Web 4418

[remdub]

Summary by CodeRabbit

Release Notes

• New Features

  • Search results now filter to display only published contacts, events, and news items.

• Bug Fixes

  • Fixed crashes when accessing missing or unpublished items in search results and directory views.
  • Resolved procedure view crashes when required tokens are unavailable.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds published-state filtering to search result components across the SmartWeb platform. Source components for contacts, events, and news are updated to append review_state=published to their API queries, preventing unpublished items from appearing in search results. The changes include bundled webcomponent updates, a new event components chunk, and dev configuration adjustments for integrity token computation.

Changes

Search Published State Filtering

Layer / File(s)	Summary
Feature Documentation CHANGES.rst	Changelog entries document three related changes: WEB-4418 filtering by published state, IndexError fix for missing/unpublished direct_access items, and WEB-4414 ProcedureViewlet crash fix.
Search Result Filters src/imio/smartweb/core/webcomponents/src/components/Search/ContactResult/ContactResult.jsx, src/imio/smartweb/core/webcomponents/src/components/Search/EventsResult/EventsResult.jsx, src/imio/smartweb/core/webcomponents/src/components/Search/NewsResult/NewsResult.jsx	Source components add review_state=published query parameter to API requests and extend @search URLs with additional parameters (_core, b_size, metadata_fields).
Event Components Bundle src/imio/smartweb/core/webcomponents/build/js/887.smartweb-webcomponents-compiled.js	New webpack chunk introduces compiled React event experience components: date filtering, event filter menu, event detail view with metadata rendering, paginated event list with map integration, and map marker helpers.
Search & Filter Updates src/imio/smartweb/core/webcomponents/build/js/533.smartweb-webcomponents-compiled.js, src/imio/smartweb/core/webcomponents/build/js/592.smartweb-webcomponents-compiled.js, src/imio/smartweb/core/webcomponents/build/js/864.smartweb-webcomponents-compiled.js, src/imio/smartweb/core/webcomponents/build/js/942.smartweb-webcomponents-compiled.js	Updated chunks: 864 adds published-state filter to directory search, 533 refactors filter UI wiring and listing composition, 942 updates style helper signatures and async request hooks, 592 renders event results with pagination.
Build Configuration src/imio/smartweb/core/webcomponents/webpack.config.js, src/imio/smartweb/core/webcomponents/build/js/914.smartweb-webcomponents-compiled.js.LICENSE.txt	Webpack dev server devMiddleware.writeToDisk enabled for integrity token computation; Moment Timezone dependency version updated from 0.6.0 to 0.6.2.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• IMIO/imio.smartweb.core#75: Both PRs modify search query construction to include review_state filtering and adjust how news/events/directory API queries are built.

Poem

🐰 Hop along through search results so bright,
Published items dance in filtered light!
No unpublished surprises to find,
A cleaner search experience, thoughtfully designed!
✨

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Web 4418' is vague and generic, referencing only a ticket number without describing the actual changes made in the pull request.	Consider using a more descriptive title that summarizes the main change, such as 'Filter search results by published state for contacts, events, and news' or 'Add review_state=published filter to search components'.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch WEB-4418

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

src/imio/smartweb/core/webcomponents/src/components/Search/ContactResult/ContactResult.jsx (1)

19-29: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

b_size=100 still makes larger result sets incomplete.

This component treats response.items.length as the total and only paginates on the client, so the new fixed batch size turns into a hard ceiling. On directories with more than 100 published contacts, the extra entries become unreachable and the count in the header is wrong. Please switch this flow to server-side batching, or keep fetching until the backend is exhausted instead of hard-capping the search response.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/imio/smartweb/core/webcomponents/src/components/Search/ContactResult/ContactResult.jsx`
around lines 19 - 29, The current ContactResult.jsx build of the search request
hard-caps results with params.b_size=100 and treats response.items.length as
total, which drops contacts beyond the first batch; change the fetch logic to
perform server-side batching by adding and incrementing the b_start param (or
equivalent server pagination token) and repeatedly requesting until the backend
returns no more items (or until fetched count matches response.total if
provided), rather than relying on response.items.length as the full total;
update the request construction around the baseURL/params block (where b_size
and props.urlParams are set) and the component logic that uses
response.items.length so it accumulates items across pages and uses
response.total or the empty-page sentinel to stop fetching.

src/imio/smartweb/core/webcomponents/src/components/Search/EventsResult/EventsResult.jsx (1)

17-24: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Whitelist the forwarded query params.

Appending review_state=published in the URL is not enough while this request still forwards props.urlParams wholesale. A crafted URL that includes SearchableText plus another backend key like review_state, _core, or b_start will send both values, so the published-only filter is no longer guaranteed. Build params from an explicit allowlist here, and apply the same change to the other search components updated in this PR.

🔒 Proposed fix

+    const requestParams = Object.fromEntries(
+        Object.entries({
+            SearchableText: props.urlParams?.SearchableText,
+            iam: props.urlParams?.iam,
+            topics: props.urlParams?.topics,
+        }).filter(([, value]) => value !== undefined && value !== null && value !== ""),
+    );
+
     const { response, error, isLoading } = useAxios(
         {
             method: "get",
             url: "",
             baseURL: props.url + "/@search?&_core=events&b_size=100&review_state=published", //props.queryUrl*/,
             headers: {
                 Accept: "application/json",
             },
-            params:
-                props.urlParams.SearchableText || props.urlParams.iam || props.urlParams.topics
-                    ? props.urlParams
-                    : {},
+            params: requestParams,
         },
         [props]
     );

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/imio/smartweb/core/webcomponents/src/components/Search/EventsResult/EventsResult.jsx`
around lines 17 - 24, The component EventsResult.jsx currently forwards
props.urlParams wholesale into the axios params, allowing a client to override
backend-only keys; change the params construction to build an explicit allowlist
(e.g., only include SearchableText, iam, topics or whatever safe keys your API
expects) and copy values from props.urlParams into a new object that is sent as
params (do not merge in review_state, _core, b_start, etc.), update the code
that sets params in the axios/request config used by EventsResult (and apply the
identical allowlist approach to the other search components modified in this PR)
so only approved query keys are forwarded to the backend.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@src/imio/smartweb/core/webcomponents/build/js/887.smartweb-webcomponents-compiled.js`:
- Line 1: The map container style builds an invalid CSS calc string
(height:"calc(100vh-"+F.height+K) in the le component; compute the total offset
as a number (e.g. total = F.height + K) and set the style to a valid expression
such as "calc(100vh - Xpx)" where X is total, and ensure any top value uses
pixel units if needed; update the style object used when rendering the map (the
object referencing F.height and K in le that sets top and height) to construct a
correct CSS string (or numeric pixel value) before rebuilding the bundle.
- Line 1: The compiled bundle contains several anchors with target="_blank" and
no rel attribute; update the source JSX to add rel="noopener noreferrer" to
every external/new-tab anchor (e.g. the edit links and
social/ticket/event/propose links rendered in components R, Z, le and any other
places that create <a href=... target="_blank">) and then rebuild to regenerate
this compiled file so ESLint reports no warnings.
- Line 1: The recurrence control is rendered as an anchor with role="button" (in
the component/function Z where you create the element with className
"recurence-schedul" and onClick:()=>{C(!0)}), which is not keyboard-accessible;
change that element to a real <button type="button"> (or at minimum add tabIndex
and key handlers), remove the role="button" on the anchor, bind aria-expanded to
the D state (aria-expanded={D}) and keep the onClick handler (or toggle C) so
keyboard users can activate it; locate the "recurence-schedul" element in the Z
component and replace it accordingly and rebuild.

---

Outside diff comments:
In
`@src/imio/smartweb/core/webcomponents/src/components/Search/ContactResult/ContactResult.jsx`:
- Around line 19-29: The current ContactResult.jsx build of the search request
hard-caps results with params.b_size=100 and treats response.items.length as
total, which drops contacts beyond the first batch; change the fetch logic to
perform server-side batching by adding and incrementing the b_start param (or
equivalent server pagination token) and repeatedly requesting until the backend
returns no more items (or until fetched count matches response.total if
provided), rather than relying on response.items.length as the full total;
update the request construction around the baseURL/params block (where b_size
and props.urlParams are set) and the component logic that uses
response.items.length so it accumulates items across pages and uses
response.total or the empty-page sentinel to stop fetching.

In
`@src/imio/smartweb/core/webcomponents/src/components/Search/EventsResult/EventsResult.jsx`:
- Around line 17-24: The component EventsResult.jsx currently forwards
props.urlParams wholesale into the axios params, allowing a client to override
backend-only keys; change the params construction to build an explicit allowlist
(e.g., only include SearchableText, iam, topics or whatever safe keys your API
expects) and copy values from props.urlParams into a new object that is sent as
params (do not merge in review_state, _core, b_start, etc.), update the code
that sets params in the axios/request config used by EventsResult (and apply the
identical allowlist approach to the other search components modified in this PR)
so only approved query keys are forwarded to the backend.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a84ec720-e802-470c-9511-4225523c0dfc

📥 Commits

Reviewing files that changed from the base of the PR and between 9247b33 and a9a6e23.

📒 Files selected for processing (23)

• CHANGES.rst
• src/imio/smartweb/core/webcomponents/build/css/887.smartweb-webcomponents-compiled.css
• src/imio/smartweb/core/webcomponents/build/js/115.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/115.smartweb-webcomponents-compiled.js.LICENSE.txt
• src/imio/smartweb/core/webcomponents/build/js/24.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/39.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/533.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/592.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/623.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/78.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/824.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/864.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/887.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/914.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/914.smartweb-webcomponents-compiled.js.LICENSE.txt
• src/imio/smartweb/core/webcomponents/build/js/939.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/942.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/963.smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/build/js/smartweb-webcomponents-compiled.js
• src/imio/smartweb/core/webcomponents/src/components/Search/ContactResult/ContactResult.jsx
• src/imio/smartweb/core/webcomponents/src/components/Search/EventsResult/EventsResult.jsx
• src/imio/smartweb/core/webcomponents/src/components/Search/NewsResult/NewsResult.jsx
• src/imio/smartweb/core/webcomponents/webpack.config.js

💤 Files with no reviewable changes (1)

• src/imio/smartweb/core/webcomponents/build/js/592.smartweb-webcomponents-compiled.js

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix malformed map height CSS expression (invalid calc(...)).

At Line 1, the map style builds height:"calc(100vh-"+F.height+K, which yields an invalid CSS value (missing unit separation/closing format). This can break map sizing.

Use a valid expression like height: \calc(100vh - ${F.height + K}px)`` in the source component, then rebuild the bundle.

🧰 Tools

🪛 Biome (2.4.14)

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/imio/smartweb/core/webcomponents/build/js/887.smartweb-webcomponents-compiled.js`
at line 1, The map container style builds an invalid CSS calc string
(height:"calc(100vh-"+F.height+K) in the le component; compute the total offset
as a number (e.g. total = F.height + K) and set the style to a valid expression
such as "calc(100vh - Xpx)" where X is total, and ensure any top value uses
pixel units if needed; update the style object used when rendering the map (the
object referencing F.height and K in le that sets top and height) to construct a
correct CSS string (or numeric pixel value) before rebuilding the bundle.

---

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add rel="noopener noreferrer" to external links opened in a new tab.

At Line 1, multiple anchors use target="_blank" without rel. That leaves a reverse-tabnabbing risk and weakens security posture.

Please add rel="noopener noreferrer" in the source JSX for every external/new-tab link and regenerate this compiled file.
As per coding guidelines, ESLint must enforce zero warnings tolerance.

🧰 Tools

🪛 Biome (2.4.14)

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/imio/smartweb/core/webcomponents/build/js/887.smartweb-webcomponents-compiled.js`
at line 1, The compiled bundle contains several anchors with target="_blank" and
no rel attribute; update the source JSX to add rel="noopener noreferrer" to
every external/new-tab anchor (e.g. the edit links and
social/ticket/event/propose links rendered in components R, Z, le and any other
places that create <a href=... target="_blank">) and then rebuild to regenerate
this compiled file so ESLint reports no warnings.

---

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Recurrence toggle uses an anchor as a button without keyboard-safe semantics.

At Line 1, the recurrence control is rendered as <a onClick ... role="button"> without proper keyboard handling/tab semantics. This can make the interaction inaccessible for keyboard users.

Switch to a real <button type="button"> (preferred), or add full keyboard support (tabIndex, Enter/Space handling, accurate aria-expanded) in source and rebuild.

🧰 Tools

🪛 Biome (2.4.14)

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

(lint/correctness/noSwitchDeclarations)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'return'.

(lint/correctness/noUnsafeFinally)

---

[error] 1-1: Unsafe usage of 'throw'.

(lint/correctness/noUnsafeFinally)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/imio/smartweb/core/webcomponents/build/js/887.smartweb-webcomponents-compiled.js`
at line 1, The recurrence control is rendered as an anchor with role="button"
(in the component/function Z where you create the element with className
"recurence-schedul" and onClick:()=>{C(!0)}), which is not keyboard-accessible;
change that element to a real <button type="button"> (or at minimum add tabIndex
and key handlers), remove the role="button" on the anchor, bind aria-expanded to
the D state (aria-expanded={D}) and keep the onClick handler (or toggle C) so
keyboard users can activate it; locate the "recurence-schedul" element in the Z
component and replace it accordingly and rebuild.