fix: detail-page routing + Newman collection bugs + export 403 (closes #33, #36)

[rubenvdlinde]

Why

Three related fixes in service of the schema-driven detail-page chain and the Newman CI red.

1. Detail-page routing (supports nextcloud-vue#227)

CnDetailPage in nextcloud-vue beta (#227, schema-driven detail) reads the route param under the prop name objectId. CnPageRenderer spreads $route.params as props onto the dispatched component, so the param name has to match the prop name. Switch the manifest route from /applications/:id to /applications/:objectId.

CnIndexPage's row-click is emit-only — no auto-navigate. The ApplicationCard was emitting click for a parent that wasn't listening. Switch the card body to a <router-link :to="{ name: 'VirtualAppDetail', params: { objectId: appUuid } }"> so the card owns its own navigation. Add an appUuid computed that reads @self.id first.

Browser-verified 2026-05-13: VirtualApps card → detail page → title + Data + Metadata widgets from manifest alone, no per-route custom component.

2. Newman collection bugs (closes #33)

Three concrete bugs fixed:

Collection	Bug	Fix
openbuilt-export-to-real-app	Polled /openbuilt/exportJob/{uuid} (schema NAME, not slug). Schema slug is export-job per openbuilt_register.json.	Use export-job
openbuilt-page-editor	UUID extraction read app.uuid || app.id and missed OR's canonical @self.id location.	Read @self.id first with legacy fallback; assert resolved id is a string
openbuilt.postman_collection	results.find(r => r.slug === 'hello-world') missed objects whose slug surfaces only at @self.slug.	Added @self.slug fallback

Local Newman run after the fixes:

Collection	Result
openbuilt.postman_collection	19/23; the remaining 4 cascade from a transition 422 caused by a stale dev-DB schema (no x-openregister-lifecycle). Fresh installs are fine.
openbuilt-export-to-real-app	6/6 ✅ (after #36 fix below)
openbuilt-page-editor	7/8; the 1 remaining failure is a server-side validation gap (invalid manifest PUT returns 200) — separate bug.
openbuilt-templates-marketplace	Still red — server-side bugs in the template-clone flow. Separate issue.

Newman stays disabled in CI for now

The upstream infra blocker prevents the seed from running in CI:

OpenBuilt: SeedHelloWorld failed: Call to undefined function React\Async\await() — OR development's runtime-schema-API uses react/async but the dependency isn't autoloading in the CI install.

[PermissionHandler] no such function: REGEXP — OR's MagicMapper SQL uses the MySQL REGEXP operator; SQLite (CI default) doesn't ship it.

Both are upstream OR fixes. The Newman gate flag stays enable-newman: false until those are unblocked; the comment in code-quality.yml documents the path back to true. The collection bug fixes still ship so the re-enable is one-line.

3. Export submit 403 (closes #36)

ExportsController::isAuthorisedForApplication()'s fallback called ObjectService::find($slug) with no register/schema context. OR's find relies on currentRegister/currentSchema which are null on a fresh service instance, so a slug-only lookup against the openbuilt/application schema returned null and the controller denied — even for admin against the seeded hello-world.

Fix: pass register: 'openbuilt' and schema: 'application' explicitly to find() (positional 4th + 5th args; same arg signature ApplicationsController::resolveApplicationBySlug uses). Also catch the Multiple objects found with same identifier exception — when a dev DB has duplicate seed rows that throws, but the mere existence of ≥1 matching row is enough proof for the IDOR guard.

Browser-verified on the dev container 2026-05-13:

• POST /api/applications/hello-world/exports → 202 with {uuid} (was 403 ✅)
• POST /api/applications/does-not-exist-xyz/exports → 403 (IDOR guard preserved ✅)

Out of scope (filed as follow-up issues)

• RBAC: owner usernames and group GIDs share one namespace in requirePermission — owners:["admin"] coincidentally satisfies the admin group #37 RBAC owners-vs-group-GID namespace clash (next PR)
• The two OR infra blockers above
• openbuilt-templates-marketplace server-side bugs (clone_failed vs slug_collision, 500 on cross-user reuse)

---

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openbuilt @ b482daf

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 432/432
PHPUnit					✅
Newman					❌
Playwright					⏭️

Coverage: 0% (0/19 statements)

---

Quality workflow — 2026-05-13 08:28 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openbuilt @ 290f0e1

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 432/432
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-05-13 08:39 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openbuilt @ f07d5ba

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 432/432
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 0% (0/19 statements)

---

Quality workflow — 2026-05-13 08:42 UTC

Download the full PDF report from the workflow artifacts.