Merge develop into main for 3.4.2-fork

Release 3.4.2-fork — repair the RSS feed wizard

Author: HugoFara

CHANGELOG.md

@@ -7,6 +7,46 @@ ones are marked like "v1.0.0-fork".
 
 ## [Unreleased]
 
+## [3.4.2-fork] - 2026-08-16
+
+### Fixed
+
+* **Finishing the RSS feed wizard saved nothing** (#262). The wizard's last
+  step posted the finished feed to `/feeds/edit`, and that route became a
+  redirect to the feeds manager in 3.4.0 when the duplicated server-rendered
+  feeds list was retired. A redirect discards the body, so the wizard ran to
+  completion and produced no feed. Affects 3.4.0 and 3.4.1. The manual "add a
+  feed" tab and the curated-source browser were unaffected.
+* **The feed wizard showed no article to pick from.** Steps 2 and 3 render the
+  fetched article so you can click the part to import, but the controller
+  handed the view the extractor's whole result array instead of the article's
+  HTML. The picker showed the word "Array", and the "Array to string
+  conversion" notice behind it is fatal wherever PHP warnings are — so on those
+  installs the wizard could not get past step 2 at all. Affects 3.4.0 and
+  3.4.1. The article is also cached in the session again, as it was meant to
+  be, so stepping back and forth no longer refetches it every time.
+
+### Changed
+
+* **The text editor and the feed forms save through `/api/v1`** (#262).
+  Creating or editing a text now uses `POST /api/v1/texts` and
+  `PUT /api/v1/texts/{id}`; the feed forms use `POST /api/v1/feeds` and
+  `PUT /api/v1/feeds/{id}`. Both surfaces work against a configurable API base
+  URL rather than the page origin, which is what a bundled mobile client needs.
+  The text editor's "Check" button still asks the server for its parsing
+  report, and the feed wizard's URL steps still drive the server-side session.
+
+### Security
+
+* **The language on a new text or feed is checked for ownership** (#262).
+  `texts.TxLgID` and `news_feeds.NfLgID` have foreign keys to `languages`, but
+  a foreign key proves the row exists, not that the caller owns it, and the
+  form handlers passed the submitted value straight through. On a multi-user
+  install a crafted request could file a text or feed under another user's
+  language. The API endpoints these forms now use check ownership, and the
+  form-POST routes that skipped the check are retired. Single-user installs
+  were never affected.
+
 ## [3.4.1-fork] - 2026-08-12
 
 ### Fixed

ROADMAP.md

@@ -110,9 +110,26 @@ Track the mobile-critical flows, not the file count.
 rendered by Alpine.js." So Phase 1 is **cutting the server-shell umbilical, not
 converting pages**.
 
-**Status (re-audited 2026-08-07): complete.** Every mobile-critical surface is
-shell-free, and the legacy-fragment cleanup that was the last open item
-([#266](https://github.com/HugoFara/lwt/issues/266)) has shipped.
+**Status (re-audited 2026-08-07): complete *as scoped*.** Every mobile-critical
+surface is shell-free, and the legacy-fragment cleanup — the last open item in
+this phase — has shipped.
+
+**This does not close [#266](https://github.com/HugoFara/lwt/issues/266).** That
+issue asks for PHP to emit "only data for hydration", which is a wider bar than
+Phase 1's. The *data* half is met (config blobs carry boot parameters —
+`['textId' => …, 'langId' => …]` — and everything else is fetched from
+`/api/v1`), but PHP still owns the markup half (audited 2026-08-08):
+
+| PHP still owns | Where | Scale |
+| --- | --- | --- |
+| DOM scaffold | `x-data` in views | 53 views |
+| Which JS modules load | `PageLayoutHelper::getRequiredModules()` → `<meta name="lwt-modules">` | every page |
+| i18n injection | `PageLayoutHelper::buildI18nScript()` | every page |
+| Icons | `IconHelper::render()` → server-rendered `<i data-lucide>` | throughout |
+
+The bundled client works around all four with a build-time transpiler
+(`build/php-view-prerender.mjs`) rather than removing them — see Phase 2. #266
+stays open against that markup half; it is not a Phase 1 deliverable.
 
 - [x] **(Phase 0 gate) Injectable API base URL.** Done in Phase 0 — same seam.
       `@shared/api/client` resolves an injectable **absolute** server root and
@@ -203,10 +220,51 @@ shell-free, and the legacy-fragment cleanup that was the last open item
       keys were decorative, and the bare `books` entry allowed only GET and
       POST. `EndpointMethodReachabilityTest` now asserts real request shapes
       resolve, so the next drift fails a test instead of a feature.
+- [x] **Form POSTs — the write half, for the surfaces above**
+      ([#262](https://github.com/HugoFara/lwt/issues/262)). Those surfaces
+      *read* from `/api/v1`; several still *wrote* by posting a form to the page
+      origin, which a client pointed at a different server cannot do.
+      Converted: tags, user profile/password/preferences,
+      standalone term creation, the **text editor**
+      (`POST /api/v1/texts`, `PUT /api/v1/texts/{id}` — neither endpoint
+      existed; `TextsApi.create()` had been calling a 404 since it was written),
+      and the **feed forms** (`POST`/`PUT /api/v1/feeds`).
+
+      Two mass-assignment holes closed on the way: `texts.TxLgID` and
+      `news_feeds.NfLgID` are client-supplied references into `languages`, and
+      a foreign key proves the row exists, not that the caller owns it. Both
+      form handlers passed the submitted value straight to the facade; the API
+      endpoints check ownership, and the form-POST routes that skipped it are
+      retired. Multi-user installs only.
+
+      Fourteen views still post, down from sixteen: admin (4), the imports
+      (`import_epub_form`, `upload_form`, `bulk_translate_form`), the feed
+      wizard's navigation steps (3), the archived-text and check forms, the
+      Microsoft link confirmation, and `edit_form` for its Check button alone.
+      Every one of those is a surface this phase deliberately leaves
+      server-rendered (below), so what remains of #262 is scoped by that list
+      rather than by view count.
 
 **Out of Phase 1** (leave server-rendered, fine in a WebView online): imports
 (file/web/youtube/whisper), admin/settings, language config, feeds.
 
+Two exceptions inside that list, both because the work was a fix rather than a
+conversion:
+
+- **The feed create/edit forms** went to `/api/v1` even though feeds are out of
+  scope, because tracing them turned up that **finishing the RSS wizard had
+  saved nothing since 2026-08-08** (`1e2216bb6`). Step 4 posted to
+  `/feeds/edit`, and that commit made the route a 302 to the manager SPA when
+  the duplicated feeds list was retired; a redirect discards the body. Present
+  in 3.4.0 and 3.4.1. Verified both ways against a live BBC RSS feed: on the
+  parent commit the walk ends with `news_feeds` empty, on the fix it writes the
+  row. The wizard's *navigation* steps (2 and 3) still post to `/feeds/wizard`
+  — they drive a server-side session state machine that renders HTML previews
+  of the fetched page, and moving that to the client is its own project.
+- **The text editor's "Check" button** still posts. It asks for a
+  server-rendered parsing report rather than saving, so it names its own target
+  with `formaction` while the form itself carries no action.
+
 **Definition of done per surface:** renders entirely from `/api/v1` JSON, no
 server-rendered partial carrying data, works against a configurable API base URL.
 

cypress/e2e/05-texts.cy.ts

@@ -153,6 +153,58 @@ describe('Texts Management', () => {
         }
       });
     });
+
+    /**
+     * The edit form saves through PUT /api/v1/texts/{id} rather than posting
+     * itself (#262). Create the text first so the case does not depend on
+     * whatever text 1 happens to be, then rename it and read the title back.
+     */
+    it('should save an edit through the API', () => {
+      const original = `Edit Me ${Date.now()}`;
+      const renamed = `${original} (renamed)`;
+
+      startPastedText();
+      cy.get('input[name="TxTitle"]').type(original);
+      cy.get('textarea[name="TxText"]').type('Ein Satz. Noch ein Satz.');
+      cy.get('button[name="op"][value="Save and Open"]').click();
+
+      cy.url()
+        .should('match', /\/text\/\d+\/read/)
+        .then((url) => {
+          const textId = /\/text\/(\d+)\/read/.exec(url)?.[1];
+          expect(textId, 'created text id').to.match(/^\d+$/);
+
+          cy.intercept('PUT', `**/api/v1/texts/${textId}`).as('saveText');
+
+          cy.visit(`/texts/${textId}/edit`);
+          cy.get('input[name="TxTitle"]').should('have.value', original).clear();
+          cy.get('input[name="TxTitle"]').type(renamed);
+          cy.get('button[name="op"][value="Change"]').click();
+
+          // A form POST would never produce this request.
+          cy.wait('@saveText').its('response.statusCode').should('eq', 200);
+
+          cy.visit(`/texts/${textId}/edit`);
+          cy.get('input[name="TxTitle"]').should('have.value', renamed);
+        });
+    });
+
+    /**
+     * "Check" is the one button still posting the form: it asks for a
+     * server-rendered parsing report instead of saving.
+     */
+    it('should still render the server-side check report', () => {
+      cy.visit('/texts/1/edit');
+      cy.get('body').then(($body) => {
+        if ($body.text().includes('not found')) return;
+
+        cy.get('button[name="op"][value="Check"]').click();
+
+        // The report is the parse of the text: its sentences and its terms.
+        cy.contains('h4', /sentences/i).should('exist');
+        cy.get('[data-action="history-back"]').should('exist');
+      });
+    });
   });
 
   describe('Archive Text', () => {

cypress/e2e/16-feeds.cy.ts

@@ -95,4 +95,83 @@ describe('Feeds', () => {
       });
     });
   });
+
+  /**
+   * The manual "add a feed" form and the edit form save through /api/v1 rather
+   * than posting themselves (#262).
+   */
+  describe('feed forms', () => {
+    it('creates a feed from the manual tab', () => {
+      const name = `Manual Feed ${Date.now()}`;
+      cy.intercept('POST', '**/api/v1/feeds').as('createFeed');
+
+      cy.visit('/feeds/new');
+      cy.contains('a, button, .is-clickable', /manual/i).click();
+
+      cy.get('input[name="NfName"]').should('be.visible').type(name);
+      cy.get('input[name="NfSourceURI"]').type('https://example.com/manual.xml');
+      cy.get('input[name="NfArticleSectionTags"]').type('//div');
+      cy.get('form').filter(':visible').contains('button[type="submit"]', /save/i).click();
+
+      cy.wait('@createFeed').its('response.statusCode').should('eq', 200);
+      cy.location('pathname').should('match', /\/feeds\/\d+\/edit/);
+      cy.get('input[name="NfName"]').should('have.value', name);
+    });
+
+    it('saves an edit through the API', () => {
+      const name = `Edit Feed ${Date.now()}`;
+      const renamed = `${name} (renamed)`;
+
+      cy.apiRequest({
+        method: 'POST',
+        url: '/api/v1/feeds',
+        body: {
+          langId: 1,
+          name,
+          sourceUri: 'https://example.com/edit.xml',
+          articleSectionTags: '//div',
+          filterTags: '',
+          options: 'edit_text=1'
+        }
+      }).then((response) => {
+        const feedId = response.body.feed.id;
+        cy.intercept('PUT', `**/api/v1/feeds/${feedId}`).as('updateFeed');
+
+        cy.visit(`/feeds/${feedId}/edit`);
+        cy.get('input[name="NfName"]').should('have.value', name).clear();
+        cy.get('input[name="NfName"]').type(renamed);
+        cy.contains('button[type="submit"]', /update|save/i).click();
+
+        // A form POST would never produce this request — and /feeds/{id}/edit
+        // no longer accepts one.
+        cy.wait('@updateFeed').its('response.statusCode').should('eq', 200);
+        cy.location('pathname').should('eq', '/feeds/manage');
+
+        cy.visit(`/feeds/${feedId}/edit`);
+        cy.get('input[name="NfName"]').should('have.value', renamed);
+      });
+    });
+
+    it('no longer accepts a form POST on the page routes', () => {
+      cy.request({ method: 'POST', url: '/feeds/new', failOnStatusCode: false })
+        .its('status')
+        .should('eq', 404);
+    });
+
+    /**
+     * The wizard's last step used to post to /feeds/edit. That route has
+     * redirected to the manager since the server-rendered feeds list was
+     * retired, so finishing the wizard discarded the feed. Walking the whole
+     * wizard needs a live RSS URL, so what is asserted here is that the form
+     * no longer targets the route that swallowed it.
+     */
+    it('does not point the wizard finish at the retired route', () => {
+      cy.request('/feeds/wizard?step=4').then((response) => {
+        const html = String(response.body);
+        expect(html).to.contain('x-data="feedWizardStep4"');
+        expect(html).to.not.contain('action="/feeds/edit"');
+        expect(html).to.not.contain('name="save_feed"');
+      });
+    });
+  });
 });

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "lwt",
-  "version": "3.4.1",
+  "version": "3.4.2",
   "description": "Learning with Texts - A self-hosted language learning application for reading-based vocabulary acquisition",
   "type": "module",
   "main": "index.js",

package.json

@@ -62,31 +62,21 @@ public function spa(array $params): void
     /**
      * New feed form (wizard with 3 tabs: Browse, URL Wizard, Manual).
      *
-     * Route: GET/POST /feeds/new
+     * Route: GET /feeds/new
+     *
+     * Renders the scaffold only. The Browse and Manual tabs save through
+     * POST /api/v1/feeds (#262), which is also the only path that checks the
+     * submitted NfLgID belongs to the caller — the save branch that used to
+     * live here passed it straight to the facade. The URL Wizard tab still
+     * posts to /feeds/wizard, which drives a server-side session state machine
+     * rather than saving a feed.
      *
      * @param array<string, string> $params Route parameters
      *
      * @return void
      */
     public function newFeed(array $params): void
     {
-        // Handle form submission before any output
-        if (InputValidator::has('save_feed')) {
-            $data = [
-                'NfLgID' => InputValidator::getString('NfLgID'),
-                'NfName' => InputValidator::getString('NfName'),
-                'NfSourceURI' => InputValidator::getString('NfSourceURI'),
-                'NfArticleSectionTags' => InputValidator::getString('NfArticleSectionTags'),
-                'NfFilterTags' => InputValidator::getString('NfFilterTags'),
-                'NfOptions' => rtrim(InputValidator::getString('NfOptions'), ','),
-            ];
-
-            $feedId = $this->feedFacade->createFeed($data);
-            $this->flashService->success(__('feed.flash.created'));
-            $this->redirect(url('/feeds/' . $feedId . '/edit'));
-            return;
-        }
-
         // Clear wizard session if exists (must be before any output)
         if ($this->wizardSession->exists()) {
             $this->wizardSession->clear();
@@ -101,7 +91,10 @@ public function newFeed(array $params): void
     /**
      * Edit feed form.
      *
-     * Route: GET/POST /feeds/{id}/edit
+     * Route: GET /feeds/{id}/edit
+     *
+     * Renders the scaffold only; the form saves through
+     * PUT /api/v1/feeds/{id} (#262).
      *
      * @param int $id Feed ID from route parameter
      *
@@ -117,23 +110,6 @@ public function editFeed(int $id): void
             return;
         }
 
-        // Handle form submission before any output
-        if (InputValidator::has('update_feed')) {
-            $data = [
-                'NfLgID' => InputValidator::getString('NfLgID'),
-                'NfName' => InputValidator::getString('NfName'),
-                'NfSourceURI' => InputValidator::getString('NfSourceURI'),
-                'NfArticleSectionTags' => InputValidator::getString('NfArticleSectionTags'),
-                'NfFilterTags' => InputValidator::getString('NfFilterTags'),
-                'NfOptions' => rtrim(InputValidator::getString('NfOptions'), ','),
-            ];
-
-            $this->feedFacade->updateFeed($id, $data);
-            $this->flashService->success(__('feed.flash.updated'));
-            $this->redirect(url('/feeds/manage'));
-            return;
-        }
-
         $langName = $this->languageFacade->getLanguageName($feed['NfLgID']);
         PageLayoutHelper::renderPageStart('Edit Feed - ' . $langName, true);