web-mojo 2.5.6 → 2.5.8

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+### Admin · Group Auth Config editor (`GroupView` → Auth Config)
+
+`GroupView` gains an **Auth Config** side-nav section (under the **Detail** divider, before **Metadata**, gated by the `sys.groups` / `sys.manage_groups` permission) for editing a group's `metadata.auth_config` — the structured config that drives the django-mojo–hosted login, registration, and passkey pages. Previously this was only editable as raw JSON through the generic Metadata section.
+
+- **`GroupAuthConfigSection`** (`src/extensions/admin/account/groups/GroupAuthConfigSection.js`) is a `View` that embeds one `FormView` with a 3-tab `tabset`:
+  - **Theme** — text inputs for `app_title`, `logo_url`, `favicon_url`, `hero_image_url`, `hero_headline`, `hero_subheadline`, `back_to_website_url`, `terms_url`, `api_base`, `success_redirect`, `custom_css_url`; a `layout` select; a `custom_css` textarea.
+  - **Login** — a multiselect for `login.methods` (password / sms / passkey / magic / google / apple).
+  - **Registration** — an `enabled` toggle, `passkey_prompt` / `identity_field` selects, a `min_age` number, a `methods` multiselect, and a fixed 6-row grid for `registration.fields` (include / required / verify per canonical field; the `password` row is locked on).
+- **Inherit-aware.** Each field shows the group's own override if set, otherwise the resolved/inherited value fetched once from `GET /api/auth/config?group_uuid=<uuid>`; text fields show the resolved value as placeholder. Only fields changed from that baseline are saved, so untouched fields keep inheriting.
+- **Standard CRUD.** Saves a nested `{ metadata: { auth_config: {…} } }` via `model.save()` — django deep-merges the `metadata` JSONField, so sibling keys (timezone, domain, portal, …) survive. Server validation errors surface as a toast.
+
 ### Core · Detail Views can size their own row-view modal via `ViewClass.DIALOG_OPTIONS`
 
 Dense detail Views (`UserView`, `GroupView`, …) opened as a row-view dialog were stuck at `Modal.dialog()`'s default `size: 'lg'`. The only way to widen them was to repeat `viewDialogOptions: { size: 'xl' }` in every TablePage / TableView / ListView that opened the View — easy to forget, and the View itself (which actually knows how much room it needs) had no say.
@@ -38,12 +49,13 @@ Operators previously had no UI for the `account.WebhookSubscription` rows that l
 ### Admin · Phone Config page (Twilio / AWS / Mojo) + downstream API-key provisioning
 
 - **New `system/phonehub/config` page** registered under System → Phone Hub → **Config** (icon `bi-sliders`), gated on `manage_phone_config` / `manage_groups`. Per-row Provider / Active / Test Mode badges and column filters; default sort `-modified`; default filter `is_active=true`. Per `planning/done/admin-phone-config-mojo-provider.md`.
-- **Single combined create/edit form driven by `showWhen`.** One PhoneConfig record carries a `provider` select that reveals only the matching credential block: **Twilio** (`twilio_from_number`, `twilio_account_sid`, `twilio_auth_token`), **AWS SNS** (`aws_region`, `aws_sender_id`, `aws_access_key_id`, `aws_secret_access_key`), or **Mojo Remote** (`mojo_remote_url`, `mojo_api_key`). Hidden showWhen fields are auto-stripped from `getFormData()`, so switching providers and saving never bleeds the prior provider's typed-but-unsaved secret to the server.
+- **Read-only `PhoneConfigView` detail + three-dots context menu** (mirrors `ApiKeyView`): header with provider / active / test badges, then Configuration / provider-settings / Metadata sections. All mutations live on the context menu — Edit, Test connection, Provision API key, Delete — rather than a button bar.
+- **Single combined create/edit form driven by `showWhen`.** Both the table Add flow and the context-menu Edit open one form whose `provider` select reveals only the matching credential block: **Twilio** (`twilio_from_number`, `twilio_account_sid`, `twilio_auth_token`), **AWS SNS** (`aws_region`, `aws_sender_id`, `aws_access_key_id`, `aws_secret_access_key`), or **Mojo Remote** (`mojo_remote_url`, `mojo_api_key`). Hidden showWhen fields are auto-stripped from `getFormData()`, so switching providers and saving never bleeds the prior provider's typed-but-unsaved secret to the server. `PhoneConfig.FORM_DIALOG_CONFIG` opens the dialog at `lg` width.
 - **Secrets are write-only.** Password inputs render with a `••••••••` placeholder; blank-on-save is stripped client-side via `PhoneConfig.SECRET_FIELDS` so an empty input never overwrites a stored credential. Backend response graphs already exclude the encrypted blob, so GET → form-prefill never round-trips a value.
-- **Test Connection button** on saved rows posts `{test_connection: 1}` through `Model.save` (same endpoint), surfaces `data.message` inline in a green banner on success or `data.error` in red — disabled while in-flight, replaced by a spinner.
+- **Test connection** posts `{test_connection: 1}` through `Model.save` (same endpoint) and surfaces the result inline in the detail view — green banner with `message` on success, red banner with the friendly-mapped error on failure.
 - **Provision downstream API key flow** (Mojo provider rows only, gated on `manage_groups` / `manage_group`). Tailored one-purpose dialog with fixed permissions `{send_sms: true, comms: true}`; raw token revealed once in a dismissal-protected alert with copy-to-clipboard, then never shown again. Reuses the existing `ApiKey` model and its `resp.data.data.token` one-time pattern.
 - **Cross-link from SMS table.** Provider chip on `system/phonehub/sms` is now value-mapped (twilio=info, aws=warning, mojo=primary) and Mojo rows render as a clickable anchor that navigates to `system/phonehub/config?provider=mojo&group=<sms.group.id>`. New `error_code` column with friendly labels for `timeout` / `http_<status>` / `remote_error` / `remote_failed` / `config_error` / credential codes.
-- **No new framework primitives.** Pure admin-extension wiring around the existing `Model`, `Collection`, `FormView` (showWhen), `TablePage`, and `Modal.show/alert/form` surfaces. New files: `src/extensions/admin/messaging/sms/PhoneConfigTablePage.js`, `src/extensions/admin/messaging/sms/PhoneConfigView.js`. `PhoneConfig` model + `PhoneConfigForms` live alongside the existing PhoneNumber / SMS wrappers in `src/extensions/admin/models/Phonehub.js`.
+- **No new framework primitives.** Pure admin-extension wiring around the existing `Model`, `Collection`, `FormView` (showWhen), `TablePage`, `ContextMenu`, and `Modal.show/alert/form` surfaces. New files: `src/extensions/admin/messaging/sms/PhoneConfigTablePage.js`, `src/extensions/admin/messaging/sms/PhoneConfigView.js`. `PhoneConfig` model + `PhoneConfigForms` live alongside the existing PhoneNumber / SMS wrappers in `src/extensions/admin/models/Phonehub.js`.
 
 ### Admin · GroupView Identity section exposes UUID (view + copy + edit + generate)