@conduction/nextcloud-vue 2.115.0 → 2.116.0

package/src/composables/useTaskInboxStore.js

@@ -223,6 +223,91 @@ export const useTaskInboxStore = defineStore('cnTaskInbox', {
 			}
 		},
 
+		/**
+		 * Run one lifecycle verb on a task read for a detail page, and keep
+		 * that record in step with the engine's answer.
+		 *
+		 * `url` replaces the engine's own verb route for an app that puts a
+		 * step of its own in front of the engine (dossiq completes a task
+		 * through its own endpoint, which checks the case type's form first).
+		 * `{id}` in it is the task uuid. A refusal is returned with the
+		 * server's message as-is and leaves the record as it was.
+		 *
+		 * @param {string} uuid The task uuid.
+		 * @param {string} verb The verb.
+		 * @param {{url?: string}} [options] An app route to post the verb to instead.
+		 * @return {Promise<{ok: boolean, status: (number|null), record: (object|null), message: string}>} The outcome.
+		 * @spec openspec/changes/record-source-verbs/specs/record-source-verbs/spec.md#requirement-a-record-source-offers-header-verbs
+		 */
+		async runRecordVerb(uuid, verb, options = {}) {
+			const key = String(uuid || '').trim()
+			const name = String(verb || '').trim()
+			if (key === '' || name === '') {
+				return { ok: false, status: null, record: null, message: '' }
+			}
+			const route = typeof options.url === 'string' && options.url !== ''
+				? options.url.replace('{id}', encodeURIComponent(key))
+				: `${FLOW_TASKS_URL}/${encodeURIComponent(key)}/${encodeURIComponent(name)}`
+			try {
+				const response = await axios.post(generateUrl(route), {})
+				return { ok: true, status: response.status || 200, record: await this.keepRecord(key, response.data), message: '' }
+			} catch (error) {
+				return { ok: false, status: error?.response?.status ?? null, record: null, message: serverMessage(error) }
+			}
+		},
+
+		/**
+		 * Tick or untick one checklist item on a task read for a detail page
+		 * (`PATCH /flow-tasks/{uuid}/checklist/{itemId}?checked=`). The engine
+		 * answers with the whole task, which replaces the record, so a refused
+		 * tick leaves the item as it was on screen.
+		 *
+		 * @param {string} uuid The task uuid.
+		 * @param {string} itemId The checklist item id.
+		 * @param {boolean} checked The new state.
+		 * @return {Promise<{ok: boolean, status: (number|null), record: (object|null), message: string}>} The outcome.
+		 * @spec openspec/changes/record-checklist-widget/specs/record-checklist-widget/spec.md#requirement-a-checklist-widget-ticks-items-through-the-record-source
+		 */
+		async checkRecordItem(uuid, itemId, checked) {
+			const key = String(uuid || '').trim()
+			const item = String(itemId || '').trim()
+			if (key === '' || item === '') {
+				return { ok: false, status: null, record: null, message: '' }
+			}
+			try {
+				const response = await axios.patch(
+					generateUrl(`${FLOW_TASKS_URL}/${encodeURIComponent(key)}/checklist/${encodeURIComponent(item)}`),
+					null,
+					{ params: { checked: checked === true ? 'true' : 'false' } },
+				)
+				return { ok: true, status: response.status || 200, record: await this.keepRecord(key, response.data), message: '' }
+			} catch (error) {
+				return { ok: false, status: error?.response?.status ?? null, record: null, message: serverMessage(error) }
+			}
+		},
+
+		/**
+		 * Store the task a write answered with as the detail record. An answer
+		 * that carries no task (an app route that returns only a status) is
+		 * followed by a fresh read, so the page never shows the state from
+		 * before the write.
+		 *
+		 * @param {string} key The task uuid.
+		 * @param {unknown} data The response body.
+		 * @return {Promise<object|null>} The task now held.
+		 */
+		async keepRecord(key, data) {
+			const body = data && typeof data === 'object' ? data : null
+			const task = body && (body.results || body.task) && typeof (body.results || body.task) === 'object' && !Array.isArray(body.results || body.task)
+				? (body.results || body.task)
+				: body
+			if (task && typeof task === 'object' && !Array.isArray(task) && String(task.uuid || '') === key) {
+				this.records = { ...this.records, [key]: task }
+				return task
+			}
+			return this.fetchRecord(key)
+		},
+
 		/**
 		 * Load one inbox page.
 		 *

package/src/dialogs/CnAccessPurposeDialog.vue

@@ -0,0 +1,183 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 Conduction B.V.
+  - SPDX-License-Identifier: EUPL-1.2
+-->
+<template>
+	<CnDialog
+		:name="title || t('nextcloud-vue', 'Why are you opening this?')"
+		defaultWidth="confirm"
+		size="small"
+		:noClose="loading"
+		data-testid="cn-access-purpose-dialog"
+		@closing="$emit('cancel')">
+		<p class="cn-access-purpose__sentence">
+			{{ description || t('nextcloud-vue', 'This record holds special categories of personal data. Your purpose is recorded with your name and the time.') }}
+		</p>
+		<fieldset class="cn-access-purpose__choices">
+			<legend class="cn-access-purpose__legend">
+				{{ t('nextcloud-vue', 'Purpose') }}
+			</legend>
+			<NcCheckboxRadioSwitch
+				v-for="option in choices"
+				:key="option.value"
+				v-model="purpose"
+				type="radio"
+				name="cn-access-purpose"
+				:value="option.value"
+				:disabled="loading"
+				:data-testid="`cn-access-purpose-option-${option.value}`">
+				{{ option.label }}
+			</NcCheckboxRadioSwitch>
+		</fieldset>
+		<NcTextArea
+			v-if="purpose === OTHER"
+			v-model="note"
+			:label="t('nextcloud-vue', 'Describe your purpose')"
+			:maxlength="500"
+			:disabled="loading"
+			data-testid="cn-access-purpose-note" />
+		<NcNoteCard v-if="error" type="error" data-testid="cn-access-purpose-error">
+			{{ error }}
+		</NcNoteCard>
+
+		<template #actions>
+			<NcButton :disabled="loading" data-testid="cn-access-purpose-cancel" @click="$emit('cancel')">
+				{{ t('nextcloud-vue', 'Cancel') }}
+			</NcButton>
+			<NcButton
+				variant="primary"
+				:disabled="!complete || loading"
+				data-testid="cn-access-purpose-submit"
+				@click="submit">
+				<template v-if="loading" #icon>
+					<NcLoadingIcon :size="20" :name="t('nextcloud-vue', 'Loading …')" />
+				</template>
+				{{ t('nextcloud-vue', 'Open') }}
+			</NcButton>
+		</template>
+	</CnDialog>
+</template>
+
+<script>
+import { translate as t } from '@nextcloud/l10n'
+import { NcButton, NcCheckboxRadioSwitch, NcLoadingIcon, NcNoteCard, NcTextArea } from '@nextcloud/vue'
+import CnDialog from '../components/CnDialog/CnDialog.vue'
+
+/** The value of the "Other" choice, which asks for a written purpose. */
+const OTHER = 'other'
+
+/**
+ * CnAccessPurposeDialog — asks why the reader opens a record before the page
+ * shows it (detail page `accessPurpose`). A short list of purposes plus
+ * "Other", which needs a written purpose. Emits the choice; the page records
+ * it and decides whether to open.
+ *
+ * @spec openspec/changes/detail-access-purpose/specs/detail-access-purpose/spec.md#requirement-a-detail-page-can-ask-for-a-purpose-before-it-opens
+ */
+export default {
+	name: 'CnAccessPurposeDialog',
+
+	components: { CnDialog, NcButton, NcCheckboxRadioSwitch, NcLoadingIcon, NcNoteCard, NcTextArea },
+
+	props: {
+		/** The dialog's title; a default question when empty. */
+		title: {
+			type: String,
+			default: '',
+		},
+
+		/** The sentence under the title; a default when empty. */
+		description: {
+			type: String,
+			default: '',
+		},
+
+		/**
+		 * The purposes offered, already translated. "Other" is added at the end.
+		 *
+		 * @type {Array<{value: string, label: string}>}
+		 */
+		options: {
+			type: Array,
+			default: () => [],
+		},
+
+		/** Whether the purpose is being recorded. */
+		loading: {
+			type: Boolean,
+			default: false,
+		},
+
+		/** Why the last attempt was refused, shown in the dialog. */
+		error: {
+			type: String,
+			default: '',
+		},
+	},
+
+	emits: [
+		/**
+		 * The reader chose a purpose.
+		 *
+		 * @type {{purpose: string, note: string}}
+		 */
+		'submit',
+		/** The reader closed the dialog without a purpose. */
+		'cancel',
+	],
+
+	data() {
+		return { purpose: '', note: '', OTHER }
+	},
+
+	computed: {
+		/** @return {Array<{value: string, label: string}>} The offered purposes and "Other". */
+		choices() {
+			const own = (Array.isArray(this.options) ? this.options : [])
+				.filter((option) => option && typeof option.value === 'string' && option.value !== '' && option.value !== OTHER)
+			return [...own, { value: OTHER, label: t('nextcloud-vue', 'Other') }]
+		},
+
+		/** @return {boolean} Whether a purpose is chosen and, for "Other", written. */
+		complete() {
+			if (this.purpose === '') {
+				return false
+			}
+			return this.purpose !== OTHER || this.note.trim() !== ''
+		},
+	},
+
+	methods: {
+		t,
+
+		/**
+		 * Emit the chosen purpose; the written note only goes with "Other".
+		 *
+		 * @return {void}
+		 */
+		submit() {
+			if (!this.complete) {
+				return
+			}
+			this.$emit('submit', { purpose: this.purpose, note: this.purpose === OTHER ? this.note.trim() : '' })
+		},
+	},
+}
+</script>
+
+<style scoped>
+.cn-access-purpose__sentence {
+	margin: 0 0 12px;
+}
+
+.cn-access-purpose__choices {
+	margin: 0 0 12px;
+	padding: 0;
+	border: 0;
+}
+
+.cn-access-purpose__legend {
+	margin-bottom: 4px;
+	font-weight: 600;
+}
+</style>

package/src/index.js

@@ -63,6 +63,7 @@ export {
 	CnChartWidgetForm,
 	CnChatPage,
 	CnChecklistRunWidget,
+	CnChecklistWidget,
 	CnChildRecordsField,
 	CnChipsFieldWidget,
 	CnChoiceCards,

package/src/schemas/app-manifest-v2.schema.json

@@ -3,7 +3,7 @@
 	"$id": "https://raw.githubusercontent.com/ConductionNL/nextcloud-vue/main/src/schemas/app-manifest-v2.schema.json",
 	"title": "Conduction App Manifest v2",
 	"description": "v2 schema for the JSON-driven page and navigation manifest consumed by @conduction/nextcloud-vue. Introduces a uniform widgets[] array on every page type with a per-slot grid coordinate system, a typed actions[] discriminator, and the required $schema field for version detection. v1 manifests continue to validate against app-manifest.schema.json (unchanged).",
-	"version": "2.136.0",
+	"version": "2.137.0",
 	"type": "object",
 	"required": ["$schema", "version"],
 	"allOf": [
@@ -1363,6 +1363,11 @@
 					"minLength": 1,
 					"description": "Dot-path to the value on the record."
 				},
+				"values": {
+					"type": "array",
+					"items": { "type": "string" },
+					"description": "With `field`: draw the pill only when the raw value is one of these (a priority pill for high and urgent only)."
+				},
 				"text": {
 					"type": "string",
 					"minLength": 1,
@@ -3202,6 +3207,23 @@
 					"default": 1,
 					"description": "open-form: how many columns the fields flow into. 2 pairs them up, which halves the scrolling on a longer form. Textareas and JSON editors still span the full width, and the layout collapses to one column below 700px. Widen the dialog with size: 'large' as well, or two columns are merely two narrow ones."
 				},
+				"endpoint": {
+					"type": "object",
+					"description": "open-form only: edit a record that is not a register object through an endpoint (an OpenRegister organisation). `url` is where the save goes (token-interpolated, app-relative or absolute), `method` is PATCH (default) or PUT, or POST to create a record with an empty form, `loadUrl` reads the record when it differs from `url`, `responsePath` plucks it from the answer. The fields are `formProperties`. Without `endpoint` the action is the schema-driven create form.",
+					"properties": {
+						"url": { "type": "string" },
+						"method": { "type": "string", "enum": ["PATCH", "PUT", "POST"] },
+						"loadUrl": { "type": "string" },
+						"responsePath": { "type": "string" }
+					},
+					"required": ["url"],
+					"additionalProperties": false
+				},
+				"formProperties": {
+					"type": "object",
+					"description": "open-form with `endpoint` only: the fields the form shows and sends, as JSON-schema properties (`{ \"name\": { \"type\": \"string\", \"title\": \"Name\" } }`).",
+					"additionalProperties": { "type": "object" }
+				},
 				"handler": {
 					"type": "string",
 					"description": "Registry key for type: 'handler'. Resolved across both registries passed to CnAppRoot: a v2 `registry` entry of `kind: 'handler'` exposing the function as `.handler` (or `.fn`), a directly function-valued registry entry, or a function-valued entry in the deprecated `customComponents` map. The same resolution serves actions[], bulkActions[] and headerActions[]. Also the built-in dispatch verb when paired with `route` (handler: 'navigate' → $router.push to `route`)."
@@ -3255,8 +3277,8 @@
 				},
 				"method": {
 					"type": "string",
-					"enum": ["POST", "PUT"],
-					"description": "api-call: HTTP method (default POST). toggle writeUrl: default PUT."
+					"enum": ["POST", "PUT", "GET"],
+					"description": "api-call: HTTP method (default POST); GET sends the resolved params as the query string, and with download: true downloads the file the endpoint answers (DqDoorlooptijd). toggle writeUrl: default PUT."
 				},
 				"payload": {
 					"type": "object",
@@ -5506,6 +5528,30 @@
 								}
 							}
 						},
+						"accessPurpose": {
+							"type": "object",
+							"required": ["when", "url"],
+							"additionalProperties": false,
+							"description": "type='detail': ask why the reader opens the record before the page shows it, and record the answer (detail-access-purpose). `when` is a condition in the visibleWhen grammar on the record and its visibilityContext records; `options` the purposes offered (\"Other\" with a written purpose is always added); `url` the app endpoint that records the purpose (POST { purpose, note }, {objectId} filled in). Nothing of the record shows until the endpoint accepts; the same record is not asked again in the same browser session. Maps to CnDetailPage `accessPurpose`.",
+							"properties": {
+								"when": { "type": "object", "description": "The condition under which the page asks, e.g. { \"field\": \"@context.caseType.specialDataCategories\", \"op\": \"notEmpty\" }." },
+								"options": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"required": ["value", "label"],
+										"additionalProperties": false,
+										"properties": {
+											"value": { "type": "string", "minLength": 1 },
+											"label": { "type": "string", "minLength": 1, "description": "i18n key." }
+										}
+									}
+								},
+								"url": { "type": "string", "minLength": 1, "description": "App endpoint that records the purpose; {objectId} is filled in." },
+								"title": { "type": "string", "description": "i18n key of the dialog's title." },
+								"description": { "type": "string", "description": "i18n key of the sentence under the title." }
+							}
+						},
 						"mapConfig": {
 							"type": "object",
 							"additionalProperties": true,

package/src/utils/actionsDispatcher.js

@@ -466,7 +466,8 @@ async function executeApiCall(action, context) {
 		console.warn('[dispatchAction] api-call is missing its url or a required token is unresolved — skipping.', action)
 		return { ok: false, error: new Error('api-call blocked') }
 	}
-	const method = String(action.method || 'POST').toUpperCase() === 'PUT' ? 'put' : 'post'
+	const verb = String(action.method || 'POST').toUpperCase()
+	const method = verb === 'PUT' ? 'put' : (verb === 'GET' ? 'get' : 'post')
 	const isDownload = action.download === true
 	const [{ default: axios }, { generateUrl }, dialogs] = await Promise.all([
 		import('@nextcloud/axios'),
@@ -478,9 +479,13 @@ async function executeApiCall(action, context) {
 		// Only pass a third axios config arg for a download call — an
 		// explicit `undefined` third argument would otherwise change the
 		// call shape for every existing (non-download) api-call consumer/test.
-		const res = isDownload
-			? await axios[method](target, body, { responseType: 'blob' })
-			: await axios[method](target, body)
+		// A GET sends the resolved params as the query string: it reads, as a
+		// download of what the page shows (DqDoorlooptijd "Downloaden").
+		const res = method === 'get'
+			? await axios.get(target, isDownload ? { params: body, responseType: 'blob' } : { params: body })
+			: (isDownload
+					? await axios[method](target, body, { responseType: 'blob' })
+					: await axios[method](target, body))
 		if (isDownload) {
 			const filename = parseDispositionFilename(
 				res && res.headers && res.headers['content-disposition'],
@@ -731,7 +736,7 @@ export async function postRunNode(action, context, config = {}) {
  *   through generateUrl) or absolute. May interpolate the shared URL tokens
  *   (`@objectId`, `@object.<field>`, `@workspace.<key>`, `@config.<key>`, and the
  *   `{objectId}` brace form).
- * @param {string} [action.method] "api-call" only: "POST" (default) | "PUT".
+ * @param {string} [action.method] "api-call" only: "POST" (default) | "PUT" | "GET" (the resolved params as the query string).
  * @param {object} [action.payload] "api-call" only: the JSON body — preferred over `params`.
  *   Values resolve the shared `@`-token grammar RECURSIVELY at any nesting depth (objects
  *   and arrays of objects, e.g. `{ dataRefs: [{ id: '@objectId' }] }`); optional (`…?`)

package/src/utils/detailActionModel.js

@@ -225,9 +225,10 @@ export function resolveNextStep(config, object, stageField = 'status') {
  *
  * A pill with `field` reads it off the record; one without `field` and with
  * `text` is a constant. A count pill (`countFrom`) is resolved by
- * {@link resolveCountPill} once its count is known.
+ * {@link resolveCountPill} once its count is known. `values` limits a field
+ * pill to those raw values: a priority pill drawn only for high and urgent.
  *
- * @param {{field?: string, text?: string, colorMap?: object, labels?: object, variant?: string}|null} config The pill config.
+ * @param {{field?: string, text?: string, colorMap?: object, labels?: object, variant?: string, values?: Array<string>}|null} config The pill config.
  * @param {object|null} object The record.
  * @return {{label: string, colorKey: string, colorMap: object|null, variant: string}|null} What CnStatusBadge needs, or null when the field is empty.
  * @spec openspec/changes/detail-action-model-and-case-surfaces/specs/detail-action-model/spec.md#requirement-header-pills
@@ -252,6 +253,9 @@ export function resolvePill(config, object) {
 	if (raw === '') {
 		return null
 	}
+	if (Array.isArray(config.values) && !config.values.map(String).includes(raw)) {
+		return null
+	}
 	const mapped = stageEntry(config.labels, raw)
 	return {
 		label: typeof mapped === 'string' && mapped !== '' ? mapped : raw,

package/src/utils/libraryWidgetKeys.js

@@ -98,6 +98,7 @@ export const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'banner',
 	'calendar',
 	'chart',
+	'checklist',
 	'checklist-run',
 	'chips-field',
 	'choice-picker',