* Move access/refresh tokens to secure cookies (#20779)
* feat: adds the `credentials: include` header to all manual requests
* feat: adds `credentials: include` as a configurable option to xhr requests (and sets it by default to true)
* feat: configures the auto-generated fetch client from hey-api to include credentials by default
* Add OpenIddict handler to hide tokens from the back-office client
* Make back-office token redaction optional (default false)
* Clear back-office token cookies on logout
* Add configuration for backoffice cookie settings
* Make cookies forcefully secure + move cookie handler enabling to the BackOfficeTokenCookieSettings
* Use the "__Host-" prefix for cookie names
* docs: adds documentation on cookie settings
* build: sets up launch profile for vscode with new cookie recommended settings
* docs: adds extra note around SameSite settings
* docs: adds extra note around SameSite settings
* Respect sites that do not use HTTPS
* Explicitly invalidate potentially valid, old refresh tokens that should no longer be used
* Removed obsolete const
---------
Co-authored-by: Jacob Overgaard <752371+iOvergaard@users.noreply.github.com>
* Remove configuration option
* Invalidate all existing access tokens on upgrade
* docs: updates recommended settings for development
* build: removes non-existing variable
* Skip flaky test
* Bumped version of our test helpers to fix failing tests
---------
Co-authored-by: Jacob Overgaard <752371+iOvergaard@users.noreply.github.com>
Co-authored-by: Andreas Zerbst <andr317c@live.dk>
* Added form control support to color picker.
* Avoid submit when readonly is true.
* Added mandatory support.
* Added form control support to date picker.
* Removed an unused import.
* Added form control and mandatory support to document picker.
* Added form control support to Eye dropper.
* Added. mandatory support for multi url picker also bind inner input in the eye dropper.
* Removed unused import.
* fix update of value
* fixing not needed override of get and set methods
---------
Co-authored-by: Niels Lyngsø <niels.lyngso@gmail.com>
* Added mandatory support for block grid property editor.
* Added form control and mandatory support to code editor.
* Added form control and mandatory support to markdown editor.
---------
Co-authored-by: Niels Lyngsø <niels.lyngso@gmail.com>
* Implemented input-with-alias in the content-type-design-editor.
* Added auto-generate-alias property to the input and revert deletion of checkAliasAutoGenerate method.
* Added form-validation-message.
* Added validation to the input-with-alias element to avoid special characters.
* Chenged right and left position of the infobox.
* Added focus support to open the modal.
* Moved tabindex out the constructor and added support for enter and space keys.
* Removed isLoding condition from the rich media input and let the thumbnail handle the loader.
* Removed unused import.
* change loader and adjust lit property configuration
* update reflect configuration
---------
Co-authored-by: Niels Lyngsø <niels.lyngso@gmail.com>
* chore(mock): adds missing try/catch around document lookup
* fix: lets the 'save and preview' button extend the 'save' button to follow the same logic in terms of when it enables/disabled - it did not have much logic before
* fix: runs validation from the server when save and previewing to ensure the UI shows what is missing
Update icon usage in collection menu and example data
Replaces <uui-icon> with <umb-icon> in the default collection menu item element to support colors. Also updates example picker data source items to showcase color support.
* feat: adds the `credentials: include` header to all manual requests
* feat: adds `credentials: include` as a configurable option to xhr requests (and sets it by default to true)
* feat: configures the auto-generated fetch client from hey-api to include credentials by default
* Add OpenIddict handler to hide tokens from the back-office client
* Make back-office token redaction optional (default false)
* Clear back-office token cookies on logout
* Add configuration for backoffice cookie settings
* Make cookies forcefully secure + move cookie handler enabling to the BackOfficeTokenCookieSettings
* Use the "__Host-" prefix for cookie names
* docs: adds documentation on cookie settings
* build: sets up launch profile for vscode with new cookie recommended settings
* docs: adds extra note around SameSite settings
* docs: adds extra note around SameSite settings
* Respect sites that do not use HTTPS
* Explicitly invalidate potentially valid, old refresh tokens that should no longer be used
* Removed obsolete const
---------
Co-authored-by: Jacob Overgaard <752371+iOvergaard@users.noreply.github.com>
* Adds new dictionary/localization item for the clipboard dialog clear all prompt
* Removes the wrapping uui-box and moved inside the component itself
* Adds Clear Clipboard button and logic
* Adds uui-box from outer components consuimg this into this component
* Adds a header to uui-box
* Adds a conditional uui-button when we have items in clipboard
* Adds confirm dialog/prompt to ask if user wants to clear all items
* Adds in general_clipboard item to use in the UUI-box header
* Removes extra space & moves the requestItems outside the for loop
* Be a better citizen
Make sure the promise for the modal is caught and we return out early if user explictiy cancels modal or presses ESC
* Cleanup my noisy comments for a re-review
---------
Co-authored-by: Jacob Overgaard <752371+iOvergaard@users.noreply.github.com>
Added 'label attribute to the uui-button in the umb-news.card.element + Removing the redundant text for uui-button since label attribute is now present
* Fix block list inline mode
https://github.com/umbraco/Umbraco-CMS/issues/20618
* Fixed potential runtime errors
* Code cleanup
* Fixed Code Health Review
* Revert some changes
Commented out unused state properties and related code.
* Remove commented-out state property in block workspace view
* fix localization
* no need for question mark after ids, they should be presented as required
---------
Co-authored-by: Niels Lyngsø <niels.lyngso@gmail.com>
Co-authored-by: Niels Lyngsø <nsl@umbraco.dk>
* Fix block list inline mode
https://github.com/umbraco/Umbraco-CMS/issues/20618
* Fixed potential runtime errors
* Code cleanup
* Fixed Code Health Review
* Revert some changes
Commented out unused state properties and related code.
* Remove commented-out state property in block workspace view
* fix localization
* no need for question mark after ids, they should be presented as required
---------
Co-authored-by: Niels Lyngsø <niels.lyngso@gmail.com>
Co-authored-by: Niels Lyngsø <nsl@umbraco.dk>
* Add errorDetail property to umb-entity-item-ref
Add optional errorDetail property to display additional context
(such as file paths or IDs) in error states. This enhances the
error display to show both the error message and relevant details.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Make _removeItem protected in UmbPickerInputContext
Change #removeItem from private to protected to allow subclasses
to reuse the removal logic while customizing the confirmation dialog.
This enables better extensibility for specialized picker contexts.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix static file picker to show error state for missing files
Update umb-input-static-file to observe statuses and render based
on item state (loading, error, success). When a static file is
missing (API returns empty array), displays error state with alert
icon and file path detail using umb-entity-item-ref.
Also adds standalone property support for proper single-item styling.
Fixes#19329🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Show file path in static file remove confirmation dialog
Override requestRemoveItem in UmbStaticFilePickerInputContext to
display the file path instead of "Not found" in the confirmation
dialog when removing missing static files.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Show GUID in document picker error state
Display the document GUID as errorDetail when a document is
not found (deleted/gone). This provides useful context for
editors to identify which document was referenced.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Show GUID in document picker remove confirmation dialog
Display the document GUID instead of "Not found" in the remove
confirmation dialog when the document no longer exists. This
provides useful context for editors.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: apply the temp model which the context uses
* Refactor: Move requestRemoveItem logic to base UmbPickerInputContext
Eliminated duplicate code across three picker contexts by:
- Adding protected getItemDisplayName() method to base class
- Moving requestRemoveItem implementation to base class
- Removing duplicate implementations from document, member, and static file pickers
- Static file picker overrides getItemDisplayName() to show file path
Net reduction: 19 lines of code (69 removed, 50 added)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Document Type Picker: Show error state for missing items (fixes#20367)
Apply the same error state handling to the document type picker that was
implemented for static files, documents, and members. When a referenced
document type is missing or deleted:
- Show error state with the GUID as errorDetail
- Allow removal with proper confirmation dialog
- Use umb-entity-item-ref for error display
- Use uui-ref-node-document-type for successful items
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Additional pickers: Show error states for missing items in user, language, media-type, member-type, member-group, and user-group pickers
Apply the same error state handling pattern to six additional picker types:
- user-input: Users
- input-language: Languages
- input-media-type: Media types
- input-member-type: Member types
- input-member-group: Member groups
- user-group-input: User groups
All pickers now:
- Observe statuses from UmbRepositoryItemsManager
- Show error state with GUID when referenced item is missing/deleted
- Use umb-entity-item-ref for error display
- Use specialized components (uui-ref-node, umb-user-group-ref, etc.) for successful items
- Allow removal with proper confirmation dialog showing GUID
Maintains code reusability by using the base class requestRemoveItem method
with getItemDisplayName() for consistent error handling across all pickers.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Lint: Remove unused 'when' imports from input-media-type and user-group-input
* Refactor: Add #renderItem helper method to all pickers for consistency
- Add #renderItem to user-input (extracted from inline repeat callback)
- Change _renderItem to #renderItem in user-group-input for consistency
- Change _renderItem to #renderItem in input-static-file for consistency
All 10 pickers now use consistent #renderItem helper method pattern,
improving code readability and maintainability as suggested by @nielslyngsoe
* `import` sorting
* Corrected (old) JSDoc typos
* Markup tidy-up
* exported `UmbPropertyEditorUIStaticFilePickerElement` as `element`
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: leekelleher <leekelleher@gmail.com>
Moves the _data.updateCurrent() call inside the updateLayoutBlock conditional
in setMasterTemplate(). This prevents spurious change detection when loading
templates from the server, while maintaining proper change tracking when users
actually modify the master template via the UI.
This completes the fix started in PR #20529 which added the updateLayoutBlock
parameter but inadvertently left the data model update outside the conditional.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Fix config value access in UmbSliderPropertyValuePreset
Updated the `UmbSliderPropertyValuePreset` class to ensure the `.value` property is accessed for configuration items. This change improves the accuracy of retrieving `enableRange`, `min`, `max`, and `step` values, addressing potential bugs in value processing.
Co-authored-by: Luuk Peters <Luuk.Peters@proudnerds.com>
* fix: Tiptap Media Picker: Skip media picker modal when editing existing images
Fixes the media picker workflow to match v13 behavior where clicking
an existing image directly opens the alt text/caption editor instead
of forcing users to re-select the same image from the media library.
Also fixes caption text extraction to properly read from the figcaption
node using Tiptap's NodeSelection API instead of unreliable attribute-based
approach.
Changes:
- Skip media picker when currentMediaUdi exists (lines 77-92)
- Extract caption from NodeSelection.node using descendants() (lines 55-73)
- Add NodeSelection export to tiptap externals for proper typing
* Refactor: Extract nested logic from media picker execute method
Reduces cyclomatic complexity from 15 to 1 by extracting conditional
logic into focused private helper methods. Addresses CodeScene warnings
for complex method and nested conditionals (bumpy road smell).
Created helper methods:
- #extractMediaUdi, #extractCaption, #findFigcaptionText
- #getMediaGuid, #updateImageWithMetadata
No functional changes - improves maintainability and testability.
