@conduction/nextcloud-vue 2.56.0-beta.3 → 2.56.0-beta.5

package/src/components/CnObjectRow/CnObjectRow.vue

@@ -2,7 +2,7 @@
 	<div
 		class="cn-object-row"
 		:class="{ 'cn-object-row--selected': selected }"
-		@mousedown="onPointerDown"
+		@mousedown="onRowMouseDown"
 		@click="onRowClick($event)"
 		@auxclick="onRowAuxClick($event)">
 		<!-- Selection checkbox -->
@@ -68,7 +68,7 @@
 import { NcCheckboxRadioSwitch } from '@nextcloud/vue'
 import { useClickDragGuard } from '../../composables/useClickDragGuard.js'
 import { resolveImageUrl } from '../../utils/resolveImageUrl.js'
-import { isRowMiddleClick } from '../../utils/rowAuxClick.js'
+import { isRowMiddleClick, preventMiddleClickAutoscroll } from '../../utils/rowAuxClick.js'
 import { CnIcon } from '../CnIcon/index.js'
 import { CnStatusBadge } from '../CnStatusBadge/index.js'
 
@@ -146,7 +146,7 @@ export default {
 	// again from `$emit('click', object)` — twice per click, with different
 	// payloads. Declaring the names here removes them from `$attrs`, which is
 	// also what stops VTU v2 recording the native DOM event into `emitted()`.
-	emits: ['select', 'click'],
+	emits: ['select', 'click', 'aux-click'],
 
 	setup() {
 		// Tell a deliberate row click apart from a text-selection drag.
@@ -237,15 +237,29 @@ export default {
 				return
 			}
 			/**
-			 * @event click Emitted when a non-selectable row is clicked or middle-clicked (navigation). Payload: `(object, event)` — the row's object and the native click/auxclick event, for opening it in a new tab on a ctrl/cmd/shift or middle click.
+			 * @event click Emitted when a non-selectable row is clicked (navigation). Payload: `(object, event)` — the row's object and the native click event, for opening it in a new tab on a ctrl/cmd/shift click. A middle click emits `aux-click` instead.
 			 * @type {object} The row's object.
 			 */
 			this.$emit('click', this.object, event)
 		},
 
 		/**
-		 * Row-body middle click: emits `click` like a click on a
-		 * non-selectable row.
+		 * Row mousedown: record the press for the drag guard, and on a
+		 * non-selectable row keep a middle press from starting autoscroll.
+		 *
+		 * @param {MouseEvent} event The mousedown event.
+		 */
+		onRowMouseDown(event) {
+			this.onPointerDown(event)
+			if (!this.selectable) {
+				preventMiddleClickAutoscroll(event)
+			}
+		},
+
+		/**
+		 * Row-body middle click on a non-selectable row: emits `aux-click`, not
+		 * `click`, so an existing `click` listener that navigates never moves
+		 * the current tab away.
 		 *
 		 * @param {MouseEvent} event The auxclick event.
 		 */
@@ -253,7 +267,11 @@ export default {
 			if (this.selectable || !isRowMiddleClick(event)) {
 				return
 			}
-			this.$emit('click', this.object, event)
+			/**
+			 * @event aux-click Emitted when a non-selectable row is middle-clicked, for opening it in a new tab (see `openRowTarget`). Payload: `(object, event)` — the row's object and the native auxclick event.
+			 * @type {object} The row's object.
+			 */
+			this.$emit('aux-click', this.object, event)
 		},
 	},
 }

package/src/components/CnObjectSidebar/CnFilesTab.vue

@@ -153,7 +153,6 @@
 							v-if="file.id"
 							:href="showInFilesUrl(file)"
 							target="_blank"
-							rel="noopener noreferrer"
 							:closeAfterClick="true">
 							<template #icon>
 								<FolderOutline :size="20" />

package/src/components/CnPageRenderer/CnPageRenderer.vue

@@ -128,6 +128,7 @@
 				v-bind="{ ...$attrs, ...resolvedProps }"
 				@view="onRowOpen"
 				@rowClick="onRowOpen"
+				@rowAuxClick="onRowOpen"
 				@editOpen="onRowOpen"
 				@configure="showConfigModal = true">
 				<!-- This `<template v-for>` defines dynamic SLOTS, not a
@@ -203,6 +204,7 @@
 			v-bind="{ ...$attrs, ...resolvedProps }"
 			@view="onRowOpen"
 			@rowClick="onRowOpen"
+			@rowAuxClick="onRowOpen"
 			@editOpen="onRowOpen"
 			@configure="showConfigModal = true">
 			<!-- Dynamic slot definition, not a rendered list — see the note on

package/src/components/CnRowActions/CnRowActions.vue

@@ -41,6 +41,7 @@
 <script>
 import { NcActionButton, NcActionLink, NcActions } from '@nextcloud/vue'
 import { followItemActionLink, resolveItemActionLink } from '../../utils/actionLink.js'
+import { isModifiedClick } from '../../utils/linkNavigation.js'
 import { evaluateVisibleWhenLocal, isLocallyDecidableVisibleWhen } from '../../utils/visibleWhen.js'
 import { CnIcon } from '../CnIcon/index.js'
 
@@ -215,16 +216,20 @@ export default {
 		/**
 		 * A link entry was clicked: route a plain in-app click, leave the rest to
 		 * the browser, and emit `action` as a button would. The `handler` is not
-		 * called, since navigating is what the link already does.
+		 * called, since navigating is what the link already does. A modified
+		 * click opens a new tab, so nothing is emitted in this one.
 		 *
 		 * @param {object} action The action definition.
 		 * @param {object} link The resolved link.
 		 * @param {MouseEvent} event The click event.
 		 */
 		onLinkAction(action, link, event) {
+			if (isModifiedClick(event)) {
+				return
+			}
 			followItemActionLink(event, link, this.$router)
 			/**
-			 * @event action User picked an entry. Payload: the action's label and the row. A button entry has already run its `handler`; a link entry navigates instead.
+			 * @event action User picked an entry. Payload: the action's label and the row. A button entry has already run its `handler`; a link entry navigates instead, and a modified (new-tab) click on a link emits nothing.
 			 * @type {{ action: string, row: object|null }}
 			 */
 			this.$emit('action', { action: action.label, row: this.row })

package/src/components/CnSetupWizard/CnSetupWizard.vue

@@ -133,7 +133,7 @@
 							v-for="item in summaryItems"
 							:key="item.id"
 							class="cn-setup-summary__item"
-							:class="{ 'cn-setup-summary__item--done': item.done }">
+							:class="{ 'cn-setup-summary__item--done': item.done, 'cn-setup-summary__item--not-run': item.notRun }">
 							<span class="cn-setup-summary__mark">{{ item.done ? '✓' : '○' }}</span>
 							<span class="cn-setup-summary__label">{{ item.title }}</span>
 							<span v-if="item.value" class="cn-setup-summary__value">{{ item.value }}</span>
@@ -380,7 +380,14 @@ export default {
 		 * a done marker (info steps always done; choice steps done when picked;
 		 * run-action steps done when the action succeeded).
 		 *
-		 * @return {Array<{ id: string, title: string, value: string, done: boolean }>}
+		 * An on-demand step (`onDemand: true`) is the exception: it is done
+		 * only when its action succeeded in THIS session. Apps report such a
+		 * step as `done` on purpose so it never auto-runs (learniq's "Remove
+		 * the example data"), and reading that flag here ticked a removal
+		 * nobody ran. When it did not run it gets `notRun: true` and the value
+		 * "Not run" instead.
+		 *
+		 * @return {Array<{ id: string, title: string, value: string, done: boolean, notRun: boolean }>}
 		 */
 		summaryItems() {
 			return this.setupSteps
@@ -399,6 +406,16 @@ export default {
 							.map((f) => `${f.label}: ${this.configModel[f.key] !== null && this.configModel[f.key] !== undefined ? this.configModel[f.key] : ''}`)
 							.join(', ')
 					}
+					if (this.isOnDemand(step)) {
+						const ran = this.ranThisSession(step.id)
+						return {
+							id: step.id,
+							title: this.stepTitle(step),
+							value: ran ? '' : t('nextcloud-vue', 'Not run'),
+							done: ran,
+							notRun: !ran,
+						}
+					}
 					let done
 					if (step.type === 'info') {
 						done = true
@@ -407,7 +424,7 @@ export default {
 					} else {
 						done = this.isStepDone(step.id)
 					}
-					return { id: step.id, title: this.stepTitle(step), value, done }
+					return { id: step.id, title: this.stepTitle(step), value, done, notRun: false }
 				})
 		},
 
@@ -427,7 +444,9 @@ export default {
 			if (this.completedStepIds.length === 0) {
 				return ''
 			}
-			const actionable = this.setupSteps.filter((s) => s.type !== 'info' && s.type !== 'summary')
+			// An on-demand step is never outstanding work, so it is never the
+			// step to resume on.
+			const actionable = this.setupSteps.filter((s) => s.type !== 'info' && s.type !== 'summary' && !this.isOnDemand(s))
 			const firstUnmetIndex = actionable.findIndex((s) => {
 				if (s.type === 'choice') {
 					return !(this.hasChoice(s) || this.isServerDone(s.id))
@@ -459,14 +478,16 @@ export default {
 		 * the step has nothing else for the user to decide by then (the
 		 * choice it acts on was already made on an earlier step), so
 		 * requiring a click before showing progress just adds a stall.
-		 * No-ops for any other step type, or one already run/running.
+		 * No-ops for any other step type, or one already run/running, and
+		 * never fires an on-demand step (`onDemand: true`): those run only
+		 * when the user clicks Run.
 		 *
 		 * @param {string} stepId The step id becoming current.
 		 * @return {void}
 		 */
 		maybeAutoRunStep(stepId) {
 			const step = this.setupSteps.find((s) => s.id === stepId)
-			if (step && step.type === 'run-action' && !this.isStepDone(step.id) && !this.running[step.id]) {
+			if (step && step.type === 'run-action' && !this.isOnDemand(step) && !this.isStepDone(step.id) && !this.running[step.id]) {
 				this.runAction(step)
 			}
 		},
@@ -847,6 +868,29 @@ export default {
 			}
 		},
 
+		/**
+		 * Whether a step is marked on-demand (`onDemand: true`): it runs only
+		 * when the user asks, never automatically, and the summary ticks it
+		 * only when it ran in this session.
+		 *
+		 * @param {object} step The manifest step.
+		 * @return {boolean}
+		 */
+		isOnDemand(step) {
+			return !!step && step.onDemand === true
+		},
+
+		/**
+		 * Whether a step's action succeeded in the CURRENT session, ignoring
+		 * whatever the server reports.
+		 *
+		 * @param {string} id Step id.
+		 * @return {boolean}
+		 */
+		ranThisSession(id) {
+			return !!(this.actionResult[id] && this.actionResult[id].success)
+		},
+
 		isStepDone(id) {
 			return this.isServerDone(id) || this.localDone[id] === true || (this.actionResult[id] && this.actionResult[id].success)
 		},
@@ -964,4 +1008,11 @@ export default {
 	font-weight: 600;
 	color: var(--color-main-text);
 }
+
+/* An on-demand step that did not run says so quietly: it is a choice the
+   user did not make, not a failure. */
+.cn-setup-summary__item--not-run .cn-setup-summary__value {
+	font-weight: normal;
+	color: var(--color-text-maxcontrast);
+}
 </style>

package/src/components/CnSpendAnalyticsWidget/CnSpendAnalyticsWidget.vue

@@ -145,7 +145,8 @@ const DEBOUNCE_MS = 200
  * Data origin (decoupling seam): all data flows through a consumer-supplied
  * `dataSource` prop OR the `cnSpendAnalyticsSource` injection — an object
  * exposing `fetchSummary(args)`, `fetchVendorCommitments(args)`,
- * `fetchNarrative(args)`, and optionally `resolveDeepLink(app, kind, id)`. The
+ * `fetchNarrative(args)`, and optionally `resolveDeepLink(app, kind, id)`
+ * (pure and synchronous: it runs for every row on every render). The
  * renderer imports NO financeq / procest / launchpad service module and never
  * calls axios itself; the consuming app (typically over GraphQL) owns the
  * transport. The `requires.graphql` hint lives only in the registry entry, not
@@ -182,8 +183,9 @@ export default {
 		 * Consumer-supplied data source overriding the
 		 * `cnSpendAnalyticsSource` injection. Must expose `fetchSummary`,
 		 * `fetchVendorCommitments`, and `fetchNarrative`; may expose
-		 * `resolveDeepLink`. When `null` the injection (then the empty state)
-		 * is used.
+		 * `resolveDeepLink`, which must be pure and synchronous, since it is
+		 * called for every row on every render. When `null` the injection
+		 * (then the empty state) is used.
 		 *
 		 * @type {object|null}
 		 */

package/src/components/CnTabs/CnTabs.vue

@@ -467,7 +467,11 @@ export default defineComponent({
 }
 
 /* A fade over the clipped edge, only on the side that hides tabs. Stops a
-   pixel above the bar's rule so the rule keeps its full colour. */
+   pixel above the bar's rule so the rule keeps its full colour.
+
+   z-index 2 so the fades outrank a lifted tab: CnTabsWidget puts the open tab
+   at 1, and a tie goes to DOM order, which would draw that tab over the start
+   fade (it precedes the tabs) while the end fade still covered it. */
 .cn-tabs__strip::before,
 .cn-tabs__strip::after {
 	content: '';
@@ -476,7 +480,7 @@ export default defineComponent({
 	pointer-events: none;
 	position: absolute;
 	width: 56px;
-	z-index: 1;
+	z-index: 2;
 }
 
 .cn-tabs__strip::before {
@@ -513,7 +517,7 @@ export default defineComponent({
 	padding: 0;
 	position: absolute;
 	width: 28px;
-	z-index: 2;
+	z-index: 3;
 }
 
 /* Nextcloud's `button:hover` rule would otherwise fill the chevron. */

package/src/components/CnTasksWidget/CnTasksWidget.vue

@@ -31,6 +31,7 @@
 					class="cn-tasks-widget__row"
 					:data-state="task.state"
 					@click="onRowClick(task, $event)"
+					@mousedown="preventMiddleClickAutoscroll"
 					@auxclick="onRowAuxClick(task, $event)">
 					<span class="cn-tasks-widget__body">
 						<span class="cn-tasks-widget__name">{{ titleOf(task) }}</span>
@@ -90,7 +91,7 @@ import { inject, ref } from 'vue'
 import { taskDeepLink, taskDueLabel } from '../../composables/indexSources.js'
 import { useEndpointSource } from '../../composables/useEndpointSource.js'
 import { openRowTarget } from '../../utils/linkNavigation.js'
-import { isRowMiddleClick } from '../../utils/rowAuxClick.js'
+import { isRowMiddleClick, preventMiddleClickAutoscroll } from '../../utils/rowAuxClick.js'
 
 /**
  * The OpenRegister inbox read (openregister flow-task-entity). One endpoint
@@ -367,6 +368,8 @@ export default {
 	},
 
 	methods: {
+		preventMiddleClickAutoscroll,
+
 		/**
 		 * Start (or restart) the refetch interval, unless polling is off.
 		 *

package/src/css/table.css

@@ -334,6 +334,32 @@
 	background-color: var(--color-primary-light);
 }
 
+/* A row with a route is a real link (see CnDataTable's row link): the anchor
+   in its first cell is stretched over the whole row. The row's own controls
+   sit above it so they stay usable; keep the list in step with NESTED_CONTROL
+   in utils/rowAuxClick.js. */
+.cn-table-row--linked {
+	position: relative;
+}
+
+.cn-table-row__link {
+	position: absolute;
+	inset: 0;
+	cursor: pointer;
+}
+
+.cn-table-row__link:focus-visible {
+	outline: 2px solid var(--color-main-text);
+	outline-offset: -2px;
+}
+
+.cn-table-row--linked .cn-table-col--checkbox,
+.cn-table-row--linked .cn-table-col--actions,
+.cn-table-row--linked td :is(a, button, input, select, textarea, label, summary, [role='button'], [role='checkbox'], [role='link'], [contenteditable='true']):not(.cn-table-row__link) {
+	position: relative;
+	z-index: 1;
+}
+
 /* Column Types */
 .cn-table-col--checkbox {
 	width: 50px;

package/src/integrations/builtin/analytics/CnAnalyticsCard.vue

@@ -122,7 +122,7 @@ import ChartPie from 'vue-material-design-icons/ChartPie.vue'
 import TableIcon from 'vue-material-design-icons/Table.vue'
 import ViewDashboard from 'vue-material-design-icons/ViewDashboard.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 5
@@ -287,8 +287,9 @@ export default {
 			return `cn-analytics-card__badge--type-${type ?? 'unknown'}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		reportUrl(report) {
-			if (report && report.url) {
+			if (report && report.url && safeHref(report.url) !== '#') {
 				return report.url
 			}
 			const id = this.reportKey(report)

package/src/integrations/builtin/analytics/CnAnalyticsTab.vue

@@ -82,8 +82,7 @@
 			<NcButton
 				variant="primary"
 				:href="analyticsAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ChartBar :size="20" />
 				</template>
@@ -131,8 +130,7 @@
 					<NcActionLink
 						:closeAfterClick="true"
 						:href="reportUrl(report)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -178,7 +176,7 @@ import ViewDashboard from 'vue-material-design-icons/ViewDashboard.vue'
 import CnAnalyticsReportCreate from '../../../components/CnAnalyticsReportCreate/CnAnalyticsReportCreate.vue'
 import CnAnalyticsReportPicker from '../../../components/CnAnalyticsReportPicker/CnAnalyticsReportPicker.vue'
 import CnStatusBadge from '../../../components/CnStatusBadge/CnStatusBadge.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnAnalyticsTab — bespoke dataset list for the `analytics` integration.
@@ -408,8 +406,9 @@ export default {
 			return t('nextcloud-vue', 'Latest value')
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		reportUrl(report) {
-			if (report && report.url) {
+			if (report && report.url && safeHref(report.url) !== '#') {
 				return report.url
 			}
 			const id = this.reportKey(report)

package/src/integrations/builtin/bookmarks/CnBookmarksCard.vue

@@ -34,9 +34,11 @@
 					@error="onFaviconError(entity)">
 				<Bookmark v-else :size="14" />
 				<a
+					v-if="hasSafeUrl(entity)"
 					:href="entity.url"
 					target="_blank"
 					rel="noopener noreferrer">{{ bookmarkTitle(entity) }}</a>
+				<span v-else>{{ bookmarkTitle(entity) }}</span>
 			</span>
 			<span v-else class="cn-bookmarks-card__empty">{{ emptyLabel }}</span>
 		</template>
@@ -62,9 +64,11 @@
 						@error="onFaviconError(mostRecent)">
 					<Bookmark v-else :size="14" />
 					<a
+						v-if="hasSafeUrl(mostRecent)"
 						:href="mostRecent.url"
 						target="_blank"
 						rel="noopener noreferrer">{{ bookmarkTitle(mostRecent) }}</a>
+					<span v-else>{{ bookmarkTitle(mostRecent) }}</span>
 				</div>
 				<div v-if="bookmarks.length > 1" class="cn-bookmarks-card__view-all">
 					<a
@@ -99,10 +103,12 @@
 					</div>
 					<div class="cn-bookmarks-card__row-main">
 						<a
+							v-if="hasSafeUrl(bookmark)"
 							:href="bookmark.url"
 							target="_blank"
 							rel="noopener noreferrer"
 							class="cn-bookmarks-card__title">{{ bookmarkTitle(bookmark) }}</a>
+						<span v-else class="cn-bookmarks-card__title">{{ bookmarkTitle(bookmark) }}</span>
 					</div>
 				</li>
 			</ul>
@@ -121,7 +127,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import Bookmark from 'vue-material-design-icons/Bookmark.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const COMPACT_LIMIT = 5
@@ -245,6 +251,11 @@ export default {
 			return bookmark.title || bookmark.url || ''
 		},
 
+		// Bookmark URLs are user-entered (bookmarklets are `javascript:`), so only a safe one is a link.
+		hasSafeUrl(bookmark) {
+			return safeHref(bookmark.url) !== '#'
+		},
+
 		chipSubtitle(bookmark) {
 			return bookmark.description || bookmark.url || this.bookmarkTitle(bookmark)
 		},

package/src/integrations/builtin/bookmarks/CnBookmarksTab.vue

@@ -57,8 +57,7 @@
 			<NcButton
 				variant="primary"
 				:href="bookmarksAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<Bookmark :size="20" />
 				</template>
@@ -92,8 +91,9 @@
 					:name="bookmarkTitle(bookmark)"
 					:bold="true"
 					:href="bookmarkHref(bookmark)"
-					target="_blank"
-					:forceDisplayActions="true">
+					:target="hasSafeUrl(bookmark) ? '_blank' : undefined"
+					:forceDisplayActions="true"
+					@click="onBookmarkClick(bookmark, $event)">
 					<template #icon>
 						<span class="cn-bookmarks-tab__row-icon">
 							<Bookmark :size="20" />
@@ -121,10 +121,10 @@
 					</template>
 					<template #actions>
 						<NcActionLink
+							v-if="hasSafeUrl(bookmark)"
 							:closeAfterClick="true"
 							:href="bookmarkHref(bookmark)"
-							target="_blank"
-							rel="noopener noreferrer">
+							target="_blank">
 							<template #icon>
 								<OpenInNew :size="20" />
 							</template>
@@ -393,6 +393,23 @@ export default {
 			return safeHref(bookmark.url)
 		},
 
+		/**
+		 * Whether the bookmark's URL passed `safeHref`, so its row is a link.
+		 *
+		 * @param {object} bookmark The bookmark row.
+		 * @return {boolean}
+		 */
+		hasSafeUrl(bookmark) {
+			return this.bookmarkHref(bookmark) !== '#'
+		},
+
+		// NcListItem always renders an anchor; one without a safe URL must not follow `#`.
+		onBookmarkClick(bookmark, event) {
+			if (!this.hasSafeUrl(bookmark)) {
+				event?.preventDefault?.()
+			}
+		},
+
 		bookmarkTags(bookmark) {
 			const tags = bookmark.tags
 			if (!Array.isArray(tags)) {

package/src/integrations/builtin/bookmarks/__tests__/CnBookmarksTab.spec.js

@@ -78,7 +78,7 @@ describe('CnBookmarksTab', () => {
 		expect(openLink.attributes('target')).toBe('_blank')
 	})
 
-	it('neutralises unsafe bookmark URL schemes in the row and action hrefs', async () => {
+	it('renders a bookmark with an unsafe URL as an inert row with no Open action', async () => {
 		global.fetch = jest.fn().mockResolvedValueOnce({
 			ok: true,
 			status: 200,
@@ -90,7 +90,12 @@ describe('CnBookmarksTab', () => {
 		await flushPromises()
 		const row = wrapper.find('.cn-bookmarks-tab__row')
 		expect(row.attributes('href')).toBe('#')
-		expect(row.find('.stub.NcActionLink').attributes('href')).toBe('#')
+		expect(row.attributes('target')).toBeUndefined()
+		expect(row.find('.stub.NcActionLink').exists()).toBe(false)
+
+		const event = { preventDefault: jest.fn() }
+		wrapper.vm.onBookmarkClick(wrapper.vm.filteredBookmarks[0], event)
+		expect(event.preventDefault).toHaveBeenCalled()
 		wrapper.unmount()
 	})
 

package/src/integrations/builtin/collectives/CnCollectivesCard.vue

@@ -126,7 +126,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import BookOpenPageVariant from 'vue-material-design-icons/BookOpenPageVariant.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
@@ -263,8 +263,9 @@ export default {
 			return typeof emoji === 'string' ? emoji.trim() : ''
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pageUrl(page) {
-			if (typeof page.url === 'string' && page.url !== '') {
+			if (typeof page.url === 'string' && page.url !== '' && safeHref(page.url) !== '#') {
 				return page.url
 			}
 			const d = this.dataOf(page)

package/src/integrations/builtin/collectives/CnCollectivesTab.vue

@@ -72,8 +72,7 @@
 			<NcButton
 				variant="primary"
 				:href="collectivesAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<BookOpenPageVariant :size="20" />
 				</template>
@@ -122,8 +121,7 @@
 							<NcActionLink
 								:closeAfterClick="true"
 								:href="pageUrl(page)"
-								target="_blank"
-								rel="noopener noreferrer">
+								target="_blank">
 								<template #icon>
 									<OpenInNew :size="20" />
 								</template>
@@ -168,7 +166,7 @@ import OpenInNew from 'vue-material-design-icons/OpenInNew.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnCollectivePageCreate from '../../../components/CnCollectivePageCreate/CnCollectivePageCreate.vue'
 import CnCollectivePagePicker from '../../../components/CnCollectivePagePicker/CnCollectivePagePicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const MS_PER_DAY = 24 * 60 * 60 * 1000
@@ -333,8 +331,9 @@ export default {
 			return text
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pageUrl(page) {
-			if (typeof page.url === 'string' && page.url !== '') {
+			if (typeof page.url === 'string' && page.url !== '' && safeHref(page.url) !== '#') {
 				return page.url
 			}
 			const d = this.dataOf(page)

package/src/integrations/builtin/cospend/CnCospendCard.vue

@@ -108,7 +108,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import CurrencyEur from 'vue-material-design-icons/CurrencyEur.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 
@@ -250,7 +250,7 @@ export default {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const projectId = row.projectId ?? row.project_id ?? row.data?.projectid ?? row.data?.project_id ?? null