main
11
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 cgalo5758
|
f3fa8e7456 |
Confirm a plan switch in the shared dialog
#291. A plan switch (Upgrade, Downgrade, or Pay for this plan on a granted tier's card) was confirmed in a panel at the top of the Plans section, above the cards and away from the button that opened it. It now confirms in the same dialog as Cancel plan and Resume plan. The button opens the dialog at once, titled with the panel's question ("Switch to Pro?", or "Pay for Pro?" on the granted tier's own card), and the dialog's body loads from the switch's preview route, because the charge it states comes from Stripe at that moment. Keep current plan closes the dialog and sends nothing. An answer that belongs in the dialog stays there: a declined card, a payment awaiting the bank's approval, stale figures; focus moves to the new form. An answer that lands outside closes it: the switch made or refused, or a plan withdrawn after the page loaded. A load that fails closes the dialog with the error toast; a commit that fails (403 or 5xx, which the pages' htmx config does not swap) leaves it open with the toast. Closing the dialog while its body loads aborts the load, and the aborted load shows no toast. The shared dialog gains a region the loaded form lives in; the forms library renders a preview that leaves by the dialog without a box of its own; the lint accepts `data-action-load` as a trigger's route. No string is added or reworded. docs/design-system.md, docs/operator-ux-conventions.md and docs/stripe.md say the same. Tests: TestSwitchAnswersNameTheirRegion, TestPlanMoveTitle, TestSwitchControlOpensTheSharedDialog, TestConfirmModalCarriesTheLoadedRegion, TestPreviewInTheDialogRendersNoBox, and the walkthrough TestSwitchDialogWalkthrough (seven steps in a browser, among them a load answered offline, a load closed mid-flight, and a commit answered 503 by the browser so nothing reaches Stripe). The walkthrough resets the application database, so it runs only with SWITCH_DIALOG_WALK=1, as the merchant-disclosure sheet runs only when asked; make test skips it. 35 goldens change: every member plans golden loses one blank line, the switch controls of 12 lose their hx-* attributes for the dialog's, and the plan move form's golden loses its box. Full suite on reset databases: 5249 passed, 16 skipped, none failed. Sandbox walk on this commit, all twelve steps passed: the dialog opens at once and loads Stripe's figure ($20.00 equal to the preview's amount_due); Keep current plan sends nothing; Cancel plan shows its own form; offline the dialog closes with the toast; stale figures, a declined card and a payment awaiting approval stay in the dialog with focus on the new form; the made switch closes it and Max is current; a plan withdrawn in another session refuses in the Plans region; Pay for this plan reads "Pay for Max?". make screens: no page this commit touches changed. Three operator captures differ for other reasons: person detail and invoice detail show new ids, because the demo snapshot was rebuilt when the previous landing added a FedWiki migration, and the domains list's age column counts one more day (#120). Not walked by the walkthrough, with the reason: a request in flight at a chosen moment (the dialog closed while the commit runs, another switch opened) and a page restored from the browser's cache; a load answered 400 and a commit the switch refuses answer through the same close rule as the withdrawn plan and the made switch that the walkthrough and the hand walk cover. Breaks, all CAUGHT (19 test records): - own card titled as a switch (title test) - own card titled as a switch (control test) - setMove leaves the title unset - control loads without the price (control test) - control loads without the price (render test) - control loads the switch's route - heading left in the message - current tier's name unescaped - refused preview left in the dialog - confirmation answered into the Plans region (a declined switch) - confirmation answered into the Plans region (a stale switch) - confirmation answered into the Plans region (a switch awaiting approval) - decline answered 200 - way out a link again - commit's description dropped - region renamed in the partial - box rule removed - box rule widened to every kind - box rule widened to every way out Breaks of the walkthrough, all CAUGHT (8 records, each building and booting the app from the edited tree): - the close not deferred - the abort on close dropped - the cancelled mark ignored by the toast - the load not sent - the loaded region left showing under a static trigger - the close on an answer outside the dialog removed - the failed commit closing the dialog - the way out a link again Seen by no test: renderConfirmation without its describeCommit call (the database tests' handlers carry no Stripe key fingerprint, so the line is never shown there; describeCommit itself is pinned); data-action-load dropped from the lint's condition (no template interpolates a route into it); the spinner and aria-busy not set, and the focus after a stay-open answer not moved, which only the hand walk reaches, because the walkthrough stops before any Stripe write. |
||
|
cgalo5758
|
dec031e6dc |
Name every ladder a grant leaves empty when it supersedes a bundle
#271. A grant on one ladder of a product that is a tier of several ladders keeps ending the subscription's tier on all of them, and the ladders the grant is not on stay empty until it ends; what changes is that every place an operator or a member looks now says so. A new test pins the console's behaviour the strings rest on: the subscription holds nothing anywhere, the other ladder holds no position, the grant delivers, and a reconcile of the subscription is queued, which pauses its billing when it pays for nothing else. The Issue grant form: an option now carries its own hint (forms.Option.Hint, rendered as data-hint, and hint-on-choice.js shows the chosen option's hint or the declared one). A product that would supersede a tier of several ladders names them: "This grant would supersede a tier a subscription pays for on Duo and Wiki; its billing pauses until the grant ends." A product superseding a tier of one ladder keeps the existing warning. An option's hint is not held to the registry's 100-character cap, because the ladder names are the fact. The Not delivering badge on the organization page's Billing card and in the subscriptions list: the ladder's name rides the conferral shapes (ListConferralShapes selects it, Rung.LadderName), and the title adds "; nothing is delivered on {ladders}" for the ladders of the tier on which no live position exists when the page renders: "Billing paused while a grant holds Wiki; nothing is delivered on Duo." A ladder something else holds is named in neither clause. The organization page reads the default pool's positions it already holds; the list reads them with one statement per page (ListLiveLadderIDsBySubscriptionIDs), and a failed read shows "Failed to load deliveries." as the other reads do. Whether a sentence says paused or continues is decided from the deciding displacements only, as the reconcile decides the pause, so a ladder a later subscription holds cannot turn a recorded pause into "Billing continues"; when a named holder is not a grant the sentence reads "Billing paused while other plans hold Duo and Wiki." The member's Products page: on each ladder the grant does not hold, the paid tier's card reads "Paused while Pro is granted on Wiki", or "Billing continues while Pro is granted on Wiki" until Stripe confirms the pause, and draws no control; the controls stay on the card of the ladder the grant holds. docs/models/plan-ladders-transitions.md, docs/plan-management.md and docs/stripe.md say the same. Tests: TestReconcile_AGrantOnOneLadderOfABundlePausesIt, TestSupersededLadders, TestLadderNamesNeedsEveryName, TestRenderHintOnChoiceShowsTheChosenOptionsOwnHint, TestSubscriptionsListNamesEveryLadderOfABundle, TestOrgEnrollmentTwoLadderGolden (two states on their own World), TestGrantHeldLadder, TestPaidPlanCardOnAVacatedLadder, and new rows in TestDisplacedOnPage, TestDisplacementTitle, TestOrgEnrollmentIssueGrantSupersedeHint, TestOrgEnrollmentReadFailures and TestSubscriptionsListDisplacementReadFailures. TestMemberPlansGolden: the seven paid-plus-under-granted-pro states draw Duo's Plus card with the ladder line; the member and organization .json goldens gain the new fields. The grant-hint walkthrough's own-hint step is a subtest that skips, naming its precondition, because no demo state holds a subscription to a product of two ladders. Full suite on reset databases: 5143 passed, 15 skipped, none failed. make screens: no page changed; no demo state holds such a subscription. Hand captures cover the grant form, the badge and the member's cards. Unseen by any test: hint-on-choice.js not setting the line's text; only the browser walkthrough reads it, and its step skips. The hand captures show it. Breaks, all CAUGHT (44): - DisplacedProducts passes over a product of several rungs - displacedOnPage adds no emptied ladder (page rows) - displacedOnPage adds no emptied ladder (golden) - displacedOnPage names only the deciding ladder as held - groupDisplaced keeps an emptied ladder the group names as held - continuingSentence one subscription without the clause - displacedOnPage ignores live (page rows) - displacedOnPage ignores live (list) - pausedSentence uses pausedHolder whatever the holders - displacedOnPage takes grantsOnly over every holder the walk adds - organization page drops the positions read error from the badge - subscriptionDisplacementTitles ignores the live ladder read error - ListLiveLadderIDsBySubscriptionIDs answers no row - ListConferralShapes selects no name (list) - ListConferralShapes selects no name (golden) - RungsByProduct leaves LadderName empty - supersededLadders answers for a product whose superseded provisions each hold one ladder - supersededLadders keeps only the ladders the product is a tier of - ladderNames answers the names it read when one is missing - issuanceProductOptions leaves Option.Hint empty (page) - issuanceProductOptions leaves Option.Hint empty (golden) - issueGrantSupersedeHintOn answers for no ladders - selectOptions does not copy Hint - selectOptions copies Hint without ShowsHint - choiceHint answers the declared hint for a chosen option with its own - HintDefault left empty - HintDefault set when no option carries its own hint - ui_form_field.html without data-hint on the option - ui_form_field.html without data-hint-default on the line - grantHolds without its DefaultSourced test - grantHeldLadder walks rows in place of ladders - grantHeldLadder without its subscription test - setPaidUnderGrant draws the controls on a card with grantLadder - template plain paused branch without the ladder - template payment-due paused branch without the ladder - template moves-to paused branch without the ladder - template without the Billing continues branch - buildLadder without the empty-ladder case - buildLadder takes the heading's cancellation date from a card with grantLadder - pausedSentence one subscription without the clause - pausedSentence several subscriptions without the clause - continuingSentence a count of the account without the clause - continuingSentence several subscriptions without the clause - groupDisplaced leaves the emptied ladders unsorted |
||
|
cgalo5758
|
f7363e98af |
Show the grant form's supersession hint only once a marked product is chosen
Task 5.10 of #269's change. The Issue grant form showed a yellow alert under its lead whenever its Product select offered a product marked with the warning sign, before anything was chosen, so it read as a standing warning. The sentence now reads "This grant would supersede a tier a subscription pays for; its billing pauses until the grant ends." and is the Product field's one hint line, hidden until the operator chooses a marked product and hidden again when an unmarked one is chosen. A refused submission that chose a marked product renders it shown. The form's message is the lead alone. The forms library gains the mechanism, for any Stacked form: a select declares HintOnChoice with its Hint, options carry ShowsHint, and the field part renders the hint only when an offered option shows it, hidden unless the chosen one does, and named by the select's aria-describedby only while it shows. One external script, hint-on-choice.js, loaded with defer by the operator shell, follows later choices and htmx swaps through data-hint-toggle and data-shows-hint. The invariants refuse HintOnChoice off a Stacked select, without a Hint or with a Notice, and the escape hatch refuses data-hint-toggle. The change's text gains a form-library requirement ("A select's hint can wait for the option that shows it") and modifies form-conventions' "Every control has a label, and its hint and error are described" so a hint is described while it shows. docs/design-system.md describes the mechanism in section 8 and adds the script to the progressive-enhancement table. Tests: TestOrgEnrollmentIssueGrantSupersedeHint (at rest, no marked product, a refused submission with a marked, an unmarked and no product, the message the lead alone), TestOperatorShellLoadsTheHintToggle, TestRenderHintOnChoiceFollowsTheChosenOption, TestInvariantsHintOnChoiceBelongsToAStackedSelectWithItsHint, the escape hatch's and the invariant messages' rows, and TestGrantSupersedeHintWalkthrough, which chooses a marked and then an unmarked product on the demo's Carlos Member organization and checks the hint and aria-describedby both ways. Three organization goldens change only in the message and the Product field. Review: round 1, three majors (the hint supplied per render, bypassing the registry's hint checks; no spec for the library's new contract, with form-conventions saying the opposite; the script's break unreachable while the app serves its embedded copy) and five minors, all fixed; round 2, no major. Breaks: 12 of 12 caught. 8 in code; the script's 4 run as a second list whose preparation rebuilds and restarts the app on the broken tree. Full suite on reset databases: 4843 pass, 14 skip. make screens: Carlos Member's organization, open and refused, at both widths, loses the alert. Hand captures of the form at rest, with a marked product chosen and with an unmarked one chosen after it sit beside the change's screens. |
||
|
cgalo5758
|
fc68a6b78e |
Stop offering "None" for the entitlement set of a product that is a tier
Fourth section of #153's change. The product edit reads the ladders the product is a tier of. For a tier product the Entitlement set select no longer offers "None"; it opens with the disabled placeholder "Choose an entitlement set", and the field's one line reads "This product is a tier of <ladders>, and a tier needs an entitlement set." in place of the off-ladder sentence, which moves from the field's declared hint to the same line slot (the create page keeps it). A submitted "None" is refused with that sentence; so is a clear refused by section 2's trigger when the product became a tier after the page was read, after the ladders are read again. A failed read of the ladders is logged and saves nothing, instead of reading as "on no ladder". The edit's write now runs in its own READ COMMITTED transaction (db.InTx with db.ReadCommitted, item 4.6), so a tier add that commits first is seen by the clear whatever the server's default isolation; at REPEATABLE READ the edit's snapshot predated the tier and the clear committed. UpdateProduct is split into helpers, each answer and log line kept. Tests: TestTheEntitlementSetFieldFollowsTheProductsTiers, TestTheCreatePageCarriesTheOffLadderLine, TestTierNeedsSetSentence, TestProductEditOfATierProductOffersNoNone, TestProductEditRefusesNoneForAProductThatBecameATier, TestProductEditWithUnreadLaddersSavesNothing, TestProductEditClearingASetIsRefusedWhenATierAddCommitsFirstAtAnyDefaultIsolation (on a connection whose default is REPEATABLE READ). The forms golden operator.product.html moves the hint to the line. TestUpdateProductEntitlementSetSentinel builds its product on committed rows, since the edit's own transaction cannot see an uncommitted fixture; its assertions are unchanged. productTierOf takes no context: it logs through the handler's logger and unparam refuses the unused parameter. Breaks: 20 of 20 caught. The parse's error left in place; None offered whatever the tiers (T6, T6c, T6d); the placeholder left out (T6d, T6); the ladders out of name order; the line kept beside the error; the off-ladder line blanked beside an error; the create page's line lost; the failed read treated as no tier; the save going ahead when the read failed; the parse's field error left when the ladders are unread; L3 not logged; the second-read refusal not logged; the database's refusal unmapped; the refusal named over a failed second read; the join reduced to the first name; the write at the server's default isolation; the empty-value condition dropped. Review: round 1, no blocker or major; four minor and three nits, applied. #153's sequence (item 5.4), app rebuilt from this tree, from the demo snapshot, the whole walkthrough package three times without a reset: ok each run. The plan-ladders walkthrough's ladder now has tiers with sets, the org-types walkthrough committed a default change to it on runs 2 and 3 and put the default back, and the grant revoke passed on all three runs; the app log has no "has no entitlement set". Item 5.4 is reworded to what ran: the three-walkthrough filter it named finds no revoke subject on the demo snapshot, which another walkthrough's grant supplies. Full suite on reset databases: 4731 pass, 14 skip. make screens: no change beyond section 1's; the captured product is not a tier. |
||
|
cgalo5758
|
dc685004dd | Delete unused helpers and move splitRuleRows into its test | ||
|
cgalo5758
|
113c672e3b |
Resume a marked grant when the plan that replaced it ends, and archive the change
An operator can mark a grant to resume. When a plan replaces a marked grant and that plan later ends (the subscription ends, or a granted plan is revoked or expires), the grant delivers again from its own row before the org-type floor runs (core migration 00023, core.grant_waits). - Grants: a resumes_after_supersession column, off by default and never on a default grant; delivery states gain On hold, with a badge hover that names what the grant waits on. - Operator: one Manage action per grant opens a card under its row (Note, Valid until, Resumes; Save, Cancel, Revoke). A changed Valid until extends the grant; otherwise the note and mark change in place. An extension now keeps its predecessor's valid_from. - Member: a held rung reads Granted and is reached by cancelling; the cancel confirmation names each ladder's outcome; Cancel plan sits beside Keep plan while a downgrade is scheduled. - Smaller fixes from the screens reviews: 24-hour times everywhere, search placeholders that name what they match, a checkbox label above its box, and the org-types walkthrough restoring the default it changes. |
||
|
cgalo5758
|
f8a3478f2a |
Rebuild the entitlement set Rules surface as a staged batch
The Rules section is one record table grouped by kind, Limit then Boolean, on fixed columns, edited in place: Edit opens a row's controls in their columns, Add rule opens a dense row above the table, and every change is staged into a tray that lists the deltas with Undo and applies them as one rule-change act. The reduction policy is a column of the rule beside its limit. History shows counts only. Group rows are a quiet heading rather than a divider, the maintainer's pick from four rounds of outside-model ideation. Dense rows align to the top and render each error under its control in every form family (design D16), replacing the below-row error block; the forms library gains the batch form (rows plus one tray) and the RowField dense and label-hidden options. Migration 00019 records the governing reduction policy on effect rows. Archive staged-rule-changes with its spec updates (entitlement-set- management, entitlement-set-history, entitlements, form-library, form-conventions, ui-quality-gate). Screens accepted 2026-09-19. |
||
|
cgalo5758
|
12f1d3fc00 |
Fix the four Slice 3 walk findings and page every operator list
Archives openspec change slice3-walk-fixes and syncs its five delta specs (fedwiki-sites, entitlements, operator-panel-navigation, operator-list-scale, ui-quality-gate). - FedWiki site usage is read from active site rows in both quota readers; the reservation counter converges on the rows: raise-only after farm sync and inside the create quota check, exact at boot. The understated production counters repair on the first boot. - The People tile caption excludes the reserved system person through the same query parameter the directory uses. - The operator Domains live-claims list is a governed list: pages of 50, true total, search over root name and organization, a pending/active facet. - New lint rule table-without-list-controls refuses an unpaged page-body table unless it carries a list-scale exempt marker with a reason; six curated or detail tables carry one. Its first run caught the operator FedWiki sites list, which is now governed the same way. - Entitlement-set rule copy: "Per unit", "Multiplied by the quantity purchased or granted." |
||
|
cgalo5758
|
88db730fcc |
Add dual licensing and SPDX headers
Introduce a commercial license option alongside AGPL-3.0-only, require a CLA for contributors, and document the terms in COMMERCIAL.md and NOTICE. Add a script to stamp SPDX headers on Go files and apply it across the tree. |
||
|
cgalo5758
|
d47c47ef0f |
Make control type decide dense form width
Width becomes a one-rung step from the control's natural fraction, and invariants bound the ladder. The grant's free text is renamed to GrantNote, and both grant ledgers show it as a muted note line. |
||
|
cgalo5758
|
9ff516ba95 |
Introduce the forms library and migrate all forms
Every form on both surfaces is now a declared FormSpec in internal/forms, rendered through the shared form part and parsed by its handler through the same declaration. Create and edit share one field list, refusals answer 422 with values carried back, and layout, buttons and errors come from one part. Also adds the form registry with its invariant and route-mapping tests, the raw-form, filler-copy and Go em-dash lint rules, declared action triggers, and the capture-coverage cross-check. The forms-library change is archived under openspec/changes/archive/2026-09-05-forms-library. |