox', link: link_to(I18n.t('lato.terms_and_conditions'), Lato.config.legal_terms_and_conditions_url, target: '_blank')).html_safe, required: true %>
 </div>

data/app/views/lato/authentication/_form-authenticator.html.erb

@@ -10,11 +10,11 @@ user ||= Lato::User.new
     <%= lato_form_errors user, class: %w[mb-3] %>
 
     <div class="mb-3 text-center">
-      <p><%= raw I18n.t('lato.authenticator_code_help', email: h(user.email_protected)) %></p>
+      <%= form.label :authenticator_code, raw(I18n.t('lato.authenticator_code_help', email: h(user.email_protected))), class: 'form-label' %>
     </div>
     
     <div class="mb-3">
-      <%= lato_form_item_input_text form, :authenticator_code, required: true %>
+      <%= lato_form_item_input_text form, :authenticator_code, required: true, autocomplete: 'one-time-code', inputmode: 'numeric', pattern: '[0-9]{6}', maxlength: 6, autofocus: true %>
     </div>
 
     <div>

data/app/views/lato/authentication/_form-signin.html.erb

@@ -11,12 +11,12 @@ user ||= Lato::User.new
     
     <div class="mb-3">
       <%= lato_form_item_label form, :email %>
-      <%= lato_form_item_input_email form, :email, required: true %>
+      <%= lato_form_item_input_email form, :email, required: true, autocomplete: 'username' %>
     </div>
 
     <div class="mb-3">
       <%= lato_form_item_label form, :password %>
-      <%= lato_form_item_input_password form, :password, required: true %>
+      <%= lato_form_item_input_password form, :password, required: true, autocomplete: 'current-password' %>
     </div>
 
     <div>

data/app/views/lato/authentication/_form-verify-email.html.erb

@@ -10,13 +10,14 @@ code ||= nil
   <%= form_with model: user, url: lato.authentication_verify_email_action_path(id: user.id), class: 'text-center', data: { turbo_frame: '_self' } do |form| %>
     <% if code %>
       <%= form.hidden_field :code, value: code %>
-      <button type="submit" style="display: none;"></button>
+      <%# Visible fallback when JavaScript is disabled or blocked by CSP. %>
+      <button type="submit" class="btn btn-primary"><%= I18n.t('lato.verify_email') %></button>
       <script>document.getElementById('authentication_form_verify_email').querySelector('button[type="submit"]').click()</script>
     <% else %>
       <%= lato_form_notices class: %w[mb-3], fixed: true %>
       <%= lato_form_errors user, class: %w[mb-3], fixed: true %>
 
-      <%= link_to 'Torna all tuo account', lato.account_path, class: %w[btn btn-primary] %>
+      <%= link_to I18n.t('lato.back_to_account'), lato.account_path, class: %w[btn btn-primary] %>
     <% end %>
   <% end %>
 <% end %>

data/app/views/lato/authentication/_form-web3-signin.html.erb

@@ -12,7 +12,7 @@ user ||= Lato::User.new
     <% if session[:web3_nonce] %>
     
       <div class="alert alert-light mb-0 text-center">
-        <h4 class="alert-heading">Connecting..</h4>
+        <h4 class="alert-heading" role="status"><%= I18n.t('lato.connecting') %></h4>
         <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
           <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
         </div>
@@ -21,13 +21,14 @@ user ||= Lato::User.new
       <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
       <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
       <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, 'Confirm', class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
+      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
 
       <script>
         (async () => {
+          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
           const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
 
-          const nonce = document.getElementById('account_form-web3__nonce').innerText
+          const nonce = document.getElementById('account_form-web3__nonce').textContent
           const inputAddress = document.getElementById('account_form-web3__input-web3_address')
           const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
           const submitButton = document.getElementById('account_form-web3__submit')

data/app/views/lato/components/_form_item_input_signature.html.erb

@@ -102,7 +102,7 @@ default_tab = existing_url ? 'current' : 'draw'
   <%# Clear button (solo nelle tab di editing) %>
   <div class="d-flex justify-content-end mt-2" data-lato-input-signature-target="clearRow">
     <button type="button"
-            class="btn btn-outline-secondary btn-sm"
+            class="btn btn-outline-primary btn-sm"
             style="font-size: 0.75rem;"
             data-action="click->lato-input-signature#clearSignature">
       <i class="bi bi-eraser"></i> <%= I18n.t('lato.signature_clear') %>

data/app/views/lato/components/_index.html.erb

@@ -9,9 +9,10 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
 
 <%= turbo_frame_tag "lato_index_#{key}_#{model_name_underscore}", class: "lato-index #{browser.device.mobile? ? 'lato-index-mob' : 'lato-index-desk'}" do %>
 
-  <%= form_tag request.path, method: :get, data: { controller: 'lato-form lato-index', turbo_frame: '_self' } do %>
+  <%= form_tag request.path, method: :get, data: { controller: 'lato-form lato-index', lato_index_key_value: key, turbo_frame: '_self' } do %>
     <%= hidden_field_tag :key, key %>
-    <% params.each do |k, v| %>
+    <% params.except(:controller, :action, :key).each do |k, v| %>
+      <% next unless v.is_a?(String) %>
       <%= hidden_field_tag k, v %>
     <% end %>
 
@@ -33,7 +34,7 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
         <% if custom_actions.any? %>
           <div class="btn-group ms-2">
             <% custom_actions.each do |action_key, action_params| %>
-              <%= link_to action_params[:path], { class: 'btn btn-primary' }.merge(action_params) do %>
+              <%= link_to action_params[:path], { class: 'btn btn-primary', 'aria-label': action_params[:title] }.merge(action_params) do %>
                 <i class="<%= action_params[:icon] %>"></i>
               <% end %>
             <% end %>
@@ -42,7 +43,7 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
 
         <% if dropdown_actions %>
           <div class="dropdown ms-2">
-            <%= content_tag :button, { class: 'btn btn-primary dropdown-toggle', 'data-bs-toggle': 'dropdown' }.merge(dropdown_actions) do %>
+            <%= content_tag :button, { class: 'btn btn-primary dropdown-toggle', 'data-bs-toggle': 'dropdown', 'aria-label': dropdown_actions[:title] }.merge(dropdown_actions) do %>
               <i class="<%= dropdown_actions[:icon] %>"></i>
             <% end %>
             <ul class="dropdown-menu">
@@ -98,7 +99,7 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
           <span class="text-muted"><%= collection_total %> <%= I18n.t('lato.total_results').downcase %></span>
         <% end %>
         <% if collection.respond_to?(:total_pages) %>
-          <div class="mt-3"><%= paginate(collection, param_name: "#{key}_page", total_pages: total_pages, window: 1) %></div>
+          <div class="mt-3"><%= lato_index_paginate(collection, key, total_pages: total_pages, window: 1) %></div>
         <% end %>
       </div>
 
@@ -109,28 +110,32 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
           <thead>
             <tr class="align-middle">
               <% columns.each do |column| %>
-                <th scope="col" class="lato-index-desk-col-label lato-index-desk-col-label-<%= column %>">
+                <% column_label = collection_test_istance.respond_to?(column) ? collection.model.human_attribute_name(column) : lato_index_dynamic_label({
+                  key: key,
+                  model_name: model_name,
+                  column: column
+                }) %>
+                <% sort_direction = sortable_columns.include?(column) ? { "#{column}|ASC" => 'ascending', "#{column}|DESC" => 'descending' }[params["#{key}_sort_by"]] : nil %>
+                <%= content_tag :th, scope: 'col', class: "lato-index-desk-col-label lato-index-desk-col-label-#{column}", 'aria-sort': sort_direction do %>
                   <div class="d-flex align-items-center justify-content-between">
-                    <span><%= collection_test_istance.respond_to?(column) ? collection.model.human_attribute_name(column) : lato_index_dynamic_label({
-                      key: key,
-                      model_name: model_name,
-                      column: column
-                    }) %></span>
+                    <span><%= column_label %></span>
                     <% if sortable_columns.include?(column) %>
                       <div class="btn-group ms-3 lato-index-col-sort">
-                        <div class="position-relative btn btn-sm <%= params["#{key}_sort_by"] == "#{column}|ASC" ? 'btn-primary' : 'btn-outline-primary' %>">
-                          <input type="submit" name="<%= "#{key}_sort_by" %>" value="<%= column %>|ASC" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0">
-                          <i class="bi bi-sort-up"></i>
-                        </div>
-
-                        <div class="position-relative btn btn-sm <%= params["#{key}_sort_by"] == "#{column}|DESC" ? 'btn-primary' : 'btn-outline-primary' %>">
-                          <input type="submit" name="<%= "#{key}_sort_by" %>" value="<%= column %>|DESC" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0">
-                          <i class="bi bi-sort-down"></i>
-                        </div>
+                        <% [['ASC', 'ascending', 'bi-sort-up'], ['DESC', 'descending', 'bi-sort-down']].each do |direction, direction_name, icon| %>
+                          <% active = params["#{key}_sort_by"] == "#{column}|#{direction}" %>
+                          <button
+                            type="submit"
+                            name="<%= "#{key}_sort_by" %>"
+                            value="<%= column %>|<%= direction %>"
+                            class="btn btn-sm <%= active ? 'btn-primary' : 'btn-outline-primary' %>"
+                            aria-label="<%= I18n.t("lato.sort_#{direction_name}", column: strip_tags(column_label.to_s)) %>"
+                            aria-pressed="<%= active %>"
+                          ><i class="bi <%= icon %>" aria-hidden="true"></i></button>
+                        <% end %>
                       </div>
                     <% end %>
                   </div>
-                </th>
+                <% end %>
               <% end %>
             </tr>
           </thead>
@@ -156,7 +161,7 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
               <td colspan="<%= columns.length %>">
                 <div class="d-flex justify-content-between align-items-center">
                   <% if collection.respond_to?(:total_pages) %>
-                    <div><%= paginate(collection, param_name: "#{key}_page", total_pages: total_pages) %></div>
+                    <div><%= lato_index_paginate(collection, key, total_pages: total_pages) %></div>
                   <% else %>
                     <div></div>
                   <% end %>

data/app/views/lato/components/_navbar_nav_item.html.erb

@@ -1,5 +1,5 @@
 <li class="nav-item">
-  <%= link_to path, class: ['nav-link', ('active' if active)] do %>
+  <%= link_to path, class: ['nav-link', ('active' if active)], aria: { current: ('page' if active) } do %>
     <%= yield %>
   <% end %>
 </li>

data/app/views/lato/components/_operation.html.erb

@@ -29,7 +29,7 @@
 
     <% if operation.completed_status? %>
       <div class="text-center">
-        <div class="fs-1 text-success">
+        <div class="fs-1 text-success-emphasis">
           <i class="bi bi-check-circle"></i>
         </div>
         <h2><%= I18n.t('lato.operation_completed_title') %></h2>
@@ -40,14 +40,17 @@
         <% end %>
 
         <% if operation.output_message? %>
-          <p class="text-success fw-bold">
+          <p class="text-success-emphasis fw-bold">
             <%= operation.output_message %>
           </p>
         <% end %>
 
         <% if operation.output_action? %>
           <div class="mt-3 d-flex justify-content-center">
-            <%= link_to operation.output_action['label'], operation.output_action['href'], { class: 'btn btn-primary' }.merge(operation.output_action['attributes']) %>
+            <%# Only http(s) and relative links: a javascript: href built from job input would run on click. %>
+            <% output_href = operation.output_action['href'].to_s %>
+            <% output_href = '#' unless output_href.start_with?('/', 'http://', 'https://') && !output_href.start_with?('//') %>
+            <%= link_to operation.output_action['label'], output_href, { class: 'btn btn-primary' }.merge(operation.output_action['attributes'] || {}) %>
           </div>
         <% end %>
       </div>

data/app/views/lato/components/_page_head.html.erb

@@ -9,7 +9,7 @@
     </ol>
   <% end %>
 
-  <h1><%= raw title %></h1>
+  <h1><%= title %></h1>
 
   <%= yield %>
 </div>

data/app/views/lato/components/_sidebar_nav_item.html.erb

@@ -9,6 +9,7 @@ unless has_children
     class: ['nav-link position-relative', (active ? 'active' : 'link-dark')].join(' '),
   }
   link_to_options[:target] = '_blank' if external
+  link_to_options[:aria] = { current: 'page' } if active
 end
 
 %>
@@ -28,7 +29,7 @@ end
         <ul class="list-unstyled mt-2 border-start border-1 ps-2">
           <% children.each do |child| %>
             <li class="py-1">
-              <%= link_to child[:path], class: ['nav-link py-1', (active == child[:key] ? 'active' : 'link-dark')].join(' ') do %>
+              <%= link_to child[:path], class: ['nav-link py-1', (active == child[:key] ? 'active' : 'link-dark')].join(' '), aria: { current: ('page' if active == child[:key]) } do %>
                 <%= child[:label] %>
               <% end %>
             </li>

data/app/views/lato/mailer/invitation/invite_mail.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
 
 You have received an invitation to use <%= Lato.config.application_title %>.
 <br><br>

data/app/views/lato/mailer/user/email_verification_mail.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
 
 To have access to all the features of <%= Lato.config.application_title %> you must confirm your email address.
 <br><br>

data/app/views/lato/mailer/user/password_update_mail.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
 
 An update to your <%= Lato.config.application_title %> account password has been requested.
 <br><br>

data/app/views/lato/mailer/user/signin_success_mail.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
 
 An access to your <b><%= Lato.config.application_title %></b> account has been made with the IP address <b><%= @ip_address %></b>.
 <br><br>

data/app/views/layouts/lato/_action.html.erb

@@ -1,11 +1,11 @@
 <% 10.times do %>
 
-<div class="modal fade" data-lato-action-target="modal" tabindex="-1" aria-hidden="true" data-bs-backdrop="static" data-bs-keyboard="false">
+<div class="modal fade" data-lato-action-target="modal" tabindex="-1" aria-hidden="true" data-bs-backdrop="static">
   <div class="modal-dialog modal-dialog-centered modal-dialog-scrollable" data-lato-action-target="modalDialog">
     <div class="modal-content">
       <div class="modal-header">
         <h2 class="mb-0 mt-0 fs-4" data-lato-action-target="modalTitle"></h2>
-        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="<%= I18n.t('lato.close') %>"></button>
       </div>
       <div class="modal-body" data-lato-action-target="modalBody">
         ...

data/app/views/layouts/lato/_aside-opener.html.erb

@@ -2,7 +2,7 @@
   class="aside-opener shadow"
   data-controller="lato-aside-opener"
   data-action="click->lato-aside-opener#onClickToggle"
-  aria-label="Toggle sidebar"
+  aria-label="<%= I18n.t('lato.toggle_sidebar') %>"
 >
-  <i class="bi bi-layout-text-sidebar-reverse"></i>
+  <i class="bi bi-layout-text-sidebar-reverse" aria-hidden="true"></i>
 </button>

data/app/views/layouts/lato/_confirm.html.erb

@@ -1,26 +1,24 @@
-<div class="lato-confirm modal fade" data-controller="lato-confirm" tabindex="-1" aria-hidden="true" data-bs-keyboard="false">
+<div class="lato-confirm modal fade" data-controller="lato-confirm" tabindex="-1" aria-hidden="true" aria-labelledby="latoConfirmTitle">
   <div class="modal-dialog modal-dialog-centered modal-dialog-scrollable">
     <div class="modal-content">
       <div class="modal-header">
-        <h2 class="mb-0 mt-0 fs-4"><%= I18n.t('lato.confirm_title') %></h2>
-        <button type="button" class="btn-close" data-action="click->lato-confirm#confirmCancel" aria-label="Close"></button>
+        <h2 class="mb-0 mt-0 fs-4" id="latoConfirmTitle"><%= I18n.t('lato.confirm_title') %></h2>
+        <button type="button" class="btn-close" data-action="click->lato-confirm#confirmCancel" aria-label="<%= I18n.t('lato.close') %>"></button>
       </div>
       <div class="modal-body" data-lato-confirm-target="modalBody">
       </div>
       <div class="modal-footer">
         <button
           type="button"
-          class="btn btn-danger"
+          class="btn btn-secondary"
           data-action="click->lato-confirm#confirmCancel"
-          aria-label="<%= I18n.t('lato.confirm_no') %>"
         ><%= I18n.t('lato.confirm_no') %></button>
         <button
           type="button"
-          class="btn btn-success"
+          class="btn btn-primary"
           data-action="click->lato-confirm#confirmSuccess"
-          aria-label="<%= I18n.t('lato.confirm_yes') %>"
         ><%= I18n.t('lato.confirm_yes') %></button>
       </div>
     </div>
   </div>
-</div>
+</div>

data/app/views/layouts/lato/_feedbacks.html.erb

@@ -1,11 +1,11 @@
 <div class="toast-container">
   <% if notice %>
     <div class="position-fixed end-0 bottom-0 p-3" style="z-index: 11;">
-      <div data-controller="lato-feedback" id="feedbackNotice" class="toast hide" role="alert" aria-live="assertive" aria-atomic="true">
+      <div data-controller="lato-feedback" id="feedbackNotice" class="toast hide" role="status" aria-live="polite" aria-atomic="true">
         <div class="toast-header">
-          <i class="bi bi-check-circle-fill text-success me-2"></i>
-          <strong class="me-auto"><%= I18n.t('lato.operation_completed') %></strong>
-          <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="Close"></button>
+          <i class="bi bi-check-circle-fill text-success me-2" aria-hidden="true"></i>
+          <strong class="me-auto"><%= I18n.t('lato.notice_title') %></strong>
+          <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="<%= I18n.t('lato.close') %>"></button>
         </div>
         <div class="toast-body">
           <%= notice %>
@@ -16,11 +16,12 @@
 
   <% if alert %>
     <div class="position-fixed end-0 bottom-0 p-3" style="z-index: 11;">
-      <div data-controller="lato-feedback" id="feedbackAlert" class="toast hide" role="alert" aria-live="assertive" aria-atomic="true">
+      <%# Errors stay visible until dismissed: auto hiding gives no time to read them. %>
+      <div data-controller="lato-feedback" id="feedbackAlert" class="toast hide" role="alert" aria-live="assertive" aria-atomic="true" data-bs-autohide="false">
         <div class="toast-header">
-          <i class="bi bi-check-circle-fill text-danger me-2"></i>
-          <strong class="me-auto"><%= I18n.t('lato.operation_failed') %></strong>
-          <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="Close"></button>
+          <i class="bi bi-exclamation-triangle-fill text-danger me-2" aria-hidden="true"></i>
+          <strong class="me-auto"><%= I18n.t('lato.alert_title') %></strong>
+          <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="<%= I18n.t('lato.close') %>"></button>
         </div>
         <div class="toast-body">
           <%= alert %>

data/app/views/layouts/lato/_mailer-head_content.html.erb

@@ -1,4 +1,4 @@
-<% if I18n.locale == 'en' %>
+<% if I18n.locale.to_s != 'it' %>
   Hello,
   <br><br>
 <% else %>

data/app/views/layouts/lato/_network.html.erb

@@ -1,4 +1,4 @@
-<div class="fixed-bottom p-3 d-none" data-controller="lato-network">
-  <span class="badge rounded-pill text-bg-danger fs-6 d-none" data-lato-network-target="offline">You are offline</span>
-  <span class="badge rounded-pill text-bg-success fs-6 d-none" data-lato-network-target="online">You are online</span>
+<div class="fixed-bottom p-3 d-none" data-controller="lato-network" role="status" aria-live="polite">
+  <span class="badge rounded-pill text-bg-danger fs-6 d-none" data-lato-network-target="offline"><%= I18n.t('lato.network_offline') %></span>
+  <span class="badge rounded-pill text-bg-success fs-6 d-none" data-lato-network-target="online"><%= I18n.t('lato.network_online') %></span>
 </div>

data/app/views/layouts/lato/application.html.erb

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no,interactive-widget=resizes-content">
-  <title><%= @layout_page_title %></title>
+  <title><%= @layout_page_title.presence || Lato.config.application_title %></title>
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
 
@@ -27,6 +27,7 @@
   class="controller-<%= controller_name %> action-<%= action_name %> <%= @layout_body_classes.join(' ') %> <%= cookies[:lato_aside_hidden] == 'true' ? 'aside-hidden' : '' %>"
   data-controller="lato-action lato-guide"
 >
+  <a class="visually-hidden-focusable position-absolute top-0 start-0 p-2 bg-white" style="z-index: 2100;" href="#main"><%= I18n.t('lato.skip_to_content') %></a>
   <header>
     <%= render 'layouts/lato/navbar' %>
   </header>
@@ -39,7 +40,7 @@
       </aside>
     <% end %>
 
-    <main class="<%= @layout_sidebar ? 'layout_sidebar' : '' %>">
+    <main id="main" tabindex="-1" class="<%= @layout_sidebar ? 'layout_sidebar' : '' %>">
       <%= render 'layouts/lato/content' %>
     </main>
   </div>