@conduction/nextcloud-vue 2.58.0 → 2.60.0

package/src/utils/fetchFilterCounts.js

@@ -0,0 +1,182 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * fetchFilterCounts: how many records each of a set of filters matches, in as
+ * few requests as the API allows.
+ *
+ * Quick filters and saved views usually differ in ONE field (`status: open`,
+ * `status: closed`, ...). Those are answered by one `/grouped` request on that
+ * field. A filter that narrows on something else (two fields, an operator, a
+ * list of values) cannot be read off a grouped result, so each of those costs
+ * one `/value` count. A filter that holds a LIST of values is counted through
+ * the list endpoint, because the aggregation endpoints cannot express it.
+ * Nothing is requested for an entry that did not ask.
+ *
+ * @module utils/fetchFilterCounts
+ */
+
+import { fetchAggregateValue, fetchGroupedCounts } from './fetchAggregate.js'
+import { buildHeaders, buildQueryString, prefixUrl } from './headers.js'
+import { resolveFilterTokens } from './resolveFilterTokens.js'
+
+/**
+ * Whether a filter holds a list of values (`{ status: ['open', 'hold'] }`).
+ *
+ * The aggregation endpoints have no spelling for "one of these values", so a
+ * filter like this is never sent to them. It is counted through the list
+ * endpoint instead, which is where the page's own request sends it.
+ *
+ * @param {object} filter A filter map.
+ * @return {boolean} True when any value is an array.
+ * @spec openspec/changes/workplace-dashboard-primitives/specs/workplace-dashboard-primitives/spec.md#requirement-counts-on-filters-and-views
+ */
+export function hasListValue(filter) {
+	if (!filter || typeof filter !== 'object') {
+		return false
+	}
+	return Object.values(filter).some((value) => Array.isArray(value))
+}
+
+/**
+ * Count the records a filter matches by asking the LIST endpoint for one
+ * record and reading its `total`. The filter is sent the way the list request
+ * sends it: a list of values as repeated `field[]=`, an operator as
+ * `field[op]=`.
+ *
+ * @param {string} register The register slug.
+ * @param {string} schema The schema slug.
+ * @param {object} filter The filter map.
+ * @param {object} [ctx] Token-resolution context for the filter.
+ * @return {Promise<number|null>} The total, or null when the response carries none.
+ * @spec openspec/changes/workplace-dashboard-primitives/specs/workplace-dashboard-primitives/spec.md#requirement-counts-on-filters-and-views
+ */
+export async function fetchListTotal(register, schema, filter, ctx) {
+	const resolved = resolveFilterTokens(filter || {}, ctx || {})
+	const params = {}
+	for (const [key, value] of Object.entries(resolved || {})) {
+		if (value && typeof value === 'object' && !Array.isArray(value)) {
+			for (const [op, operand] of Object.entries(value)) {
+				params[`${key}[${op}]`] = operand
+			}
+		} else {
+			params[key] = value
+		}
+	}
+	const qs = buildQueryString({ ...params, _limit: 1 })
+	const url = prefixUrl(`/apps/openregister/api/objects/${encodeURIComponent(register)}/${encodeURIComponent(schema)}${qs}`)
+	const response = await fetch(url, { headers: buildHeaders() })
+	if (!response.ok) {
+		throw new Error(`list returned ${response.status}`)
+	}
+	const data = await response.json()
+	return typeof data.total === 'number' ? data.total : null
+}
+
+/**
+ * The single field a filter narrows on with a plain equality, or null when the
+ * filter is anything else.
+ *
+ * @param {object} filter A filter map.
+ * @return {{field: string, value: string}|null} The field and the value it must equal.
+ * @spec openspec/changes/workplace-dashboard-primitives/specs/workplace-dashboard-primitives/spec.md#requirement-counts-on-filters-and-views
+ */
+export function singleEqualityOf(filter) {
+	if (!filter || typeof filter !== 'object' || Array.isArray(filter)) {
+		return null
+	}
+	const keys = Object.keys(filter)
+	if (keys.length !== 1) {
+		return null
+	}
+	const value = filter[keys[0]]
+	if (value === null || value === undefined || value === '' || typeof value === 'object') {
+		return null
+	}
+	// A token (`@me`, `@today`) resolves to a value the grouped keys are
+	// compared against only after resolution, which the count request does.
+	if (typeof value === 'string' && value.charAt(0) === '@') {
+		return null
+	}
+	return { field: keys[0], value: String(value) }
+}
+
+/**
+ * Count the records each entry's filter matches.
+ *
+ * @param {object} options The request.
+ * @param {string} options.register The register slug.
+ * @param {string} options.schema The schema slug.
+ * @param {Array<{key: (string|number), filter: object}>} options.entries The filters to count, each under its own key.
+ * @param {object} [options.baseFilter] A filter every count is narrowed by (the page's fixed filter).
+ * @param {object} [options.ctx] Token-resolution context for the filters.
+ * @return {Promise<{[key: string]: number}>} The count per entry key. An entry whose count failed is left out.
+ * @spec openspec/changes/workplace-dashboard-primitives/specs/workplace-dashboard-primitives/spec.md#requirement-counts-on-filters-and-views
+ */
+export async function fetchFilterCounts({ register, schema, entries, baseFilter, ctx } = {}) {
+	const counts = {}
+	if (!register || !schema || !Array.isArray(entries) || entries.length === 0) {
+		return counts
+	}
+	const base = (baseFilter && typeof baseFilter === 'object') ? baseFilter : {}
+
+	// Entries that share one equality field go into one grouped request, but
+	// only when at least two do: a lone entry costs one request either way,
+	// and `/value` returns exactly its number.
+	// A list of values anywhere in a request rules the aggregation endpoints
+	// out for it. A base filter with one rules them out for every entry.
+	const baseHasList = hasListValue(base)
+	const byField = {}
+	const single = []
+	const viaList = []
+	for (const entry of entries) {
+		if (baseHasList || hasListValue(entry.filter)) {
+			viaList.push(entry)
+			continue
+		}
+		const eq = singleEqualityOf(entry.filter)
+		if (eq !== null && !(eq.field in base)) {
+			(byField[eq.field] = byField[eq.field] || []).push({ entry, value: eq.value })
+		} else {
+			single.push(entry)
+		}
+	}
+	const jobs = []
+	for (const [field, members] of Object.entries(byField)) {
+		if (members.length < 2) {
+			single.push(members[0].entry)
+			continue
+		}
+		jobs.push(fetchGroupedCounts({ register, schema, groupBy: field, filter: base }, ctx)
+			.then((groups) => {
+				const map = {}
+				for (const group of groups) {
+					map[group.key] = group.count
+				}
+				for (const member of members) {
+					counts[member.entry.key] = map[member.value] || 0
+				}
+			})
+			.catch(() => {}))
+	}
+	for (const entry of single) {
+		jobs.push(fetchAggregateValue({ register, schema, metric: 'count', filter: { ...base, ...(entry.filter || {}) } }, ctx)
+			.then((value) => {
+				if (value !== null && Number.isFinite(Number(value))) {
+					counts[entry.key] = Number(value)
+				}
+			})
+			.catch(() => {}))
+	}
+	for (const entry of viaList) {
+		jobs.push(fetchListTotal(register, schema, { ...base, ...(entry.filter || {}) }, ctx)
+			.then((total) => {
+				if (total !== null) {
+					counts[entry.key] = total
+				}
+			})
+			.catch(() => {}))
+	}
+	await Promise.all(jobs)
+	return counts
+}

package/src/utils/index.js

@@ -11,6 +11,7 @@ export { safeHref, safeImageSrc, safeSvgPath } from './safeHref.js'
 export { followLinkClick, isModifiedClick, openRowTarget, resolveHref } from './linkNavigation.js'
 export { isNewTabHandled, isRowMiddleClick } from './rowAuxClick.js'
 export { resolveImageUrl } from './resolveImageUrl.js'
+export { resolveDateVariant } from './dateVariant.js'
 export { compareVisibleWhen, evaluateVisibleWhen, evaluateVisibleWhenLocal, isLocallyDecidableVisibleWhen, readVisibleWhenPath } from './visibleWhen.js'
 export { validateFieldValue } from './formValidation.js'
 export { computeObjectDiff } from './computeObjectDiff.js'

package/src/utils/libraryWidgetKeys.js

@@ -93,10 +93,12 @@ export const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'calendar',
 	'chart',
 	'container',
+	'conversation',
 	'countdown',
 	'data',
 	'delta',
 	'divider',
+	'document-review',
 	'files',
 	'flow-runs',
 	'gauge',
@@ -110,6 +112,7 @@ export const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'map',
 	'menu',
 	'nc-widget',
+	'next-step',
 	// `news` was here until the widget moved to LaunchPad, which owns the feed
 	// fetching. An app that renders one now gets it from LaunchPad's registry.
 	'object-geo',
@@ -119,6 +122,7 @@ export const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'quicklinks',
 	'related',
 	'spend-analytics',
+	'stacked-bar',
 	'stages',
 	'stat',
 	'stats-block',
@@ -128,6 +132,7 @@ export const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'text',
 	'tile',
 	'video',
+	'week-strip',
 	'workspace-filter',
 ])
 

package/src/utils/linkNavigation.js

@@ -69,8 +69,11 @@ export function resolveHref(target, router) {
  * click is routed through the router; a modified click, or one a handler
  * already prevented, is left to the browser.
  *
+ * Unlike `resolveHref`, a string target is a router path, so pair the two
+ * with a location object (or `{ path }`) for the href and click to agree.
+ *
  * @param {MouseEvent} event The click event.
- * @param {string|object} target The router location the link points at.
+ * @param {string|object} target The router location the link points at; a string is a router path.
  * @param {object} [router] The app's router.
  * @return {boolean} True when the app navigated.
  */
@@ -96,8 +99,8 @@ export function followLinkClick(event, target, router) {
  *
  * A click that came from a control inside the surface (a button, a link, a
  * checkbox) is left to that control. Opening a new tab marks the event with
- * `preventDefault()`, and an event already marked that way is skipped, so
- * two listeners on the same click never open two tabs.
+ * `markNewTabHandled`, and an event already marked is skipped, so two
+ * listeners on the same click never open two tabs.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {string|object} target A URL, or a vue-router location.

package/src/utils/readPath.js

@@ -0,0 +1,27 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * readPath: read a dot-path off an object.
+ *
+ * Its own module, with no imports, so the rules that read a record's fields
+ * (stage, checklist, due date) do not hang on a module a host or a test may
+ * replace.
+ *
+ * @module utils/readPath
+ */
+
+/**
+ * Read a dot-path (`'a.b.c'`) off an object.
+ *
+ * @param {object|null} data The source object.
+ * @param {string} [path] Dot-path into the object. Empty returns the object itself.
+ * @return {unknown} The value at the path, or undefined when a segment is missing.
+ * @spec openspec/changes/detail-action-model-and-case-surfaces/specs/detail-action-model/spec.md#requirement-primary-action-follows-the-stage
+ */
+export function readPath(data, path) {
+	if (!path) {
+		return data
+	}
+	return String(path).split('.').reduce((value, key) => (value === null || value === undefined ? value : value[key]), data)
+}

package/src/utils/rowAuxClick.js

@@ -9,13 +9,17 @@
  * also fire `auxclick` for the right button, so a row that listens to it must
  * filter both out itself.
  *
- * Whoever opens a row in a new tab calls `preventDefault()` on the event, so a
- * second listener for the same click (a host behind a library default) can
+ * Whoever opens a row in a new tab marks the event with `markNewTabHandled`, so
+ * a second listener for the same click (a host behind a library default) can
  * check `isNewTabHandled` and not open a second tab.
  *
  * @module utils/rowAuxClick
  */
 
+// Events that opened a new tab. Not `defaultPrevented`, which any unrelated
+// handler can set on a modified or middle click.
+const newTabHandled = new WeakSet()
+
 const NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role="button"], [role="checkbox"], [role="link"], [contenteditable="true"]'
 
 /**
@@ -49,6 +53,21 @@ export function isRowMiddleClick(event) {
 	return Boolean(event && event.button === 1 && !isFromNestedControl(event))
 }
 
+/**
+ * Cancel a middle-button press on a clickable row or card body, so the
+ * browser does not start autoscroll (Chrome/Edge on Windows) instead of the
+ * middle click opening the row. A press on a nested control, a link
+ * included, keeps its default.
+ *
+ * @param {MouseEvent} event The mousedown event.
+ * @return {void}
+ */
+export function preventMiddleClickAutoscroll(event) {
+	if (event && event.button === 1 && !isFromNestedControl(event) && typeof event.preventDefault === 'function') {
+		event.preventDefault()
+	}
+}
+
 /**
  * Whether `openRowTarget` would open this click in a new tab.
  *
@@ -66,18 +85,24 @@ export function isNewTabClick(event) {
  * @return {boolean}
  */
 export function isNewTabHandled(event) {
-	return Boolean(isNewTabClick(event) && event.defaultPrevented)
+	return Boolean(isNewTabClick(event) && newTabHandled.has(event))
 }
 
 /**
  * Mark a new-tab click as handled after opening it, see `isNewTabHandled`.
+ * Also prevents the event's default, so the browser does not act on the
+ * click as well.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {boolean} opened Whether the target was opened.
  * @return {void}
  */
 export function markNewTabHandled(event, opened) {
-	if (opened && isNewTabClick(event) && typeof event.preventDefault === 'function') {
+	if (!opened || !isNewTabClick(event)) {
+		return
+	}
+	newTabHandled.add(event)
+	if (typeof event.preventDefault === 'function') {
 		event.preventDefault()
 	}
 }

package/src/utils/safeHref.js

@@ -18,6 +18,20 @@
  * @module utils/safeHref
  */
 
+/**
+ * Whether a URL is protocol-relative the way a browser reads it: leading
+ * control characters and spaces are dropped, tabs and newlines are ignored
+ * anywhere, and a backslash counts as `/`.
+ *
+ * @param {string} url The URL.
+ * @return {boolean}
+ */
+function isProtocolRelative(url) {
+	// eslint-disable-next-line no-control-regex
+	const normalized = url.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+/, '')
+	return /^[/\\]{2}/.test(normalized)
+}
+
 /**
  * Validate a URL and return it only if the scheme is safe for `:href`.
  *
@@ -30,7 +44,8 @@
  *   - `javascript:...`
  *   - `data:...`
  *   - `vbscript:...`
- *   - Protocol-relative `//attacker.com/...` (ambiguous origin)
+ *   - Protocol-relative `//attacker.com/...` (ambiguous origin), also as
+ *     `/\attacker.com` or with leading whitespace
  *   - Any other unrecognised scheme
  *   - `null`, `undefined`, empty string
  *
@@ -52,7 +67,7 @@ export function safeHref(url) {
 	}
 	// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative
 	// path but resolves to an arbitrary origin, bypassing same-origin intent.
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return '#'
 	}
 	// Allow root-relative paths (same-origin navigation)
@@ -97,7 +112,7 @@ export function safeImageSrc(url) {
 		return url
 	}
 	// Reject protocol-relative
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return ''
 	}
 	try {