This github workflow is now part of the pipeline to tests-passed, so we
need to run it on every commit that lands. We can continue skipping
tests for PRs that only touch certain paths
On "slow" computers and/or in production builds of the client-side
application, the redirection to discourse connect (via window.location)
might happen _after_ the login/signup route is done loading and the
login/signup template is being shown.
Since when discourse connect is enabled, no other auth "provider" is
allowed, we "flashed" a screen that indicated there was no "login
method" configured.
In order to fix this, we rely on the "isRedirectingToExternalAuth"
boolean and ensure it's set to "true" when discourse connect is enabled.
This is unfortunately ~~impossible~~ very hard to test as it depends on
how fast the browser running the test is...
The only way I was able to reproduce this issue locally was to throttle
both the CPU and network in Chrome's performance tab.
<img width="861" height="156" alt="Screenshot 2025-08-07 at 13 43 09"
src="https://github.com/user-attachments/assets/de02be42-9ce8-4253-8c9c-fd9784a9bb65"
/>
---
I also renamed `isRedirecting` to `#isRedirecting` to better indicate
this is a private variable.
---
**BEFORE**
https://github.com/user-attachments/assets/568052d9-70eb-4d27-8d59-a4b67ae6d8ac
**AFTER**
https://github.com/user-attachments/assets/f51ee3f4-3322-4fc8-8e9b-6195413bba12
In production, reloading CSS files before loading new JS is risky, and
can lead to surprising UI flickering/breakage. This commit updates theme
CSS 'file-change' notifications to trigger a reload on next navigation,
just like regular core updates.
In development mode, CSS will still be refreshed 'live'.
Also adds the 'common' target to the list of refreshed CSS bundles,
which will improve the experience in development mode.
---------
Co-authored-by: Jarek Radosz <jradosz@gmail.com>
Currently, it can happen that the `Chat::AutoJoinChannels` service
raises a `PG::UniqueViolation` error. This is probably due to a race
condition. That exception is not rescued, leading to 500s.
This PR wraps the main step inside a `try` block and also inside a
`lock` block.
On the Admin > Logs & Screening page, the Export button never applied
the current page's filters. For older websites, viewing large exported
logs may cause lag.
This commit makes the Export button respect the current page's filters,
reducing the size of exported staff action logs and improving
consistency.
Before the "theme default" option appeared conditionally, which caused
confusion. For example, it was shown when the theme was using a color
scheme that was not user-selectable. If the scheme was selectable, then
a specific scheme like "Merigold" was preselected. If the theme changed
default schemes, that change was not reflected on the user interface.
Therefore, it would be better to always have the "Theme default" option,
which would have `-1` id. It means that the user's color scheme will
always follow theme defaults.
<img width="400" height="221" alt="Screenshot 2025-08-06 at 10 07 40 am"
src="https://github.com/user-attachments/assets/e3d3588d-1d4a-4e95-9c10-925e48c4a58b"
/>
This change adds documentation and unit tests for the new `ReviewableCreatedBy` and `ReviewableTopicLink` components, as well as the `newReviewableStatus` function.
This pull request improves how user properties are managed and accessed
in post-related components and models. Notable improvements include:
- The `Post` model now provides a cached `user` property, ensuring a
consistent and up-to-date user object using relevant post fields,
instead of relying on `user` being set directly or via the `PostStream`.
- Components such as `PostAvatar` and `PostMetaDataPosterName` now
consistently reference the `user` property, improving reliability and
reducing the risk of missing or inconsistent user data.
- User context is more accurately passed to value transformers and
plugin outlets, ensuring that avatar and name rendering logic always
receives the correct user information.
- The `GroupPostSerializer` now includes the `user_id` attribute,
improving API consistency.
- Test cases have been updated to work with the new user property
approach, removing direct creation of user objects on posts and instead
relying on post fields.
- The `discourse-reactions` plugin was updated to align with the new
user property logic, ensuring reaction-related user data is accessed
consistently.
Overall, these changes improve data integrity, reduce the risk of
rendering errors due to user data inconsistencies, and streamline how
user information is passed through Discourse post-related features.
This job only runs on `main`, so we don't want to cancel existing runs
when new commits land. This config now matches the behavior of
`tests.yml` on `main`
Since the introduction of dedicated login and signup pages (as opposed
to modals), we've been seeing reports of issues where visitors aren't
redirected back to the "page" they were at when they initiated the
_authentication_ process.
Since we have a bazillion of ways a user might authenticate
(credentials, social logins, SSO, passkeys, discourse connect, etc...),
it's really hard to know what a change will impact.
The goal of this PR is to "simplify" the way we handle this "redirection
back to origin" by leveraging the use of a single `destination_url`
cookie set on the client-side.
The changes remove scattered cookie-setting code and consolidate the redirection logic to ensure users are properly redirected back to their original page after authentication.
- Centralized destination URL cookie management in routes and authentication flows
- Removed manual cookie setting from various components in favor of automatic handling
- Updated test scenarios to properly test the new redirection behavior
The hidden-upload-field input exceeds the parent width, which causes
horizontal scrollbars in certain situations
<img width="1848" height="1542" alt="image"
src="https://github.com/user-attachments/assets/d142760e-4a86-4480-83a5-b0964068d3e5"
/>
This commit makes sure it does not exceed the width of the button.
Alas, it's not a generalised solution for all instances, as there is no
way to select the variety of parent elements that would need to get
`position:relative`
This commit implements a date-time range selector to staff action log in
admin page, making it easier to filter and analyze the data.
Additionally, it allows to apply the date-time picker to the exported
file as well, reducing the exported file size.
The `hides unecessary sections and buttons for system themes` spec was still be flaky after the previous fix. It seems like the `system?` method was not being properly stubbed on the theme object we have in the spec, so now it stubs all Theme objects, so that the corresponding theme object created in the Playwright thread will also be stubbed.
I've also tweaked the `cannot edit js, upload files or delete system themes`, the test was wrong, I suspect it was only passing when the checks managed to all run before the page loaded.
Note, if this does now work we may have to simply skip in CI
Concurrent tests depend on timing of background threads and if scheduler
is overwhelmed stuff can take inconsistent amounts of time.
This allows gists to appear in PM inboxes as well, and adds a spec for
gists (didn't have one previously).
The PM and public topic list gist preferences are stored separately, as
there may be cases where you'd want one and not the other.
<img width="2222" height="916" alt="image"
src="https://github.com/user-attachments/assets/f9792e30-ab65-452b-b8e1-7407d9d181e2"
/>
This commit refactors how user status is tracked in the `poster-name`
component. The previous implementation used lifecycle hooks and a custom
refresh method to start and stop tracking the user's status. The new
approach leverages the `helperFn` pattern to directly manage tracking
based on the component's lifecycle and its user argument. This change
improves reliability and code clarity, ensuring user status is tracked
and cleaned up appropriately without manual refresh logic.
# Hide IP Addresses from Moderators When `moderators_view_ips` is
Disabled
## Summary
Feature Request Link -
https://meta.discourse.org/t/option-to-hide-ip-addresses-from-moderators/207715/51
This PR implements a feature to **hide IP addresses from moderators**
when the `moderators_view_ips` site setting is disabled. Previously,
moderators could view IPs in multiple locations across the admin UI.
This update ensures that IP addresses are visible to moderators when the
setting allows it.
## Changes Implemented
### Backend Updates
- **Added `moderators_view_ips` site setting** in `site_settings.yml`
- **Updated `CurrentUserSerializer`** to include `can_see_ip` field
based on the user’s role and site setting.
- **Modified `AdminUserSerializer`** to restrict IP address visibility.
- **Updated `UsersController`** to prevent IP addresses from being
included in API responses.
- **Restricted IPs in `ScreenedIpAddressesController`** by throwing
`Discourse::InvalidAccess` if the user lacks permission.
### Frontend Updates
- **Hid "Screened IPs" tab** in `/admin/logs` when `moderators_view_ips`
is disabled.
- **Blocked direct access to `/admin/logs/screened_ip_addresses`** for
unauthorized users.
- **Updated `user-index.hbs` and `logs.hbs`** to conditionally hide IP
fields.
### UI Screenshots
New option for Admins in the Admin Security settings dashboard:
Moderator's view before:
Moderator's view after:
Moderator's view before:
Moderator's view after:
---------
Co-authored-by: Bennett Dungan <bennettdungan@gmail.com>
Concerns this button feedback
<img width="190" height="152" alt="image"
src="https://github.com/user-attachments/assets/805a9258-2130-4e2e-99d4-50d9638c825b"
/>
This change is pretty straightforward, the desktop css includes all
styling for the `.post-action-feedback-alert`, so that can be simply
moved to common. The mobile alert was removed by
https://github.com/discourse/discourse/pull/31375 (because we open a
link modal instead)... so the mobile styles aren't actually applied
anywhere (no plugins either).
Since we don't have native floatkit/dmenu functionality (yet) to
make the menu stick to the width of the element, this is a
stopgap solution to make sure the menu stays the same width
as the filter input whether resizing the window or hiding/showing
the menu.
Localizes topic titles in these areas
- user notification
- bookmarks
This commit also updates the user notification bookmark list to use fancy
title instead of title, similar to the other user notification tabs.
This PR ports the floatkit-based autocomplete system to chat composer
under a site setting, providing consistent UX across both regular and
chat composers.
### Key Changes
* Adds floatkit_autocomplete_chat_composer setting (defaults to true)
* Adds `fixedTextareaPosition` option and
`createVirtualElementAtTextarea` to DAutocompleteModifier to allow for
positioning of the autocomplete menu relative to the whole textarea
bounds instead of following the cursor - this is better for chat UI &
aligns with current behaviour
* Use DMenu for the filter tips UI
* Move the input, filtering, and DMenu into the same
`FilterNavigationMenu` component to avoid input event listener
shenanigans
* General renaming, refactors, adding comments
* Move searching/suggestion logic for specific types of filter out into
`FilterSuggestions` lib to avoid cluttering the component
David Taylor
Jordan Vidrine
Natalie Tay
Joffrey JAFFEUX
Régis Hanol
Selase Krakani
Kris
Loïc Guitaut
Linca
Sam
Krzysztof Kotlarek
Gary Pendergast
Sérgio Saquetim
chapoi
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Roman Rizzi
benjandBennett Dungan
Rafael dos Santos Silva
Martin Brennan
Kelv