fix(deps): bump @conduction/nextcloud-vue to 2.1.0-vue3.15 — non-admins can use the app - #87
Merged
Merged
Conversation
…ns can use the app Picks up ConductionNL/nextcloud-vue#576: a 401/403 from /api/setup/status now empties the unmet-steps lists, so a non-admin is no longer shown the first-time-setup wizard. Why this bump matters more than the version delta suggests: after #81 gave non-admins OpenRegister-level read on the schemas, an editor still could not use OpenBuild. They landed on "Welcome to OpenBuild / Set up this app" with .openbuild-schema-list count 0 — the setup endpoints are admin-only, they answer 403, and useSetupStatus read that as "setup unfinished". Also corrects a drift found on the way: node_modules held 2.1.0-vue3.7 while package.json and the lockfile both said 2.1.0-vue3.13. Nobody had run an install since that bump, so local builds were linking a library three versions behind the pin. This commit was built from a clean `npm ci`. New: tests/e2e/non-admin-access.spec.ts, a regression suite for the OUTCOME rather than any one layer. Two consecutive fixes for this looked green while the app stayed broken for the user — openbuild#76's grant, then a nc-vue fix that short-circuited `completed`, which CnAppRoot never reads. The only assertion that would have caught both is "a non-admin sees the app", so that is what these three tests assert: - an editor reaches the schema designer AND no setup wizard (both halves — asserting the wizard's absence alone passes on a blank page) - an editor sees the app they were granted - an outsider sees none — the control proving openbuild's row-level filter still runs on top of OR's coarse `authenticated` read grant Verified live against the disposable instance: 3 passed.
Contributor
Quality Report — ConductionNL/openbuild @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ❌ | ||||
| stylelint | ❌ | ||||
| composer | ✅ | ✅ 100/100 | |||
| npm | ❌ | ❌ | |||
| PHPUnit | ⏭️ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ |
Quality workflow — 2026-08-02 07:45 UTC
Download the full PDF report from the workflow artifacts.
rubenvdlinde
added a commit
that referenced
this pull request
Aug 2, 2026
…rontend jobs with it (#92) Six jobs have been red on development: Vue Quality (eslint), Vue Quality (stylelint), License (npm), Security (npm), SBOM, and Quality Report. They share one cause, and it is not any of the tools they are named after. Every one of those jobs runs `npm ci` first, and `npm ci` refused to install: npm error `npm ci` can only install packages when your package.json and package-lock.json are in sync. npm error Missing: pinia@4.0.2 from lock file npm error Missing: vite@8.2.0 from lock file npm error Missing: esbuild@0.28.1 from lock file So no linter ever ran. The jobs were not reporting lint failures — they were reporting that the install step died before reaching a linter, which reads identically on the dashboard. The missing entries are TRANSITIVE: nothing declares pinia@4 or vite@8, and the declared ranges are ^2.1.7 and ^5.4.0. They arrived with the @conduction/nextcloud-vue 2.1.0-vue3.15 bump (#87), whose lockfile regeneration did not capture the new transitive graph. This is invisible locally: an existing node_modules already contains the packages, so `npm run lint` passes on a developer machine and `npm ls` reports the tree resolves. Only `npm ci` — which installs from the LOCKFILE rather than the tree — can see it. Reproduced under CI's node 20 rather than the local node 22. The diff is purely additive and verified as such: declared dependency versions changed: 0 packages added: 63 packages removed: 0 Verified under node:20 after the fix: npm ci OK (previously EUSAGE) npm run lint clean npm stylelint clean npm audit --audit-level=critical --omit=dev exit 0 (10 vulns: 5 low, 4 moderate, 1 high — all below the critical gate) The one licence outside my first hand-written allowlist replica, domain-browser 5.7.0 (Artistic-2.0, via node-polyfill-webpack-plugin), is on the shared workflow's real allowlist — my replica was incomplete, not the licence. Co-authored-by: Ruben van der Linde <juan.claude@conduction.nl>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the thread started in #76/#81: a non-admin with an app role can now actually use OpenBuild.
Why a dependency bump was needed at all
#81 gave non-admins OpenRegister-level read on the schemas. They still could not use the app — an editor navigating to the builder landed on "Welcome to OpenBuild / Set up this app" with
.openbuild-schema-listcount 0. Setup endpoints are admin-only and answer 403;useSetupStatusread that as "setup unfinished" and the shell rendered the wizard over the app.Fixed upstream in ConductionNL/nextcloud-vue#576, published as
2.1.0-vue3.15.Version drift found on the way
node_modulesheld 2.1.0-vue3.7 whilepackage.jsonand the lockfile both said 2.1.0-vue3.13. No install had been run since that bump, so local builds were linking a library three versions behind the pin. This branch was built from a cleannpm ci.New:
tests/e2e/non-admin-access.spec.tsTwo consecutive fixes for this looked green while the app stayed broken for the user. Each layer's own tests passed; the user-visible outcome didn't change. The only assertion that would have caught both is "a non-admin sees the app" — so that is what this suite asserts:
authenticatedgrantVerification
non-admin-access.spec.ts— 3 passed live.Nextunclickable) still reproduces 8/8 at vue3.15, confirming it is not a library-version artefact.🤖 Generated with Claude Code