feat(connections): the breach check reads Switched off through its switch, and the formatters come from nextcloud-vue 3.2.0

[rubenvdlinde]

What changes

The Breach check row on the Integrations page now reads Switched off while an admin has the breach check off. It used to read Not configured. The two connection formatters now come from @conduction/nextcloud-vue instead of a local copy.

Refs hydra#677, integriq#2024, nextcloud-vue#1173 and nextcloud-vue#1175.

The switch

hibp in lib/Settings/connections.json swaps requiredConfig for a switch:

"switch": { "configKey": "breach_check_enabled" },
"disabledMessage": "Breach checking is switched off. Switch it on under Breach checking in the Keepiq admin settings.",
"unconfiguredMessage": "Not checked yet. Keepiq reports here after the next password check reaches Have I Been Pwned."

• breach_check_enabled is a plain boolean in app config, so there is no jsonPath.
• It defaults to off (getValueBool(..., false) in BreachProxyController). An unset key and a stored false both read as empty, so no offValues is needed: empty means off, which is what keepiq means too.
• On screen: switched off, the row reads Switched off ("Uitgeschakeld") with the message above. Switched on, it reads Not checked yet until a lookup reports. Before, the same row read Not configured when off, and Configured with "Required settings are filled." when on, before anything had been checked.
• SIEM stays reportedOnly, with no switch. Sinks are records, not one setting. When sinks exist and all of them are off, keepiq now reports disabled itself with a message that names no host. With no sink at all it still reports unconfigured.
• The declaration is valid under ajv 2020 against connections.schema.json from integriq development, and the vendored fixture in tests/fixtures/Integriq/ matches that file.

The library move

• @conduction/nextcloud-vue ^2.41.1 to ^3.2.0 (3.2.0 locked). 3.2.0 maps disabled to Switched off and ships the Dutch "Uitgeschakeld".
• src/services/connectionRegistry.js keeps only the Add integration handler. App.vue no longer passes formatters, so CnAppRoot supplies the built-ins.
• tests/vitest/connectionRegistry.spec.js imports BUILT_IN_FORMATTERS from the installed library and calls it: connectionStatus('disabled') must return Switched off. An earlier version read the module source with a regex, which answers about the file and not about what the page renders. The import reaches @nextcloud/auth, so the file runs on jsdom.
• Lockfile: a plain npm install. A first try with --legacy-peer-deps dropped all 84 peer entries. Against development, only @conduction/nextcloud-vue moves at the top level, and one Dexie (4.4.5) stays in the tree.
• development is merged in (fix(tests): two #706 tests that could not pass in CI #717, fix(tests): declare the classes the connection report tests use #719), not rebased.

What 2.x to 3.x touches in keepiq

I read CHANGELOG.md on nextcloud-vue main.

• News widget removed (the one breaking change). No CnNewsWidget, CnNewsWidgetForm or news widget type anywhere in src.
• Tiles without colours render untinted. The Dashboard's three quick-action tiles all set backgroundColor and textColor at the top level, so they look the same.
• Detail page headerActions move into the Actions menu. No detail page declares headerActions. The only headerActions sit on the Integrations index page, which already rendered them in the menu.
• External navigate actions open as links. No manifest action navigates to an external URL.
• marked, dompurify, dexie and @vueuse/core are peers. All four are declared and inside the peer ranges (marked 12.0.2 against >=12 <19).

Verified

Check	Result
Mutation, on committed code	Adding "offValues": ["false"] to the hibp switch, which would read an unset key as on, reddened ConnectionsDeclarationTest::testTheBreachCheckDeclaresItsSwitch at its assertSame on line 283. Restored, git status clean.
npm run build	exit 0 (3 webpack size warnings, inherited)
npm run lint	exit 0, 0 errors (167 warnings, inherited)
npm test (vitest)	exit 0, 929 of 929 in 126 files
hydra/scripts/diff-check.sh	GREEN at 02af7d2: gates, php -l, phpcs, phpstan, phpunit, eslint and stylelint PASS, 0 new, 0 inherited
composer check:strict	exit 0, ALL CHECKS PASSED: lint, phpcs (0 errors), phpmd, psalm, phpstan, and PHPUnit 1329 tests (9 skipped)

Not verified

• No deploy, no occ, no Playwright. tests/e2e/workflows/integrations-page.spec.ts now expects disabled while off and unconfigured with Not checked yet while on. It was not run here.
• The Integrations page was not opened against a live integriq.
• CI was not watched.

Inherited and environmental findings

• None of the checks above found anything on a line this PR touches. The warnings that remain are older: 167 eslint warnings, phpcs warnings, and webpack's size warnings (keepiq-main.js at 7.17 MiB).
• The three Dashboard tiles hardcode their colours (#21468B, #3b82f6, #6b7280). That predates this PR and belongs in a theming sweep.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/keepiq @ e6991f2

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		❌
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 111/111
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					✅

---

Quality workflow — 2026-09-16 09:55 UTC

Download the full PDF report from the workflow artifacts.