@eeacms/volto-eea-design-system 1.60.8 → 1.61.1

package/.gitleaks.toml

@@ -0,0 +1,101 @@
+title = "Betterleaks config"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "secret-literal-assignment"
+description = "Secret-like literal assignment in source, YAML, env and config files"
+regex = '''(?i)([A-Za-z0-9_.-]*(?:password|passwd|pwd|api[_-]?key|apikey|access[_-]?key|secret[_-]?access[_-]?key|private[_-]?key|client[_-]?secret|consumer[_-]?key|consumer[_-]?secret|(?:auth|access|refresh|session|api|bearer|id|jwt|csrf|xsrf|oauth)[_-]?token|translate[_-]?auth|translation[_-]?auth|auth[_-]?password|auth[_-]?key|auth[_-]?credentials|database[_-]?url|connection[_-]?string)[A-Za-z0-9_.-]*)[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
+secretGroup = 2
+keywords = [
+  "password",
+  "passwd",
+  "pwd",
+  "api_key",
+  "apikey",
+  "access_key",
+  "private_key",
+  "client_secret",
+  "consumer_key",
+  "consumer_secret",
+  "auth_token",
+  "access_token",
+  "refresh_token",
+  "session_token",
+  "api_token",
+  "bearer_token",
+  "id_token",
+  "jwt_token",
+  "csrf_token",
+  "xsrf_token",
+  "oauth_token",
+  "translate_auth",
+  "translation_auth",
+  "auth_password",
+  "auth_key",
+  "auth_credentials",
+  "database_url",
+  "connection_string"
+]
+tags = ["literal-secret"]
+
+[[rules]]
+id = "env-short-secret-assignment"
+description = "Uppercase env-style PASS/TOKEN/SECRET assignment"
+regex = '''\b((?:PASS|TOKEN|SECRET|[A-Z0-9_]*(?:_PASS|_TOKEN|_SECRET|PASS_|TOKEN_|SECRET_)[A-Z0-9_]*))[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
+secretGroup = 2
+keywords = [
+  "PASS",
+  "TOKEN",
+  "SECRET"
+]
+tags = ["env", "literal-secret"]
+
+[[rules]]
+id = "standalone-sk-token"
+description = "Standalone sk-* token not attached to a secret-like variable name"
+regex = '''(?i)\b(sk-[A-Za-z0-9][A-Za-z0-9_-]{20,})\b'''
+secretGroup = 1
+entropy = 2.5
+keywords = ["sk-"]
+tags = ["standalone-token", "generic"]
+
+[[rules]]
+id = "dotenv-only-jest-setup"
+description = ".env may only contain the committed Jest setup lines"
+path = '''(?i)(^|/)\.env$'''
+regex = '''(?m)^(.+)$'''
+secretGroup = 1
+tags = ["file", "dotenv"]
+[[rules.allowlists]]
+regexTarget = "match"
+regexes = [
+  '''^JEST_USE_SETUP=OFF # Jest configuration variables: ON, OFF\r?$''',
+]
+
+[[rules]]
+id = "forbidden-secret-file"
+description = "Forbidden secret-bearing file committed to repository"
+path = '''(?i)(^|/)(\.env\..*|\.npmrc|\.pypirc|id_rsa|id_ed25519|.*\.(pem|key|p12|pfx|jks|kubeconfig))$'''
+regex = '''(?s).{1,}'''
+tags = ["file", "secret-file"]
+
+[[allowlists]]
+description = "Allow Jenkins SonarQube token environment variable reference"
+regexTarget = "match"
+regexes = [
+  '''SONAR_AUTH_TOKEN''',
+]
+
+[[allowlists]]
+description = "Allow generated documentation assets"
+paths = [
+  '''^docs/assets/''',
+]
+
+[[allowlists]]
+description = "Semantic UI flag stylesheet uses ISO country-code selectors like `.pw:before` (Palau), not credentials"
+paths = [
+  '''(^|/)theme/themes/eea/elements/flag\.overrides$''',
+]

package/CHANGELOG.md

@@ -4,7 +4,30 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
-### [1.60.8](https://github.com/eea/volto-eea-design-system/compare/1.60.7...1.60.8) - 10 June 2026
+### [1.61.1](https://github.com/eea/volto-eea-design-system/compare/1.61.0...1.61.1) - 7 September 2026
+
+#### :bug: Bug Fixes
+
+- fix: make the AI summary toggle hook SSR-safe - refs #307513 [Miu Razvan - [`bc0afda`](https://github.com/eea/volto-eea-design-system/commit/bc0afdae8d934989dda8bde07714be4a545a3aac)]
+
+#### :hammer_and_wrench: Others
+
+- listing documentation [Dobricean Ioan Dorian - [`5785e17`](https://github.com/eea/volto-eea-design-system/commit/5785e175a1ee3fca2291607bf08736719cfe20f6)]
+### [1.61.0](https://github.com/eea/volto-eea-design-system/compare/1.60.8...1.61.0) - 7 September 2026
+
+#### :bug: Bug Fixes
+
+- fix: Add betterleaks github action - refs #304517 [dobri1408 - [`dd4b4da`](https://github.com/eea/volto-eea-design-system/commit/dd4b4da5ef18454ac76c1cbff1e2a7d5baa5c550)]
+
+#### :house: Internal changes
+
+- chore(gitleaks): allowlist flag.overrides stylesheet [Claudia Ifrim - [`d3ac637`](https://github.com/eea/volto-eea-design-system/commit/d3ac637ed1396c04e600971abf50b26ae3bcdaa3)]
+- chore: [JENKINSFILE] sanitize sonarqube command Refs #305084 [valentinab25 - [`c933e31`](https://github.com/eea/volto-eea-design-system/commit/c933e31abf8b564a4d11f860e8df93ad86edff51)]
+
+#### :hammer_and_wrench: Others
+
+- test: pin Chromium version 149 to work with Cypress [valentinab25 - [`0be5062`](https://github.com/eea/volto-eea-design-system/commit/0be5062d18dcff0350c7e37a2b42ae82be66cd63)]
+### [1.60.8](https://github.com/eea/volto-eea-design-system/compare/1.60.7...1.60.8) - 11 June 2026
 
 #### :bug: Bug Fixes
 

package/README.md

@@ -119,6 +119,65 @@ See [RELEASE.md](https://github.com/eea/volto-eea-design-system/blob/master/RELE
 
 See [DEVELOP.md](https://github.com/eea/volto-eea-design-system/blob/master/DEVELOP.md).
 
+## Secret Scanning
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+`.gitleaks.toml` and uploads a `betterleaks-report` artifact when a finding is
+detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- `SMTP_URL`
+- `SMTP_PORT` (optional, defaults to `25`)
+- `SMTP_EMAIL`
+- `SMTP_PASSWORD` (optional if the SMTP server does not require authentication)
+
+Port `465` is sent with direct TLS; other ports use the default SMTP handshake.
+The email includes a short finding summary from the redacted Betterleaks report,
+including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. **Everything is OK.** The `Betterleaks / Scan for secrets` check is green and
+   no action is needed. Regular references to runtime values are OK, for example:
+
+   ```js
+   const tokenFromCookie = req.universalCookies.get('auth_token');
+   ```
+
+2. **A real secret was found.** The check is red and the workflow log asks you to
+   download the `betterleaks-report` artifact. Open the artifact from the GitHub
+   Actions run and check the reported file, line and rule. Remove the committed
+   value, move it to the proper secret store, and rotate it if it was exposed.
+   A report entry looks like this:
+
+   ```json
+   {
+     "RuleID": "secret-literal-assignment",
+     "File": "src/config.js",
+     "StartLine": 12,
+     "Secret": "[REDACTED]"
+   }
+   ```
+
+3. **The finding is a false positive.** Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   `betterleaks:allow` on the same line and include a short explanation in the
+   pull request.
+
+   ```js
+   const testPassword = 'admin'; //betterleaks:allow
+   ```
+
+   ```yaml
+   password: "admin" #betterleaks:allow
+   ```
+
+Do not add `betterleaks:allow` to real credentials.
+
 ## Copyright and license
 
 The Initial Owner of the Original Code is European Environment Agency (EEA).

package/RELEASE.md

@@ -33,7 +33,7 @@ Release-it is a tool that automates 4 important steps in the release process:
 To configure the authentification, you need to export GITHUB_TOKEN for [GitHub](https://github.com/settings/tokens)
 
    ```
-   export GITHUB_TOKEN=XXX-XXXXXXXXXXXXXXXXXXXXXX
+   export GITHUB_TOKEN="${GITHUB_TOKEN}"
    ```
 
  To configure npm, you can use the `npm login` command or use a configuration file with a TOKEN :

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eeacms/volto-eea-design-system",
-  "version": "1.60.8",
+  "version": "1.61.1",
   "description": "@eeacms/volto-eea-design-system: Volto add-on",
   "main": "src/index.js",
   "author": "European Environment Agency: IDM2 A-Team",

package/src/ui/Header/Header.jsx

@@ -16,6 +16,7 @@ import burgerIcon from '@eeacms/volto-eea-design-system/../theme/themes/eea/asse
 
 import HeaderSearchPopUp from './HeaderSearchPopUp';
 import HeaderMenuPopUp from './HeaderMenuPopUp';
+import { useAISummaryToggle } from './useAISummaryToggle';
 import { findBestMatchingMenuItem, isMenuItemActive } from './utils';
 import PropTypes from 'prop-types';
 import omit from 'lodash/omit';
@@ -166,7 +167,12 @@ const Main = ({
       state.reduxAsyncConnect?.headerSettings?.useAISearchIcon || false,
   );
 
-  const searchIcon = useAISearchIcon ? aiSearchIcon : searchSVG;
+  const [aiSummaryEnabled] = useAISummaryToggle();
+
+  // The AI sparkle only shows when the AI search icon is configured and
+  // the user has not opted out of AI summaries.
+  const searchIcon =
+    useAISearchIcon && aiSummaryEnabled ? aiSearchIcon : searchSVG;
 
   const itemsLayouts =
     menuItemsLayouts || config.settings?.menuItemsLayouts || {};

package/src/ui/Header/Header.test.jsx

@@ -770,3 +770,58 @@ test('menu click outside behavior with different active states', async () => {
   expect(burgerButton).toHaveAttribute('aria-expanded', 'false');
   expect(searchButton).toHaveAttribute('aria-expanded', 'false');
 });
+
+describe('header search icon and AI summary state', () => {
+  const renderMain = () =>
+    renderWithProvider(
+      <Router history={createMemoryHistory()}>
+        <Header>
+          <Header.Main
+            pathname="/test"
+            menuItems={[
+              { '@id': '/test', url: '/test', title: 'Test', items: [] },
+            ]}
+            renderGlobalMenuItem={(item) => (
+              <a href={item.url} title={item.title}>
+                {item.title}
+              </a>
+            )}
+          />
+        </Header>
+      </Router>,
+    );
+
+  beforeEach(() => {
+    window.localStorage.clear();
+    mockState.reduxAsyncConnect.headerSettings.useAISearchIcon = false;
+  });
+
+  it('shows the plain magnifier when useAISearchIcon is false', () => {
+    const { container } = renderMain();
+    expect(container.querySelector('img[alt="Global search"]')).toHaveAttribute(
+      'src',
+      'search-line.svg',
+    );
+  });
+
+  it('shows the AI sparkle when useAISearchIcon is true and AI summaries are enabled', () => {
+    mockState.reduxAsyncConnect.headerSettings.useAISearchIcon = true;
+
+    const { container } = renderMain();
+    expect(container.querySelector('img[alt="Global search"]')).toHaveAttribute(
+      'src',
+      'ai-search.svg',
+    );
+  });
+
+  it('shows the plain magnifier when useAISearchIcon is true but AI summaries are disabled', () => {
+    mockState.reduxAsyncConnect.headerSettings.useAISearchIcon = true;
+    window.localStorage.setItem('eea-ai-summary-enabled', '0');
+
+    const { container } = renderMain();
+    expect(container.querySelector('img[alt="Global search"]')).toHaveAttribute(
+      'src',
+      'search-line.svg',
+    );
+  });
+});

package/src/ui/Header/HeaderSearchPopUp.js

@@ -9,6 +9,7 @@ import { handleEnterKeyPress } from '@eeacms/volto-eea-design-system/helpers';
 
 import searchSVG from '@eeacms/volto-eea-design-system/../theme/themes/eea/assets/images/Header/search-line.svg';
 import aiSearchIcon from '@eeacms/volto-eea-design-system/../theme/themes/eea/assets/images/Header/ai-search.svg';
+import { useAISummaryToggle } from './useAISummaryToggle';
 
 const getRandomItems = (arr, max) => {
   return (
@@ -96,7 +97,12 @@ function HeaderSearchPopUp({
       state.reduxAsyncConnect?.headerSettings?.useAISearchIcon || false,
   );
 
-  const searchIcon = useAISearchIcon ? aiSearchIcon : searchSVG;
+  const [aiSummaryEnabled] = useAISummaryToggle();
+
+  // The AI sparkle only shows when the AI search icon is configured and
+  // the user has not opted out of AI summaries.
+  const searchIcon =
+    useAISearchIcon && aiSummaryEnabled ? aiSearchIcon : searchSVG;
 
   useEffect(() => {
     setVisibileSuggestions(getRandomItems(suggestions, maxToShow));

package/src/ui/Header/HeaderSearchPopUp.test.js

@@ -248,4 +248,53 @@ describe('HeaderSearchPopUp', () => {
     expect(screen.getByPlaceholderText('Search')).toBeInTheDocument();
     expect(screen.queryByText('Suggestions Title')).not.toBeInTheDocument();
   });
+
+  describe('search icon and AI summary state', () => {
+    beforeEach(() => {
+      window.localStorage.clear();
+      mockState.reduxAsyncConnect.headerSettings.useAISearchIcon = false;
+    });
+
+    const renderPopup = () =>
+      render(
+        <Provider store={mockStore}>
+          <Router history={history}>
+            <HeaderSearchPopUp
+              headerSearchBox={sampleHeaderSearchBox}
+              onClose={mockOnClose}
+              triggerRefs={[]}
+            />
+          </Router>
+        </Provider>,
+      );
+
+    it('shows the plain magnifier when useAISearchIcon is false', () => {
+      const { container } = renderPopup();
+      expect(container.querySelector('img')).toHaveAttribute(
+        'src',
+        'search-line.svg',
+      );
+    });
+
+    it('shows the AI sparkle when useAISearchIcon is true and AI summaries are enabled', () => {
+      mockState.reduxAsyncConnect.headerSettings.useAISearchIcon = true;
+
+      const { container } = renderPopup();
+      expect(container.querySelector('img')).toHaveAttribute(
+        'src',
+        'ai-search.svg',
+      );
+    });
+
+    it('shows the plain magnifier when useAISearchIcon is true but AI summaries are disabled', () => {
+      mockState.reduxAsyncConnect.headerSettings.useAISearchIcon = true;
+      window.localStorage.setItem('eea-ai-summary-enabled', '0');
+
+      const { container } = renderPopup();
+      expect(container.querySelector('img')).toHaveAttribute(
+        'src',
+        'search-line.svg',
+      );
+    });
+  });
 });

package/src/ui/Header/useAISummaryToggle.js

@@ -0,0 +1,63 @@
+import { useCallback, useEffect, useState } from 'react';
+
+/**
+ * AI Summary opt-in/opt-out state.
+ *
+ * Shared contract with the AI summary gating in
+ * @eeacms/volto-searchlib (lib/aiSummaryToggle):
+ * - the header search icons in this addon use the state to decide between
+ *   the AI sparkle and the plain magnifier
+ * - the advanced-search AI Summary box (volto-searchlib) hosts the
+ *   user-facing opt-in/opt-out controls
+ * - localStorage key: `eea-ai-summary-enabled` ("1" on, "0" off, default on)
+ * - CustomEvent `eea:ai-summary-toggle` (detail: boolean) for same-tab sync
+ * - native `storage` event for cross-tab sync
+ */
+
+export const AI_SUMMARY_STORAGE_KEY = 'eea-ai-summary-enabled';
+export const AI_SUMMARY_TOGGLE_EVENT = 'eea:ai-summary-toggle';
+
+// The hooks render during SSR, where window/localStorage do not exist;
+// storage access defaults to the enabled state until the client re-reads it.
+const getStorage = () =>
+  typeof window === 'undefined' ? null : window.localStorage;
+
+export const readAISummaryEnabled = (storage = getStorage()) =>
+  storage ? storage.getItem(AI_SUMMARY_STORAGE_KEY) !== '0' : true;
+
+export const writeAISummaryEnabled = (enabled, storage = getStorage()) => {
+  if (!storage) return;
+  storage.setItem(AI_SUMMARY_STORAGE_KEY, enabled ? '1' : '0');
+  window.dispatchEvent(
+    new CustomEvent(AI_SUMMARY_TOGGLE_EVENT, { detail: enabled }),
+  );
+};
+
+export const useAISummaryToggle = () => {
+  const [enabled, setEnabled] = useState(readAISummaryEnabled);
+
+  useEffect(() => {
+    const onToggleEvent = (event) => {
+      if (typeof event?.detail === 'boolean') setEnabled(event.detail);
+    };
+    const onStorageEvent = (event) => {
+      if (event.key === AI_SUMMARY_STORAGE_KEY) {
+        setEnabled(event.newValue !== '0');
+      }
+    };
+    window.addEventListener(AI_SUMMARY_TOGGLE_EVENT, onToggleEvent);
+    window.addEventListener('storage', onStorageEvent);
+    return () => {
+      window.removeEventListener(AI_SUMMARY_TOGGLE_EVENT, onToggleEvent);
+      window.removeEventListener('storage', onStorageEvent);
+    };
+  }, []);
+
+  const toggle = useCallback(() => {
+    const next = !readAISummaryEnabled();
+    writeAISummaryEnabled(next);
+    setEnabled(next);
+  }, []);
+
+  return [enabled, toggle];
+};