feat(deep-link): bidirectional URL sync for dashboards

[rubenvdlinde]

Summary

Each dashboard gets its own URL — /apps/mydash/{slug-chain}. The sync is bidirectional: visiting a deep-link lands the workspace on the matching dashboard, switching dashboards in the sidebar pushes a new history entry, and back/forward buttons navigate between dashboards.

Behaviour

• /apps/mydash/finance/q1-roadmap → loads with that dashboard active
• Sidebar click → URL updates without reload via pushState
• Browser back → previous dashboard returns
• Stale / unknown slug → silent fallback to resolver, never 404
• Dashboard with no slug → no URL update

Backend

• Catch-all page#deepLink route on /{deepLink} with negative-lookahead (?!api(?:/|$)).+ excluding /api/.... Registered last in appinfo/routes.php.
• PageController::deepLink() delegates to refactored index(string $deepLink = '') which resolves through DashboardTreeService::resolvePath(), falls back on failure (logged), and pushes the canonical path computed via computePath() into initial state as deepLinkPath.
• New GET /api/dashboards/{uuid}/path endpoint returns the canonical slug-chain. Empty path is a valid response (NULL slugs are unaddressable).

Frontend

• Views.vue replaces the URL on mount (replaceState) to match server, then watches activeDashboard.uuid and pushes a history entry on every switch. popstate listener strips the route prefix and re-resolves via the existing getDashboardByPath API.
• api.getDashboardPath(uuid) — thin client.
• loadInitialState reads optional deepLinkPath (empty default for backwards-compat).

Tests

• DashboardApiControllerComputePathTest (4 cases) — auth, missing-uuid, happy path, empty-path-as-valid-response.
• Newman: deep-link page render with known + unknown slugs (silent-fallback contract); regression check that /api/health still routes past the catch-all; canonical-path API envelope shape.

Risks

• The catch-all is one route ordering away from breaking every API endpoint. The negative-lookahead is the contract; a Newman regression pins /api/health reachability. Anyone adding API routes BELOW this catch-all in routes.php will quietly shadow them.

(Re-open of PR #128 after feat/* → feature/* branch rename.)

[github-actions]

Quality Report — ConductionNL/mydash @ 07062a2

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 501/501
PHPUnit					✅
Newman					✅
Playwright					⏭️

Coverage: 90.7% (127/140 statements)

---

Quality workflow — 2026-05-05 21:06 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/mydash @ fde44f6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 501/501
PHPUnit					✅
Newman					✅
Playwright					⏭️

Coverage: 90.7% (127/140 statements)

---

Quality workflow — 2026-05-05 21:36 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/mydash @ fde44f6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 501/501
PHPUnit					✅
Newman					✅
Playwright					⏭️

Coverage: 90.7% (127/140 statements)

---

Quality workflow — 2026-05-05 21:39 UTC

Download the full PDF report from the workflow artifacts.