Riyadh
e93ca043f8
Implements Task #122 — four features on the Executive Meetings schedule: 1. Word-like inline editing of meeting title and attendee names with bold, italic, underline, color, and font controls (Tiptap-backed EditableCell). 2. Drag-to-reorder column headers (dnd-kit), persisted in the existing em-schedule-cols-v1 storage key. Old up/down buttons removed. 3. Drag-to-reorder rows within a day. New POST /api/executive-meetings/reorder endpoint swaps daily_number in a single transaction using a two-phase negative→final assignment that respects the (date, daily_number) UNIQUE constraint. Audit-logged and role-guarded. 4. Highlight the meeting whose start/end window is "now", refreshed every 60 s. Toggle and color picker live in the customize popover and persist to localStorage. Backend changes - Widened titleAr / titleEn / attendees.name to text (applied via direct ALTER TABLE because db:push --force is currently blocked by Task #126). - New artifacts/api-server/src/lib/sanitize.ts with an allowlist for inline tags + safe inline styles. Applied to POST, PATCH, PUT-attendees, duplicate, and reorder paths so rich text round-trips safely. - Code-review fix: duplicate handler now re-sanitizes titleAr/titleEn. - Code-review fix: print page no longer interpolates the unsanitized attendee.title into dangerouslySetInnerHTML. - 4 new tests cover sanitization stripping, reorder happy path, cross-day rejection, and permission denial. Pre-existing app_permissions failures are unrelated and tracked by Task #126. Frontend changes - artifacts/tx-os/src/components/editable-cell.tsx with FormattingToolbar. - ScheduleSection wires saveTitle, saveAttendeeName, reorder mutation (optimistic with revert on error), highlight tick, and HighlightPrefs. - New SortableHeader component for column drag. - AttendeesCell now passes the original attendee index to PUT writes so edits reach the right row even after grouping into virtual/internal/ external sections. - Print page renders sanitized HTML via dangerouslySetInnerHTML on names and titles (titles still rendered as plain text on the print page). - Translation keys added in ar.json and en.json. Drift - Sanitization for attendee.title was identified by the architect review as a defense-in-depth gap and proposed as Task #130 rather than fixing inline; the print-page XSS path that depended on it was fixed directly.
100 lines
3.4 KiB
JSON
100 lines
3.4 KiB
JSON
{
|
|
"name": "@workspace/tx-os",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite --config vite.config.ts --host 0.0.0.0",
|
|
"build": "vite build --config vite.config.ts",
|
|
"serve": "vite preview --config vite.config.ts --host 0.0.0.0",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
"test:e2e": "playwright test --config playwright.config.mjs"
|
|
},
|
|
"devDependencies": {
|
|
"@hookform/resolvers": "^3.10.0",
|
|
"@playwright/test": "^1.59.1",
|
|
"@radix-ui/react-accordion": "^1.2.4",
|
|
"@radix-ui/react-alert-dialog": "^1.1.7",
|
|
"@radix-ui/react-aspect-ratio": "^1.1.3",
|
|
"@radix-ui/react-avatar": "^1.1.4",
|
|
"@radix-ui/react-checkbox": "^1.1.5",
|
|
"@radix-ui/react-collapsible": "^1.1.4",
|
|
"@radix-ui/react-context-menu": "^2.2.7",
|
|
"@radix-ui/react-dialog": "^1.1.7",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.7",
|
|
"@radix-ui/react-hover-card": "^1.1.7",
|
|
"@radix-ui/react-label": "^2.1.3",
|
|
"@radix-ui/react-menubar": "^1.1.7",
|
|
"@radix-ui/react-navigation-menu": "^1.2.6",
|
|
"@radix-ui/react-popover": "^1.1.7",
|
|
"@radix-ui/react-progress": "^1.1.3",
|
|
"@radix-ui/react-radio-group": "^1.2.4",
|
|
"@radix-ui/react-scroll-area": "^1.2.4",
|
|
"@radix-ui/react-select": "^2.1.7",
|
|
"@radix-ui/react-separator": "^1.1.3",
|
|
"@radix-ui/react-slider": "^1.2.4",
|
|
"@radix-ui/react-slot": "^1.2.0",
|
|
"@radix-ui/react-switch": "^1.1.4",
|
|
"@radix-ui/react-tabs": "^1.1.4",
|
|
"@radix-ui/react-toast": "^1.2.7",
|
|
"@radix-ui/react-toggle": "^1.1.3",
|
|
"@radix-ui/react-toggle-group": "^1.1.3",
|
|
"@radix-ui/react-tooltip": "^1.2.0",
|
|
"@replit/vite-plugin-cartographer": "catalog:",
|
|
"@replit/vite-plugin-dev-banner": "catalog:",
|
|
"@replit/vite-plugin-runtime-error-modal": "catalog:",
|
|
"@tailwindcss/typography": "^0.5.15",
|
|
"@tailwindcss/vite": "catalog:",
|
|
"@tanstack/react-query": "catalog:",
|
|
"@types/node": "catalog:",
|
|
"@types/react": "catalog:",
|
|
"@types/react-dom": "catalog:",
|
|
"@vitejs/plugin-react": "catalog:",
|
|
"@workspace/api-client-react": "workspace:*",
|
|
"class-variance-authority": "catalog:",
|
|
"clsx": "catalog:",
|
|
"cmdk": "^1.1.1",
|
|
"date-fns": "^3.6.0",
|
|
"embla-carousel-react": "^8.6.0",
|
|
"framer-motion": "catalog:",
|
|
"i18next": "^26.0.6",
|
|
"input-otp": "^1.4.2",
|
|
"lucide-react": "catalog:",
|
|
"next-themes": "^0.4.6",
|
|
"pg": "^8.20.0",
|
|
"react": "catalog:",
|
|
"react-day-picker": "^9.11.1",
|
|
"react-dom": "catalog:",
|
|
"react-hook-form": "^7.55.0",
|
|
"react-i18next": "^17.0.4",
|
|
"react-icons": "^5.4.0",
|
|
"react-resizable-panels": "^2.1.7",
|
|
"recharts": "^2.15.2",
|
|
"socket.io-client": "^4.8.3",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "catalog:",
|
|
"tailwindcss": "catalog:",
|
|
"tw-animate-css": "^1.4.0",
|
|
"vaul": "^1.1.2",
|
|
"vite": "catalog:",
|
|
"wouter": "^3.3.5",
|
|
"zod": "catalog:"
|
|
},
|
|
"dependencies": {
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@tiptap/extension-color": "^3.22.4",
|
|
"@tiptap/extension-font-family": "^3.22.4",
|
|
"@tiptap/extension-text-style": "^3.22.4",
|
|
"@tiptap/extension-underline": "^3.22.4",
|
|
"@tiptap/react": "^3.22.4",
|
|
"@tiptap/starter-kit": "^3.22.4",
|
|
"@uppy/aws-s3": "^5.1.0",
|
|
"@uppy/core": "^5.2.0",
|
|
"@uppy/dashboard": "^5.1.1",
|
|
"@uppy/react": "^5.2.0",
|
|
"@workspace/object-storage-web": "workspace:*"
|
|
}
|
|
}
|