Release: merge development into beta

appinfo/info.xml

@@ -50,7 +50,7 @@ Vrij en open source onder de EUPL-licentie.
 
 **Ondersteuning:** Voor ondersteuning, neem contact op via support@conduction.nl. Voor een Service Level Agreement (SLA), neem contact op via sales@conduction.nl.
     ]]></description>
-    <version>0.1.148-unstable.20260830155811</version>
+    <version>0.1.152-unstable.20260901111016</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Stackiq</namespace>

composer.json

@@ -104,7 +104,8 @@
         "optimize-autoloader": true,
         "sort-packages": true,
         "platform": {
-            "php": "8.3"
+            "php": "8.3",
+            "ext-xsl": "1"
         }
     }
 }

eslint-suppressions.json

@@ -4,6 +4,11 @@
       "count": 2
     }
   },
+  "src/components/CatalogPanels.vue": {
+    "no-console": {
+      "count": 10
+    }
+  },
   "src/components/CollapsibleSection.vue": {
     "vue/slot-name-casing": {
       "count": 1
@@ -431,17 +436,6 @@
       "count": 2
     }
   },
-  "src/views/Dashboard.vue": {
-    "@typescript-eslint/no-unused-vars": {
-      "count": 1
-    },
-    "no-console": {
-      "count": 10
-    },
-    "vue/multi-word-component-names": {
-      "count": 1
-    }
-  },
   "src/views/KwetsbaarhedenView.vue": {
     "@typescript-eslint/no-unused-vars": {
       "count": 1
@@ -542,4 +536,4 @@
       "count": 1
     }
   }
-}
+}

eslint.config.mjs

@@ -144,11 +144,32 @@ export default [
 			'no-console': 'off',
 			'n/no-process-exit': 'off',
 			'n/hashbang': 'off',
-			// `_` / `__` as a deliberate throwaway binding — `catch (_)`, a
-			// discarded destructuring slot. Narrow on purpose: the pattern matches
-			// UNDERSCORES ONLY, so a real name that happens to start with `_` is
-			// still reported. v9 drives plain `.js` through the CORE rule (the
-			// `@typescript-eslint` swap is per-file-type), so it is set here.
+			// Tests import devDependencies by definition; this rule is about what
+			// ships in the published package, which tests/ never does.
+			'n/no-unpublished-import': 'off',
+		},
+	},
+
+	{
+		// `_` / `__` as a deliberate throwaway binding — `catch (_)`, a discarded
+		// destructuring slot. Narrow on purpose: the pattern matches UNDERSCORES
+		// ONLY, so a real name that happens to start with `_` is still reported.
+		//
+		// 🔴 `.js` / `.mjs` ONLY, NOT `.ts`. The CORE rule is not TypeScript-aware:
+		// applied to a `.ts` file it reads the parameter NAMES inside a function
+		// TYPE as bindings and reports them unused. Measured on humaniq —
+		//
+		//   t?: (app: string, key: string) => string
+		//
+		// produced four `no-unused-vars` errors for `app` and `key`, which are
+		// documentation, not variables. The same mis-scoping made every unused
+		// `catch (e)` in a `.ts` spec report TWICE, once per rule.
+		//
+		// v9 already turns the core rule off for `.ts` and drives
+		// `@typescript-eslint/no-unused-vars` instead; naming `.ts` here switched
+		// it back on. TypeScript files are handled by the block below.
+		files: ['tests/**/*.js', 'tests/**/*.mjs'],
+		rules: {
 			'no-unused-vars': [
 				'error',
 				{
@@ -165,12 +186,117 @@ export default [
 					ignoreRestSiblings: true,
 				},
 			],
-			// Tests import devDependencies by definition; this rule is about what
-			// ships in the published package, which tests/ never does.
-			'n/no-unpublished-import': 'off',
 		},
 	},
 
+	{
+		// The TypeScript half of the block above. Same intent, same patterns, on
+		// the rule that actually understands the language: it knows a name inside
+		// a function type is not a binding, so type annotations stay quiet while a
+		// genuinely dead local is still reported.
+		files: ['tests/**/*.ts', 'tests/**/*.tsx'],
+		rules: {
+			'@typescript-eslint/no-unused-vars': [
+				'error',
+				{
+					varsIgnorePattern: '^_+$',
+					caughtErrors: 'all',
+					caughtErrorsIgnorePattern: '^_+$',
+					argsIgnorePattern: '^_',
+					ignoreRestSiblings: true,
+				},
+			],
+		},
+	},
+
+	{
+		// 🔴 Node-side CLI tooling under `scripts/`, which is COMMONJS. Flat
+		// config defaults every `.js` to ESM with browser-ish globals, so without
+		// this block eslint reports the CommonJS wrapper itself as undefined
+		// identifiers. Measured on this app: 52 of the 233 errors under
+		// `tests/` + `scripts/` were `no-undef`, ALL of them in `scripts/`, and
+		// all five names were the environment rather than a typo — `process` 23,
+		// `require` 20, `__dirname` 6, `__filename` 2, `module` 1.
+		//
+		// This is describing the environment, not relaxing a rule, and it is the
+		// same argument the test-globals block below makes: declaring them keeps
+		// `no-undef` able to do its real job, which is catching a genuinely
+		// misspelled identifier. Suppressing the rule instead would bury that.
+		//
+		// `no-console` is off because printing its report is what a CLI checker
+		// is FOR.
+		//
+		// 🔴 NO `n/*` ENTRIES HERE, DELIBERATELY. `eslint-plugin-n` is NOT
+		// registered for these files under eslint 10 + @nextcloud/eslint-config
+		// 9, so `'n/no-process-exit': 'off'` would be dead config that reads as
+		// if it were doing something. Measured both ways on this app: 0 `n/`
+		// findings with the entries and 0 without.
+		//
+		// What DID report was the opposite — four `scripts/*.js` carried
+		// `/* eslint-disable n/no-process-exit */` and `/* eslint-disable
+		// n/shebang */` left over from the eslintrc era, and an inline disable
+		// naming an unregistered plugin is itself an error ("Definition for rule
+		// 'n/shebang' was not found"). Those 8 comments are removed; do not add
+		// `n/*` rules back to replace them.
+		//
+		// ⚠️ `.js` and `.cjs` ONLY. A `scripts/*.mjs` is genuinely ESM and must
+		// keep the default `sourceType`, or `import` stops parsing there.
+		files: ['scripts/**/*.js', 'scripts/**/*.cjs'],
+		languageOptions: {
+			sourceType: 'commonjs',
+			globals: {
+				require: 'readonly',
+				module: 'writable',
+				exports: 'writable',
+				process: 'readonly',
+				__dirname: 'readonly',
+				__filename: 'readonly',
+				console: 'readonly',
+				Buffer: 'readonly',
+				global: 'readonly',
+				URL: 'readonly',
+				TextEncoder: 'readonly',
+				TextDecoder: 'readonly',
+			},
+		},
+		rules: {
+			'no-console': 'off',
+		},
+	},
+
+	{
+		// The ESM half of the block above. A `scripts/*.mjs` is genuinely a module
+		// and must keep the default `sourceType`, so it gets Node's globals but
+		// none of the CommonJS wrapper. Measured: `process` reported undefined 2x
+		// in hermiq's generate-opengemeenten-icons.mjs and 4x in openregister's
+		// l10n/runtime-check.mjs, which the `.js`/`.cjs` block deliberately does
+		// not match.
+		files: ['scripts/**/*.mjs', 'tests/**/*.mjs'],
+		languageOptions: {
+			globals: {
+				process: 'readonly',
+				console: 'readonly',
+				Buffer: 'readonly',
+				global: 'readonly',
+				URL: 'readonly',
+				TextEncoder: 'readonly',
+				TextDecoder: 'readonly',
+			},
+		},
+		rules: {
+			'no-console': 'off',
+		},
+	},
+
+	{
+		// eslint must not try to PARSE a shell script. `tests/e2e/seed.test.sh`
+		// matches the `**/*.test.*` glob some presets use, and eslint then reads
+		// it as JavaScript and reports "Parsing error: Unexpected character" —
+		// a finding about a file it should never have opened.
+		ignores: ['**/*.sh', '**/*.bash'],
+	},
+
+
 	{
 		// Test globals. Several apps keep their spec files INSIDE `src/`, which the
 		// lint script scans, and neither `@nextcloud/eslint-config` nor the runner

l10n/nl.js

@@ -758,7 +758,9 @@ OC.L10N.register(
         "Flow": "Flow",
         "Where the automation lives": "Waar de automatisering zit",
         "Flows are what happens without anyone clicking: a reminder before a deadline passes, a confirmation sent on submission. This is where you read and edit them. Nothing to build now.": "Flows zijn wat er gebeurt zonder dat iemand klikt: een herinnering voordat een termijn verstrijkt, een bevestiging bij indiening. Hier lees en bewerk je ze. Je hoeft nu niets te bouwen.",
-        "Open Flows in the menu": "Open Flows in het menu"
+        "Open Flows in the menu": "Open Flows in het menu",
+        "Modules": "Modules",
+        "Object statistics": "Object statistieken"
     },
     "nplurals=2; plural=(n != 1);"
 )

l10n/nl.json

@@ -757,6 +757,8 @@
         "Flow": "Flow",
         "Where the automation lives": "Waar de automatisering zit",
         "Flows are what happens without anyone clicking: a reminder before a deadline passes, a confirmation sent on submission. This is where you read and edit them. Nothing to build now.": "Flows zijn wat er gebeurt zonder dat iemand klikt: een herinnering voordat een termijn verstrijkt, een bevestiging bij indiening. Hier lees en bewerk je ze. Je hoeft nu niets te bouwen.",
-        "Open Flows in the menu": "Open Flows in het menu"
+        "Open Flows in the menu": "Open Flows in het menu",
+        "Modules": "Modules",
+        "Object statistics": "Object statistieken"
     }
 }

lib/Controller/ModerationController.php

@@ -70,7 +70,7 @@ public function __construct(
 	/**
 	 * List the pending entries (of `type`) awaiting moderation.
 	 *
-	 * @param string $type The moderated object type ('organization', default, or 'assessment').
+	 * @param string $type The moderated object type ('organization', default, or 'software-review').
 	 *
 	 * @return JSONResponse `{ok, items}` or a 400.
 	 *
@@ -92,7 +92,7 @@ public function pending(string $type = ModerationService::MODERATED_TYPE): JSONR
 	 * Approve a pending entry (of `type`).
 	 *
 	 * @param string $uuid The entry uuid.
-	 * @param string $type The moderated object type ('organization', default, or 'assessment').
+	 * @param string $type The moderated object type ('organization', default, or 'software-review').
 	 *
 	 * @return JSONResponse `{ok, status}` or a 400.
 	 *
@@ -114,7 +114,7 @@ public function approve(string $uuid, string $type = ModerationService::MODERATE
 	 * Reject a pending entry (of `type`).
 	 *
 	 * @param string $uuid The entry uuid.
-	 * @param string $type The moderated object type ('organization', default, or 'assessment').
+	 * @param string $type The moderated object type ('organization', default, or 'software-review').
 	 *
 	 * @return JSONResponse `{ok, status}` or a 400.
 	 *

lib/Repair/RenameDutchSchemaSlugs.php

@@ -69,7 +69,7 @@ class RenameDutchSchemaSlugs implements IRepairStep {
 	 * @var array<string, string>
 	 */
 	public const SLUG_MAP = [
-		'beoordeeling' => 'assessment',
+		'beoordeeling' => 'software-review',
 		'bioMaatregel' => 'bioMeasure',
 		'contactpersoon' => 'contactPerson',
 		'dienst' => 'service',

lib/Service/ModerationService.php

@@ -63,7 +63,7 @@ class ModerationService {
 	/**
 	 * The review moderated catalog object type.
 	 */
-	public const MODERATED_TYPE_REVIEW = 'assessment';
+	public const MODERATED_TYPE_REVIEW = 'software-review';
 
 	/**
 	 * Pending (awaiting moderation) state — shared field value across types.

lib/Service/ReviewAggregateService.php

@@ -43,7 +43,7 @@ class ReviewAggregateService {
 	/**
 	 * The catalog object type reviews live on.
 	 */
-	public const REVIEW_TYPE = 'assessment';
+	public const REVIEW_TYPE = 'software-review';
 
 	/**
 	 * Public-visible moderation state.

lib/Service/ReviewService.php

@@ -47,7 +47,7 @@ class ReviewService {
 	/**
 	 * The catalog object type reviews live on.
 	 */
-	public const REVIEW_TYPE = 'assessment';
+	public const REVIEW_TYPE = 'software-review';
 
 	/**
 	 * Moderation state of a freshly-submitted review — mirrors

lib/Service/SettingsService.php

@@ -119,7 +119,7 @@ class SettingsService {
 	 * @var array<string, string>
 	 */
 	public const LEGACY_SCHEMA_KEY = [
-		'assessment' => 'beoordeeling_schema',
+		'software-review' => 'beoordeeling_schema',
 		'bioMeasure' => 'bioMaatregel_schema',
 		'connection' => 'koppeling_schema',
 		'contactPerson' => 'contactpersoon_schema',
@@ -300,7 +300,7 @@ public function getSettings(): array {
 					'usage',
 					'contract',
 					'connection',
-					'assessment',
+					'software-review',
 					'module',
 					'compliancy',
 					'moduleVersion',
@@ -907,7 +907,7 @@ public function getSchemaIdForObjectType(string $objectType): ?int {
 			// (`koppeling_gebruik_schema`). Renaming a subset would resolve some
 			// types and silently leave others reporting "not configured", which is
 			// how the ratings feature died once already. Tracked as its own change.
-			'assessment' => 'beoordeeling_schema',
+			'software-review' => 'beoordeeling_schema',
 			'service' => 'dienst_schema',
 			'usage' => 'gebruik_schema',
 			'contract' => 'contract_schema',
@@ -4039,7 +4039,7 @@ private function configureVoorzieningen(): array {
 				'usage',
 				'contract',
 				'connection',
-				'assessment',
+				'software-review',
 				'module',
 				'compliancy',
 				'moduleversie',
@@ -4143,7 +4143,7 @@ private function configureVoorzieningen(): array {
 				'usage' => 'gebruik_schema',
 				'contract' => 'contract_schema',
 				'connection' => 'koppeling_schema',
-				'assessment' => 'beoordeeling_schema',
+				'software-review' => 'beoordeeling_schema',
 				'module' => 'module_schema',
 				'compliancy' => 'compliancy_schema',
 				'moduleversie' => 'moduleVersie_schema',