feat: task due date warning badge (#180)

[WilcoLouwerse]

Closes #180

Summary

Adds visual warning indicators to tasks that are approaching or past their due date. Tasks due within 2 days display a yellow "Due soon" badge, and overdue tasks display a red "Overdue" badge. The implementation includes a helper function for computing due date status and unit tests covering all boundary conditions.

Spec Reference

• Issue: [OpenSpec] [planix] task-due-date-warning #180
• Spec: openspec/changes/task-due-date-warning/design.md

Changes

• src/utils/taskHelpers.js — Added dueDateStatus helper that computes task urgency (approaching/overdue/null) based on due date
• src/components/TaskCard.vue — New task card component displaying task details with due date warning badges
• src/utils/__tests__/taskHelpers.test.js — Unit tests covering no due date, future dates, approaching dates, and overdue dates
• vitest.config.js — Test configuration for the project
• package.json — Added vitest testing framework and dependencies
• l10n/en.json — English translations for badge text and status labels
• l10n/nl.json — Dutch translations for badge text and status labels

Test Coverage

• src/utils/__tests__/taskHelpers.test.js — Comprehensive test suite with 15 tests covering:
  • No due date handling (null/undefined)
  • Future dates (>2 days away)
  • Approaching dates (0-2 days)
  • Overdue dates (past due)
  • Date parsing and time component handling

All tests pass successfully. The implementation also passes linting and builds without errors.

[github-actions]

Quality Report — ConductionNL/planix @ 3dc4506

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 215/215
PHPUnit					❌
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-04-20 14:05 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

[unfixed: vitest@4.x upgrade is a breaking change requiring separate validation] Rule: GHSA-67mh-4wv8-2f99 / OWASP A06:2021 — vitest@^1.0.0 introduces a vulnerable esbuild <=0.24.2 via the vite/vite-node chain. The esbuild vulnerability allows any website to send requests to the development server and read responses. Risk is limited to developer workstations during test runs with vitest --ui; normal vitest run in CI does not expose a public server. Fix: upgrade to vitest@4.x (npm audit fix --force), but this is a semver-breaking change — npm audit itself warns it would install vitest@4.1.4. Escalated for product-team validation.

[rubenvdlinde]

Security Review — Clyde Barcode

Result: FAIL (0 fixed, 1 unfixed WARNING, 0 CRITICAL)

Checks Run

• semgrep scan --config=p/security-audit --config=p/owasp-top-ten --metrics=off — 0 findings (7 files, 89 rules)
• semgrep scan --config=p/secrets --metrics=off — 0 findings
• gitleaks detect --no-git -s . — no leaks found
• npm audit --production — 13 pre-existing vulnerabilities (9 low, 4 moderate); none introduced by this PR
• npm audit (full, including devDeps) — 1 new WARNING: vitest esbuild chain (GHSA-67mh-4wv8-2f99)
• composer audit — no PHP packages to audit (skipped; repo has no PHP dependencies in lock)
• Manual OWASP Top 10 diff review — no v-html, no eval(), no innerHTML, no hardcoded credentials, Vue auto-escaping used correctly throughout

Findings

Severity	File	Rule	Status
WARNING	package.json:60	GHSA-67mh-4wv8-2f99 / OWASP A06:2021	[unfixed: breaking change]

Notes

New code (TaskCard.vue, taskHelpers.js): Clean. Vue template auto-escaping applied correctly, no v-html, no XSS vectors. The t() i18n function handles parameterized strings safely. The dueDateStatus helper performs pure date arithmetic with no security-sensitive operations.

Pre-existing npm audit findings (axios SSRF, dompurify bypass, follow-redirects, vue ReDoS, brace-expansion DoS) are out of scope for this PR — they were present on main before this branch.

Introduced WARNING: vitest@^1.0.0 (new devDependency) pulls in vite → esbuild <=0.24.2 (GHSA-67mh-4wv8-2f99). The vulnerability allows any website to send requests to the esbuild/vite dev server. Impact is limited to developer workstations when running vitest --ui; standard CI vitest run does not expose a public server. Fix requires vitest@4.x (breaking change per npm audit output). See inline comment for details.

Verdict: FAIL — one unfixed WARNING in new devDependency chain. Applier (Axel Pliér) to decide whether to block or accept the dev-only risk.

See inline comment for per-finding detail.

[github-actions]

Quality Report — ConductionNL/planix @ 08dc3d0

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 215/215
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 0% (0/3 statements)

---

Quality workflow — 2026-05-19 03:37 UTC

Download the full PDF report from the workflow artifacts.