fix(ui)+test: QA UI bugs (#216 #218) + test coverage (#206 #204 #192) #230

Ghost · 2026-06-27T06:17:23+03:00

Ghost commented

2026-06-27 06:17:23 +03:00

Объединяет 5 ишью: фиксы UI-багов (#216, #218) + тест-покрытие (#206, #204, #192).

Фиксы UI-багов (#216 / #218)

[sec] Публичный share не привязан к shareId (#218): контент теперь требует валидный shareId (страница должна быть достижима ЧЕРЕЗ этот share — свой share или includeSubPages-предок); поддельный shareId → 404. Остаток (намеренно): путь БЕЗ shareId (легаси /share/p/:slug + page-info {pageId}) — это унаследованный Docmost capability-URL дизайн, не расширял.
[data-loss] Пустое тело новой страницы до connect collab (#218): editable теперь дополнительно гейтится на !showStatic (isBodyEditable) — редактор не может стать редактируемым до синка; + аффорданс «Connecting… (read-only)» вместо тихого проглатывания ввода.
[sec] Утечка метаданных page-info (#218): ответ урезан до публичной проекции (убраны creatorId/spaceId/workspaceId/contributorIds/timestamps/...).
Breadcrumb пустой на глубоких страницах (#218): фолбэк на собственную цепочку предков страницы (/pages/breadcrumbs), пока ленивое дерево не подгрузилось.
Вставка > [!info] → callout (#218): paste-путь прогоняет конвертер коллаутов (GitHub-алиасы + типы редактора).
share-to-web includeSubPages по умолчанию → false (#216): теперь opt-in.
flushSync warning (#216): DEFERRED — это внутреннее TipTap (dev-only), фикс реинтродьюсит flicker-регрессию #1295. Задокументировано.

Тесты (#206 / #204 / #192)

#192: интеграционные AiChatService.stream (onError-персист, MCP-клиент закрывается ровно раз на обоих путях, анти-тампер истории из БД). 1 слайс (onAbort mid-stream) честно остаётся непокрытым.
#206: 6 находок уже зафикшены+покрыты (через #212); 2 data-loss дописаны тестами (mdrt-2 turndown drop, persist-6 empty-overwrite — оставлены it.fails, фикс = продуктовое решение). Найден+починен баг getInternalLinkPageName (extensionless link → пустой текст).
#204: high-priority подмножество (MCP lease-lifecycle, data-integrity pure-fns, table-utils, и т.д.). Остальной план — задокументированный тест-долг.

tsc (client+server) exit 0; интеграционный сьют + новые unit/vitest зелёные.

Closes #216 #218; covers #206 #204 #192 (остаток — тест-долг в описании).

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

🤖 Generated with Claude Code

Объединяет 5 ишью: фиксы UI-багов (#216, #218) + тест-покрытие (#206, #204, #192). ## Фиксы UI-багов (#216 / #218) - **[sec] Публичный share не привязан к shareId** (#218): контент теперь требует валидный shareId (страница должна быть достижима ЧЕРЕЗ этот share — свой share или includeSubPages-предок); поддельный shareId → 404. Остаток (намеренно): путь БЕЗ shareId (легаси `/share/p/:slug` + `page-info {pageId}`) — это унаследованный Docmost capability-URL дизайн, не расширял. - **[data-loss] Пустое тело новой страницы до connect collab** (#218): editable теперь дополнительно гейтится на `!showStatic` (`isBodyEditable`) — редактор не может стать редактируемым до синка; + аффорданс «Connecting… (read-only)» вместо тихого проглатывания ввода. - **[sec] Утечка метаданных page-info** (#218): ответ урезан до публичной проекции (убраны creatorId/spaceId/workspaceId/contributorIds/timestamps/...). - **Breadcrumb пустой на глубоких страницах** (#218): фолбэк на собственную цепочку предков страницы (`/pages/breadcrumbs`), пока ленивое дерево не подгрузилось. - **Вставка `> [!info]` → callout** (#218): paste-путь прогоняет конвертер коллаутов (GitHub-алиасы + типы редактора). - **share-to-web includeSubPages по умолчанию → false** (#216): теперь opt-in. - **flushSync warning** (#216): DEFERRED — это внутреннее TipTap (dev-only), фикс реинтродьюсит flicker-регрессию #1295. Задокументировано. ## Тесты (#206 / #204 / #192) - **#192**: интеграционные `AiChatService.stream` (onError-персист, MCP-клиент закрывается ровно раз на обоих путях, анти-тампер истории из БД). 1 слайс (onAbort mid-stream) честно остаётся непокрытым. - **#206**: 6 находок уже зафикшены+покрыты (через #212); 2 data-loss дописаны тестами (mdrt-2 turndown drop, persist-6 empty-overwrite — оставлены `it.fails`, фикс = продуктовое решение). Найден+починен баг `getInternalLinkPageName` (extensionless link → пустой текст). - **#204**: high-priority подмножество (MCP lease-lifecycle, data-integrity pure-fns, table-utils, и т.д.). Остальной план — задокументированный тест-долг. tsc (client+server) exit 0; интеграционный сьют + новые unit/vitest зелёные. Closes #216 #218; covers #206 #204 #192 (остаток — тест-долг в описании). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Ghost added 2 commits 2026-06-27 06:17:23 +03:00

fix(qa): resolve UI bugs from #216 and #218 22852be2e2

Public sharing (#218):
- Bind public-share content to the requested shareId. getSharedPage now
  enforces dto.shareId (forwarded from /share/:shareId/p/:slug): the page must
  be reachable THROUGH that exact share (its own share, or an includeSubPages
  ancestor that contains it). A forged/mismatched shareId 404s instead of
  rendering off the slug alone and no longer leaks the real canonical key via
  redirect. A request with no shareId keeps the legacy slug-capability path.
- Trim /shares/page-info: drop internal metadata (creatorId, spaceId,
  workspaceId, contributorIds, lastUpdated*, parent/position, lock/template
  flags, timestamps) from the anonymous payload.
- Default share-to-web includeSubPages to false (opt-in), so enabling a share
  no longer silently exposes the whole sub-tree (#216).

Editor (#218):
- Harden the new-page pre-sync window: the body editor is kept read-only until
  the collab provider is Connected and synced, so early keystrokes can't land
  only in local ProseMirror and then be clobbered by the server's empty doc.
- Surface a "Connecting… (read-only)" affordance during the static phase so
  input isn't silently swallowed.

Other:
- Breadcrumb: resolve from the page's own ancestor data (/pages/breadcrumbs)
  instead of waiting for the lazily-built sidebar tree, so deep pages don't
  render a blank breadcrumb for seconds.
- Pasting GitHub `> [!type]` callouts now converts to a callout node instead of
  a literal blockquote (new marked extension wired into markdownToHtml).

Tests: editor-sync-state gate (client), getSharedPage share-binding (server),
github-callout markdown conversion (editor-ext).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(coverage): add regression tests for issues #192 , #206 , #204 2d36641f28

Additive test coverage across server, editor-ext, client and mcp.

#192 — AiChatService.stream integration (Section 3, against real Postgres):
- new apps/server/test/integration/ai-chat-stream.int-spec.ts drives the real
  streamText through a seeded ai/test MockLanguageModelV3 and a real Node
  ServerResponse, covering: onError persists an assistant error record
  (status 'error' + partial answer + provider cause in metadata); external MCP
  client closed exactly once on BOTH onFinish and onError; anti-tamper —
  history is rebuilt from the DB transcript, not from body.messages.

#206 — red-team findings (most already fixed+tested in #212):
- mdrt-2 (UNFIXED, data loss): turndown.dataloss.test.ts documents that
  pageBreak / transclusionReference / mention are silently dropped on Markdown
  export (characterization + it.fails for the desired survive-export contract).
- persist-6 (UNFIXED, data loss): persistence-store.spec.ts adds an it.failing
  documenting that a momentarily-empty live doc overwrites non-empty content
  (left unfixed — a store-side empty-guard is a behaviour change).

#204 — test-strategy plan, highest-priority subset:
- Phase 1: mcp-clients.lease.spec.ts covers the external MCP client
  lease/refcount/eviction lifecycle (leak / premature-close / double-close).
- Phase 2 data-integrity pure functions: editor-ext table-utils
  (transpose/moveRow/convert round-trip) and math tokenizer false-positive
  guard; client emoji-menu (+ it.fails for the unguarded localStorage
  JSON.parse bug), sort-cells, normalizeTableColumnWidths; mcp htmlEmbed/
  pageBreak markdown data-loss + footnote-diff; server export
  getInternalLinkPageName extensionless-path bug — FIXED (small/clear) + tested.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Ghost referenced this issue from a commit

2026-06-27 20:10:18 +03:00

fix(review): address PR #230 review — payload type, breadcrumb helper, tests

Ghost added 1 commit 2026-06-27 20:10:18 +03:00

fix(review): address PR #230 review — payload type, breadcrumb helper, tests c9d252cf2a

Review follow-ups for the combined QA-UI fixes (#216/#206/#204/#218/#192):

- export/utils: correct the misleading getInternalLinkPageName comment — a
  bare `v1.2` loses its last dot-segment (`v1`); dots survive only in
  multi-segment names like `v1.2.md` -> `v1.2`.
- share: extract toPublicSharePayload(page, share): PublicSharePayload, an
  explicit allowlist type+mapper replacing the inline literal in the
  /shares/page-info anonymous path (#218). Add share.controller.spec.ts that
  stubs getSharedPage returning internal fields and asserts the response key
  set EXACTLY equals the whitelist (page + share), so any `...shareData`
  regression or new leaking field fails. Also key-tests the extracted mapper.
- breadcrumb: extract pure resolveBreadcrumbNodes(treeData, ancestors, pageId)
  (tree-hit -> tree; tree-miss -> map ancestors via canonical pageToTreeNode,
  dropping the as-any casts; else null) and unit-test all three branches.
- share-modal: RTL test asserting enabling a share calls mutateAsync with
  includeSubPages: false (#216 security default).
- share.service: one-line note at getSharedPage on the deferred consolidation
  of the ancestor-aware match into resolveReadableSharePage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Ghost referenced this issue from a commit

2026-06-27 21:32:15 +03:00

fix(review): address #230 re-review — stale breadcrumb, swallowed error, i18n, docs

Ghost added 1 commit 2026-06-27 21:32:15 +03:00

fix(review): address #230 re-review — stale breadcrumb, swallowed error, i18n, docs 525172104a

Approve-with-comments follow-ups:

- breadcrumb: fix the reverse regression where navigating A->B to a page absent
  from the lazily-built tree (before its ancestors load) left the previous
  page's clickable chain on screen. New pure computeBreadcrumbState clears a
  stale chain that doesn't end at the current page, while keeping one that does
  (no blank flash for an already-resolved page); unit-tested for the
  navigated-to-absent-page case.
- share.service: getShareAncestorPage no longer swallows DB errors silently —
  now a live public-share path (isPageReachableThroughShare), so a transient
  error is logged with ancestor/child ids and still fails closed (caller 404s)
  instead of becoming a traceless misleading "not found".
- i18n: register the new "Connecting… (read-only)" key (U+2026 ellipsis) in
  en-US (source of truth) and ru-RU (Подключение… (только чтение)).
- share.service: correct the FUTURE note — 3 callers pass no shareId
  (share-alias.controller/.service, share-seo.controller); the two ai-chat
  callers already pass a real shareId.
- CHANGELOG: add Unreleased Changed/Fixed/Security entries for #216 opt-in
  sub-pages default, #218 trimmed page-info payload + forged-shareId 404, #204
  export internal-link name, #206/#218 breadcrumb, #192 callout paste, #218
  editor pre-sync read-only gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Ghost referenced this issue from a commit

2026-06-27 22:11:40 +03:00

refactor(review): address #230 third review — callout dedup, ticket/type tidy

Ghost added 1 commit 2026-06-27 22:11:40 +03:00

refactor(review): address #230 third review — callout dedup, ticket/type tidy 40d1cdfc77

Approve-with-comments follow-ups (no blockers):

- callout: unify the GitHub-callout feature ticket on #192 (the callout-paste
  feature the CHANGELOG already tracks); #218 is the public-share security work.
  Fixed the code comment and test reference.
- export/utils.spec: pin current behavior of a leading-dot name (".gitignore" ->
  "") — same bug class as #204 but unreachable via the sole caller, so document
  not change.
- share.types: narrow ISharedPage to the actual /shares/page-info allowlist
  (page -> Pick of id/slugId/title/icon/content; trimmed share; dropped the
  spurious `extends IShare`). Verified all three consumers (shared-page,
  link-view, mention-view) read only allowlist fields.
- editor-ext: extract shared CALLOUT_TYPES / normalizeCalloutType /
  renderCalloutHtml into callout-common.marked.ts; both tokenizers
  (`:::type` and `> [!type]`) now share the renderer + type dict while staying
  separate. Eliminates the byte-identical renderer + duplicated type list.
- share.service: extract named predicate shareIdGrantsAccess(requestedShareId,
  resolvedShare) for the id-or-key fast path (naming only, no control-flow
  change); kept narrower than resolveReadableSharePage's id-only gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>