feat: TYPO3 v13+v14 modernization with task dialog, context zoom, and full test coverage#85
feat: TYPO3 v13+v14 modernization with task dialog, context zoom, and full test coverage#85
Conversation
Dependency ReviewThe following issues were found:
License Issuescomposer.json
OpenSSF Scorecard
Scanned Files
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly elevates the project's testing pyramid by introducing advanced testing methodologies and tightening existing configurations. The changes aim to enhance the overall stability, security, and maintainability of both PHP and JavaScript components by rigorously testing against a wider array of scenarios, including edge cases, malformed inputs, and potential injection vulnerabilities. This comprehensive approach ensures a higher degree of confidence in the codebase's resilience and correctness. Highlights
Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #85 +/- ##
============================================
+ Coverage 97.33% 98.67% +1.34%
- Complexity 127 229 +102
============================================
Files 7 14 +7
Lines 450 1282 +832
Branches 0 110 +110
============================================
+ Hits 438 1265 +827
- Misses 12 17 +5
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request significantly enhances the testing pyramid by achieving 100% JavaScript test coverage, introducing fuzz tests for the CompleteRequest DTO, and integrating mutation testing, while also tightening PHPUnit configurations. No security vulnerabilities were identified. A key suggestion is to further harden the CompleteRequest DTO by implementing a length limit for model names, which would effectively complement the newly added fuzz tests.
There was a problem hiding this comment.
Pull request overview
This PR significantly expands the test coverage of the t3-cowriter TYPO3 extension. It adds 91 PHP "fuzz" tests (parametrized data-provider tests with adversarial inputs) for CompleteRequest, 16 new JavaScript tests for the cowriter.js button execute handler and UrlLoader/AIService edge cases, sets up mutation testing infrastructure via Infection, and adds a new "Extended Testing" GitHub Actions workflow. PHPUnit configs are also hardened with failOnWarning="true".
Changes:
- Added
CompleteRequestFuzzTest.phpwith extensive adversarial/boundary tests for the DTO - Added new JavaScript tests for
cowriter.jsexecute handler,UrlLoader.jsauto-init, andAIService.jsbuffer flush - Added infrastructure:
infection.json5,codecov.yml, and.github/workflows/testing.yml - Enabled
failOnWarning="true"in all PHPUnit configs; removed legacy<coverage>block fromFunctionalTests.xml
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
Tests/Unit/Domain/DTO/CompleteRequestFuzzTest.php |
91 parametrized fuzz/adversarial tests for CompleteRequest::fromRequest() and isValid() |
Tests/JavaScript/cowriter.test.js |
16 new tests for button execute handler including success, error, and edge-case paths |
Tests/JavaScript/AIService.test.js |
1 new test for final SSE buffer flush content delivery |
Tests/JavaScript/UrlLoader.test.js |
1 new test for DOMContentLoaded auto-initialization path |
infection.json5 |
New Infection mutation testing configuration file |
codecov.yml |
New Codecov configuration with per-flag coverage tracking |
.github/workflows/testing.yml |
New workflow for mutation testing, JS coverage, and fuzz testing jobs |
composer.json |
Added infection/infection and its plugin to dev dependencies |
Build/phpunit/UnitTests.xml |
Changed failOnWarning from false to true |
Build/phpunit/IntegrationTests.xml |
Changed failOnWarning from false to true |
Build/phpunit/E2ETests.xml |
Changed failOnWarning from false to true |
Build/phpunit/FunctionalTests.xml |
Changed failOnWarning + removed <coverage> report block |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
CybotTM
changed the title
|
Warning Large PR detected: 2826 lines changed across 25 files. |
CybotTM
force-pushed
the
feature/modernize-v13-v14
branch
from
7b6e674 to
30572e1
Compare
CybotTM
force-pushed
the
feature/modernize-v13-v14
branch
3 times, most recently
from
30572e1 to
0a4d775
Compare
|
Warning Large PR detected: 2831 lines changed across 26 files. |
|
Warning Large PR detected: 2909 lines changed across 31 files. |
|
Warning Large PR detected: 2947 lines changed across 33 files. |
|
Warning Large PR detected: 3443 lines changed across 38 files. |
|
Warning Large PR detected: 3445 lines changed across 39 files. |
|
Warning Large PR detected: 3458 lines changed across 39 files. |
CybotTM
changed the title
CybotTM
force-pushed
the
feature/modernize-v13-v14
branch
from
24efe7e to
bb37791
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
… assembly Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
… dialog Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Add Playwright E2E test infrastructure and 9 tests covering: - Dialog opens with context zoom slider (not radio buttons) - Slider changes update the scope label - Reference page rows can be added/removed - Task selector and ad-hoc rules inputs work - Execute task shows result preview - Cancel closes the dialog - State resets when task or slider changes after generation Includes TYPO3 backend auth fixture, helper functions for CKEditor and modal interactions, and configurable credentials via environment variables. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
…ebounce - Add backend user page access check in ContextAssemblyService - Validate field names against /^[a-z][a-z0-9_]*$/i pattern in DTOs - Truncate relation strings to 100 chars in ExecuteTaskRequest - Add 300ms debounce on slider context preview AJAX requests - Fix PHPStan errors (BackendUserAuthentication type check, preg_match) - Apply PHP-CS-Fixer formatting Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Security fixes: - Add page access check in fetchSingleRecord (authorization bypass) - Add table name validation at service layer (defense-in-depth) - Expand HTML sanitizer to strip base/meta/link/noscript/template - Detect data:/vbscript: URI schemes and whitespace bypass in sanitizer Accessibility fixes: - Add aria-label and aria-valuetext on context slider - Associate form labels with controls via for/id attributes - Add aria-label on reference page remove button - Hide "Selection" tick label when no text is selected UX fixes: - Keep Cancel button enabled during loading (user was trapped) - Add Bootstrap spinner during generation - Add min=1 on page ID input to prevent negative values - Fix stale getContext response race condition - Clear debounce timer on dialog close Code quality: - Extract duplicate scope arrays to module-level constants - Complete recordContext validation in isValid() (uid + field) - Update _routes JSDoc to include all 6 properties - Remove unnecessary Content-Type header from GET requests Test coverage: - Add page access denial tests (missing BE_USER, disallowed table) - Add accessibility tests (ARIA, label associations) - Add sanitizer tests (dangerous elements, URI schemes) - Update tests for spinner and cancel-button behavior Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de> Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
TYPO3 v14 renders module content (CKEditor, forms) inside an iframe
and modals as native <dialog> elements via <typo3-backend-modal> web
components. Updated E2E test fixtures and specs to:
- Use frameLocator for CKEditor interactions inside the module iframe
- Use getByRole('dialog') for modal interactions in the top-level page
- Use getByRole('button') instead of data-name selectors for buttons
- Handle Execute->Insert button text change after LLM generation
- Add getModuleFrame() helper for consistent iframe access
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Task templates now focus on WHAT to do (improve, summarize, translate)
without prescribing specific formatting elements. Formatting guidance
is handled by system messages (editor capabilities, reference context).
- Remove formatting prescriptions (h2, h3, lists, tables) from text
task templates; keep them only in formatting-specific tasks
- Remove regex hack that stripped heading/list instructions at runtime
- Simplify scope instruction for selections
- Add heading-level/list-style matching to reference context
- Strengthen ad-hoc rules ("follow exactly" instead of "apply")
- Fix capabilities message to not discourage style usage
- Add inline style examples (color, background-color, mark)
- Inject ad-hoc rules before input content, not as separate message
- Add scope constraint and reference context system messages
- Update JS to pass editor capabilities and ad-hoc rules in payload
- Update all related unit and JS tests
Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de> Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
CybotTM
force-pushed
the
feature/modernize-v13-v14
branch
from
e46b277 to
931d6cc
Compare
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 79 out of 83 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
CybotTM
changed the title
- Add ContextAssemblyServiceInterface mock to E2E and integration test constructors (7th param added by context zoom feature) - Add tx_cowriter_context to UrlLoader allowedKeys - Fix AIService.js URL separator (? vs & based on existing query string) - Make RTE preset opt-in (commented out in page.tsconfig) - Update UrlLoader test to verify context route key Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de> Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
- Add htmlspecialchars() to all AJAX response fields (complete, chat, stream, getTasks, executeTask) to prevent XSS from LLM output - Restrict ci.yml push trigger to main branch only, preventing duplicate CI runs on PR branches (push + pull_request events) - Update unit tests to expect HTML-escaped output Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 80 out of 84 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add 34 targeted unit tests to kill escaped mutants, raising MSI from 71% to 85% (covered MSI 78% → 87%). Add _decodeEntities() in CowriterDialog.js to reverse server-side htmlspecialchars encoding before passing content to CKEditor's data processor. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de> Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
Summary
Major modernization of t3x-cowriter for TYPO3 v13 and v14: a task-based cowriter dialog, context-aware AI processing with "context zoom," clean prompt architecture, and a comprehensive testing pyramid — backed by a ddev demo environment for hands-on verification.
Task-based cowriter dialog
ddev seed-cowriter-tasksContext zoom
getContextpreview endpoint for word count / summary before executionClean prompt architecture
Testing
TYPO3 v13 + v14 compatibility
ajax_prefix)page.tsconfigddev demo environment
seed-pages/seed-ollama/seed-cowriter-taskscommandsUpstream dependency fixes
Test plan
make upcompletes successfully (both v13 and v14 install)composer ci:test:php:unit(354 tests)npx vitest run(122 tests)