rubocop-openproject 0.5.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 275bc3f46bfa1dd8ecc461306e5671cadbce64a83a571044d8fff2d08af163a0
-  data.tar.gz: 6c492b822185a201a389c3fd035fed0f02b60a44a87497090bf34d57c422af52
+  metadata.gz: b6399b37d75f31159de26fc061439ab6107f3621da14770ab2e3f4a263e4748e
+  data.tar.gz: c0bc045863a214c19a10fe29e4b23edd6d60f3598158f665fdfb4fefba851946
 SHA512:
-  metadata.gz: 65aacad0b8c4b61e690253a4b86169bdac9b598df89da79f98995e113fb14cad688395495863382a023c002c1ef4db101eb1d0ef162be0571c2b078d38443c8f
-  data.tar.gz: 0ceddce3d195d754dbdf194de88a68a284e86c099ee6f4d9d2069caef736bfb7b9a1ea9d4d9f1ac17e502321814c87115c197bed15bc47486a17042202b7ede9
+  metadata.gz: 5089a09294d79954f16b4fe511fd6b3aabe57b9272ebf41fa4a376feb7a6fcf8c2872b072fd6e3c7eb8493484e0e5b3eb2dc88f2bbfb964fa5fb67f0cdd8e5d8
+  data.tar.gz: 46759bc28c398aeefb4fb18305dd9494056a5296a859bb7789d4c37548b785a935a254f0cfcc98442cccceeb70fc5a788113316b3c58707dc0172506ab6462e0

data/.ruby-version

@@ -0,0 +1 @@
+4.0.6

data/CHANGELOG.md

@@ -1,4 +1,23 @@
-## [Unreleased]
+# rubocop-openproject
+
+## 0.7.0
+
+### Minor Changes
+
+- ad3ff98: Add `OpenProject/UseEffectiveTypeForConfiguration` cop to catch reading a type's
+  configuration off `#type` instead of `#effective_type`. A work package stores the root of its
+  type family while its project may resolve that family to a variant configured differently, so
+  reading an aspect (form configuration, workflows, custom fields, defaults, export templates)
+  off the stored type silently answers with the root's configuration. The failure is quiet — a
+  project running the root behaves correctly, so a spec written without a variant passes while
+  the feature is broken wherever a variant is resolved. Inherited core settings (`name`,
+  `color`, `is_milestone`, `is_in_roadmap`) are read from the root by design and are not flagged.
+
+## 0.6.0
+
+### Minor Changes
+
+- 6e7b812: Add `OpenProject/UseRenderModeInsteadOfPrimitives` cop to flag `format_text` calls that pass the external-rendering primitive flags (`static_html: true`, `plain_text: true`, `only_path: false`) instead of the canonical `render_mode:` API or the `format_mail_html` / `format_mail_text` mailer view helpers.
 
 ## [0.5.0] - 2026-05-05
 

data/README.md

@@ -24,16 +24,19 @@ require:
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+To install this gem onto your local machine, run `bundle exec rake install`.
+
+When working on a change, add a changeset describing it: run `npx changeset`
+(or `./node_modules/.bin/changeset` after `npm install`), pick the bump
+(`patch` / `minor` / `major`), and write a short summary. This adds a file under
+`.changeset/`; commit it with your PR. The release automation turns accumulated
+changesets into the next version bump and `CHANGELOG.md` entry.
 
 ## Releasing
 
-1. Update the version in `lib/rubocop/open_project/version.rb`
-2. Update the changelog in `CHANGELOG.md`
-3. Run `bundle install` to update `Gemfile.lock`
-4. Run `rake` to check everything is fine and fix any issues
-5. Commit your changes (`git commit -am 'Prepare release X.Y.Z'`)
-6. Run `bundle exec rake release`
+Releases are driven by [changesets](https://github.com/changesets/changesets) and
+GitHub Actions, so no RubyGems credentials are needed on your machine. See
+[.github/RELEASING.md](.github/RELEASING.md) for the flow and one-time setup.
 
 ## Contributing
 

data/config/default.yml

@@ -23,6 +23,16 @@ OpenProject/NoSleepInFeatureSpecs:
   Enabled: true
   VersionAdded: '0.1.0'
 
+OpenProject/UseEffectiveTypeForConfiguration:
+  Description: 'Read a type''s configuration through `effective_type`, not `type`, so the project''s variant is honoured.'
+  Enabled: true
+  VersionAdded: '0.7.0'
+
+OpenProject/UseRenderModeInsteadOfPrimitives:
+  Description: 'Use `render_mode:` instead of `static_html:`/`plain_text:`/`only_path:` on `format_text`.'
+  Enabled: true
+  VersionAdded: '0.6.0'
+
 OpenProject/UseServiceResultFactoryMethods:
   Description: 'Use ServiceResult factory methods instead of ServiceResult.new.'
   Enabled: true

data/lib/rubocop/cop/open_project/use_effective_type_for_configuration.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module OpenProject
+      # Flags reading a type's configuration off `#type` rather than `#effective_type`.
+      #
+      # A work package stores the root of its type family, while the project it lives in may
+      # resolve that family to a variant configured differently — a different form
+      # configuration, workflow, set of custom fields, defaults or export templates. Reading a
+      # configuration aspect off the stored type therefore answers with the root's
+      # configuration and silently ignores the variant.
+      #
+      # The failure mode is quiet: a project running the root behaves correctly, so a spec
+      # written without a variant passes while the feature is broken for every project that
+      # resolves one. That is what this cop is here to catch.
+      #
+      # Only configuration aspects are flagged. `name`, `color`, `is_milestone` and
+      # `is_in_roadmap` are inherited from the root by design, so reading those off `#type` is
+      # correct and left alone.
+      #
+      # Deliberately narrow: it fires when the receiver is literally a `type` call, which is
+      # the shape the mistake takes in practice. Administration code holding an explicit type
+      # (`@type.attribute_groups`) is reading that member's own configuration on purpose and is
+      # not flagged, and neither is a type held in a local variable.
+      #
+      # @example
+      #   # bad
+      #   work_package.type.attribute_groups
+      #
+      #   # bad
+      #   work_package.type.custom_fields
+      #
+      #   # bad — inside WorkPackage itself
+      #   type.statuses(include_default: true)
+      #
+      #   # good
+      #   work_package.effective_type.attribute_groups
+      #
+      #   # good — when there is no work package to ask
+      #   project.effective_type(type).attribute_groups
+      #
+      #   # good — inherited from the root by design
+      #   work_package.type.name
+      #   work_package.type.is_milestone?
+      #
+      #   # good — administration reads a specific member's own configuration
+      #   @type.attribute_groups
+      class UseEffectiveTypeForConfiguration < Base
+        MSG = "Read configuration through `effective_type`, not `type` — the stored type is " \
+              "the family's root, so this ignores the variant the project resolves to."
+
+        # Configuration aspects, per Type::ConfigurationLink::ASPECTS and the readers
+        # Type::ConfigurationLinkable resolves through the link chain.
+        CONFIGURATION_METHODS = %i[
+          artefact_export_enabled?
+          artefact_export_mode
+          attribute_groups
+          custom_field_ids
+          custom_fields
+          description
+          export_templates_disabled
+          export_templates_order
+          patterns
+          project_custom_field_type_mappings
+          statuses
+          workflows
+        ].freeze
+
+        RESTRICT_ON_SEND = CONFIGURATION_METHODS
+
+        def_node_matcher :type_call?, <<~PATTERN
+          (send _ :type)
+        PATTERN
+
+        def on_send(node)
+          return unless type_call?(node.receiver)
+
+          add_offense(node)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/open_project/use_render_mode_instead_of_primitives.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module OpenProject
+      # Flags `format_text` calls that pass the external-rendering primitive
+      # flags (`static_html: true`, `plain_text: true`, `only_path: false`)
+      # instead of the canonical `render_mode:` API.
+      #
+      # `format_text` renders trusted Markdown for two distinct audiences:
+      # in-app HTML (the default) and external surfaces such as mailer
+      # bodies or feeds. The external surface needs absolute URLs and a
+      # subset of macros pre-resolved to static HTML / plain text, because
+      # the recipient has no JavaScript runtime to hydrate the rest. The
+      # primitive flags express that requirement as three loosely coupled
+      # toggles, which makes call sites easy to get partially right (and
+      # silently wrong — see openproject#74762, where a mailer view skipped
+      # `static_html: true` and rendered numeric work package IDs instead of
+      # their semantic identifiers).
+      #
+      # The canonical API is `render_mode: :external_html` /
+      # `render_mode: :external_text`, with the mailer view helpers
+      # `format_mail_html` and `format_mail_text` as the preferred form
+      # inside mailer templates. The cop fires on both `.rb` and `.erb`
+      # sources via OpenProject's erb_lint Rubocop bridge.
+      #
+      # @example
+      #   # bad
+      #   format_text("hi", static_html: true, only_path: false)
+      #
+      #   # bad
+      #   format_text("hi", plain_text: true, only_path: false)
+      #
+      #   # bad
+      #   format_text("hi", only_path: false)
+      #
+      #   # bad (two-arg form)
+      #   format_text(@user, :name, only_path: false)
+      #
+      #   # good (canonical API)
+      #   format_text("hi", render_mode: :external_html)
+      #
+      #   # good (mailer view helper)
+      #   format_mail_html("hi")
+      #
+      #   # good (in-app default; no external flags)
+      #   format_text("hi", only_path: true)
+      #
+      #   # good (render_mode present — primitive override is an explicit escape hatch)
+      #   format_text("hi", render_mode: :external_html, only_path: false)
+      class UseRenderModeInsteadOfPrimitives < Base
+        MSG_HTML = "Use `render_mode: :external_html` (or `format_mail_html` in mailer views) " \
+                   "instead of the primitive flags `static_html: true` / `only_path: false`. " \
+                   "The `render_mode:` API documents intent and bundles the coupled toggles " \
+                   "that silently produced numeric IDs in watcher notifications (openproject#74762)."
+
+        MSG_TEXT = "Use `render_mode: :external_text` (or `format_mail_text` in mailer views) " \
+                   "instead of the primitive flags `plain_text: true` / `only_path: false`. " \
+                   "The `render_mode:` API documents intent and bundles the coupled toggles " \
+                   "that silently produced numeric IDs in watcher notifications (openproject#74762)."
+
+        MSG_ONLY_PATH = "Use `render_mode: :external_html` (or `format_mail_html` in mailer views) " \
+                        "instead of passing `only_path: false` on its own. The bare flag is " \
+                        "an under-specified external render that silently produced numeric IDs " \
+                        "in watcher notifications (openproject#74762)."
+
+        RESTRICT_ON_SEND = %i[format_text].freeze
+
+        def on_send(node)
+          hash_arg = node.last_argument
+          return unless hash_arg&.hash_type?
+
+          pairs = symbol_keyed_pairs(hash_arg)
+          return if render_mode_present?(pairs)
+
+          static_html = pair_with_value(pairs, :static_html, true)
+          plain_text  = pair_with_value(pairs, :plain_text, true)
+          only_path_false = pair_with_value(pairs, :only_path, false)
+
+          return unless static_html || plain_text || only_path_false
+
+          add_offense(node, message: message_for(static_html, plain_text, only_path_false))
+        end
+
+        private
+
+        def symbol_keyed_pairs(hash_arg)
+          hash_arg.pairs.select { |p| p.key.sym_type? }
+        end
+
+        def render_mode_present?(pairs)
+          pairs.any? { |p| p.key.value == :render_mode }
+        end
+
+        def pair_with_value(pairs, key, value)
+          pairs.find { |p| p.key.value == key && literal_equals?(p.value, value) }
+        end
+
+        def literal_equals?(node, value)
+          case value
+          when true then node.true_type?
+          when false then node.false_type?
+          end
+        end
+
+        def message_for(static_html, plain_text, only_path_false)
+          return MSG_HTML if static_html
+          return MSG_TEXT if plain_text
+
+          MSG_ONLY_PATH if only_path_false
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/open_project_cops.rb

@@ -5,3 +5,5 @@ require_relative "open_project/no_not_implemented_error"
 require_relative "open_project/no_params_in_work_package_where_id"
 require_relative "open_project/use_service_result_factory_methods"
 require_relative "open_project/no_sleep_in_feature_specs"
+require_relative "open_project/use_effective_type_for_configuration"
+require_relative "open_project/use_render_mode_instead_of_primitives"

data/lib/rubocop/open_project/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module OpenProject
-    VERSION = "0.5.0"
+    VERSION = "0.7.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-openproject
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.0
 platform: ruby
 authors:
 - OpenProject GmbH
@@ -32,6 +32,7 @@ extra_rdoc_files: []
 files:
 - ".rspec"
 - ".rubocop.yml"
+- ".ruby-version"
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
@@ -42,6 +43,8 @@ files:
 - lib/rubocop/cop/open_project/no_not_implemented_error.rb
 - lib/rubocop/cop/open_project/no_params_in_work_package_where_id.rb
 - lib/rubocop/cop/open_project/no_sleep_in_feature_specs.rb
+- lib/rubocop/cop/open_project/use_effective_type_for_configuration.rb
+- lib/rubocop/cop/open_project/use_render_mode_instead_of_primitives.rb
 - lib/rubocop/cop/open_project/use_service_result_factory_methods.rb
 - lib/rubocop/cop/open_project_cops.rb
 - lib/rubocop/open_project.rb
@@ -69,7 +72,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: RuboCop cops for OpenProject
 test_files: []