Also fixes a reference to a Create permissionft hat should be a Register
permission.
Leaf check-in: 91318928a9 user: rouilj tags: command_palette_and_timer

Send a change event to the time spent field. This acts the same as
though the 'time spent' field had been manually changed edited.

So you get:

field label background change
page h1 background change and pending change notification text
favicon ! label on yellow circle on browser tab

You can now change the time spent input field and trigger the timer
without having to unfocus from the input field.

For this to work, it needs a fixed version of comand-pal.js. check-in: f3474bd466 user: rouilj tags: command_palette_and_timer

Starting the timer updates the time field with 1 minute more than
existing time. It also sets the background for the label to
pending_change class. check-in: 3f7fba4459 user: rouilj tags: command_palette_and_timer

This starts the timer at 1 minute, so fractional parts of a minute are
rolled up to the next minute. check-in: aef552e939 user: rouilj tags: command_palette_and_timer

I have a few command-pal entries that only work/make sense from the
url of the index without an @template. This checks to make sure that
template is not specified. check-in: b1c92cebcb user: rouilj tags: command_palette_and_timer

Prevent scrolling of the command list allowing scroll of the
background.

On mobile, the soft keyboard shows up when command-pal is triggered.
This overlaps with the list making the end of the list unviewable.
Change max-length for list to be min(360px, 45vh - 30px) or if 80dvh
if dvh is understood. 30px is for the search bar, on smaller devices
the keyboard can take 50vh.. check-in: 31a28bfce1 user: rouilj tags: command_palette_and_timer

Was missing nonce. check-in: 8083ba3af3 user: rouilj tags: command_palette_and_timer

The rebuilt command-pal js library calls this function to report the
sha256 hashes that need to be added to the CSP for the application so
that command-pal will work.

This is placed here so it can be turned into a no-op once a static
command-pal.js is deployed. check-in: 470ee0aa67 user: rouilj tags: command_palette_and_timer

Defined some 20 commands. A basic filtering mecahsnism on context.
E.G. none of the timer start/pause/unpause/stop commands are available
except on an issueXXX page. Similarly there are command that only work
on issue index pages. Also there are commands that work on all
contexts.

Timer allows start/pause/restart/stop functions. It will inherit the
number of minutes from the Time Spent field and start timing there.
When the timer is not stopped, the Time Spent field has a yellow color
that is static if the timer is stopped and sweeps between yellow and
goldenrod if the timer is active.

One problem with this is that command-pal uses styling by setting
element.style directly. This is incompatible with the CSP in use. So
this commit also change the CSP to use unsafe-inline for css.

Vendored the following JS projects:

https://github.com/benwinding/command-pal v0.2.7 from cdn

https://github.com/albert-gonzalez/easytimer.js v4.5.4

Prevent browser from trying to spellcheck password fields.
Prevents browser from exfiltrating info by word lookup.

https://www.aaron-gustafson.com/notebook/spellcheckers-exfiltrating-pii_-not-so-fast/
via https://www.htmhell.dev/adventcalendar/2022/23/
check-in: 6aaf2bc53c user: rouilj tags: trunk

Use sh syntax for test [] not bash [[ ]].
full_display.png shows a collapsed fieldsset now.
added upload-image target to put full_display.png in unversioned
part of fossil for use as opengraph image.

Added generate_images target that uses splinter symbolic link to
regenerate new images w/o having to navigate to the splinter
directory.

Changed sysadmin.rst to reference older version of roundup were before
1.0. They were probably before 0.8 but I can't prove that.
check-in: 7cb537a93a user: rouilj tags: trunk

All options that were in docutils.conf are now on command line in
Makefile. Doc generation occurs on multiple machines with stylesheets
in different locations. Makefile identifies correct path. Also
stylesheets and stylesheets-inline were issuing errors when put in
docutils.conf with rst2html5 version 2.

Removed docutils.conf.

Bash script with indentation was causing html generation to fail when
used as literal block after ::. Using .. code: bash to maybe get
pygments formated code. At the very least without :: it parses
and preserved indentation correctly. check-in: 236133101d user: rouilj tags: trunk

Was having issues with structures on a newer 0.18 docutils.
check-in: e3df067491 user: rouilj tags: trunk

Aligned labels to center of input/selects so text aligns.

Pruned delcarations that were messing up or were intended to have
effect on alignment but didn't.

Made sure Topic label is always on top of select2 widget. With other
alignment it was ending up on the left and making the widget too
narrow.

Remove label tags if they do not have a for attribute (grouped by,
referenced by ..). Replace with span class=pseudolabel.
check-in: 245f608480 user: rouilj tags: trunk

Make sure border color for fieldset matches pseudo color for .fieldset.
check-in: 2246d1bef5 user: rouilj tags: trunk

Ok and Error messages get check icon and warning css icon
respectfully. If the message is multiple lines they wrap under the
icon. Stop that from happening. Allow the clear message link for ok
messages to show up under the icon.
check-in: d09f4eb1a7 user: rouilj tags: trunk

Implement focus styles from

https://css-tricks.com/standardizing-focus-styles-with-css-custom-properties/

using outline rather than current box shadow because high contrast mode
drops block shadow.

Had to modify items with 6px block margin or block padding to keep
focus ring from overlaping adjacent elements.

Also started using custom props (aka variables). In this file used
"private" varaibles. So --_theme-highlight used internally but set as
--theme-highlight in a theme file.

Also use --_theme-border for border rule between main columns in
issue.item and underline fieldset legends.
check-in: f131e17ed5 user: rouilj tags: trunk

We aren't generating xhtml. Remove those since input, link don't
have /input or /link so closing /> should just be >.

Also fix quoting/syntax for emitting style with nonce.
check-in: 3200dc3ae4 user: rouilj tags: trunk

Also move required not before form submit buttons.

Some reformatting of tables.
check-in: 4dc808d433 user: rouilj tags: trunk

Also improve contrast using black against buttons to meet aria requrements.
check-in: 0de40bea81 user: rouilj tags: trunk

Also fix up indentation and order properties for a few rules I missed.
check-in: 55bab59bfe user: rouilj tags: trunk

Also cleaned up some invalid/unsued css.
check-in: 6ab425881f user: rouilj tags: trunk

Removed borders from all fieldsets. Removed colored background from
under fieldset legends. Put 2px rule spanning fieldset width under
legend.

discussed in

https://dev.to/rouilj/a-modern-form-update-and-interior-border-hack-with-css-grid-4kae

Fixed tab when using default style. Color was set to transparent. Set
color to --theme-surface and if not defined, use transparent as the
theme is probably setting the background color on the tab to prevent
show through.
check-in: 7976dc3176 user: rouilj tags: trunk

Removed screenreaderonly label tags that duplicated the legend text.
check-in: 85773edd92 user: rouilj tags: trunk

Remove the border around each fieldset.

Put a line between the two main columns when 2-up.
Remove line when the two columns are made into a single column.

This looks cleaner to me. check-in: 444c149e31 user: rouilj tags: trunk

Add .visually-hidden class to the style section so it can be used
independently.

Add reference url's. check-in: 880f2c0ebb user: rouilj tags: trunk

Also remove role=navigation from a div as it is inside a

make it easier for mobile login.
check-in: c6071289f5 user: rouilj tags: trunk

For now the graphs are stand alone svg documents displayed in a new
window/tab. The css background chnages, remove of xml delcaration, csp
nonce/changes etc. are meant to start allowing the images to be
generated inside an html page generated by page.html.

chart.py:

Add missing check for View permission on each item to be
graphed. Before the items was counted, but not displayed when drilling
down into the table view. If there was only 1 item this was very
obvious but is a problem in any case.

Add support for query param @image_type to allow user to select svg
(default), png, or data: output. Before this output format was
hardcoded.

Support for data: output. Not sure how data will be used yet. AM
hoping I can call charting action from template code and set an object
src to the data: url.

Support variable for setting URL for pygal-tooltips.js.

Add nonce to generated svg for use with object tag in html.

Set tooltip popup background to white as other changes make svg image
background transparent so it will be able to be displayed embedded in
a page.html generated page.

Remove xml declaration from generated svg.

Add docstrings.

templating.py:

Add nonce to object CSP property. This should allow use of object tag
to embed SVG in a page.html wrapped page and activate js code and
syles.

pygal-tooltips.js:

Add target and xlink:show attributes for the 'Link >' link that shows
up when hovering over a pie wedge or bar. It would try to open in
current window otherwise.

The bare inline number didn't really indicate it was a footnote and
looked/read out of place on the same line of text.
check-in: 519a735ce7 user: rouilj tags: trunk

Changed css from using :last-of-type() to use class th.main-toggle or
tr.toggle.

Footer still doesn't work. Use tal:replace=nothing on tfoot tag to
hide it. Need to wait for podtable to be fixed so that
data-ptr-ignore="" on a tr in the tfoot is respected.

Make sticky headers work by removing overflow-x on #potable-container.

Darken label in details child pane.
check-in: 898fe7684d user: rouilj tags: podtable

They were just text not labels, so clicking on them didn't
select corresponding radiobutton.
check-in: 7a489f5027 user: rouilj tags: trunk

If the note textarea isn't displayed, don't display the note to
drag/drop files into it.
check-in: 52408a3d4e user: rouilj tags: trunk

Current tab looks like it's on top of other tab, you can see edge of
the tab. Curve the li elements so that hovering over the unselected
tab doesn't cause a flash of square corner color from the selected
tab. check-in: eb3de5d918 user: rouilj tags: trunk

Also added a couple of missing properties.

Document new drag/drop/paste interface since the change to use the
Change Note textarea as the drop zone.

Changed terminology in caption to match labels in image.

Document time log in new time log and attached files section..
check-in: 8eb652e1a9 user: rouilj tags: trunk

If context.id is false (new user), don't check to see if 2fa is enabled.
check-in: a9d9d9184e user: rouilj tags: trunk

Change default Option to a SecretOption.
check-in: 51112813e9 user: rouilj tags: trunk

Commented out settings, so HOTP/TOTP enabled with default settings.
check-in: 8291695efa user: rouilj tags: trunk

Use new external secret feature for storing secrets.

Change to whoosh for indexer for testing some core
code improvements.
check-in: d6b809a6e2 user: rouilj tags: trunk

2fa.py:
Add new two_fa_disabled(context) templating method. Returns True if
both 2fa methods are disabled.

page.html:

Remove all
's in login fieldset. Use div's to break items onto
new lines or when row is too short and inputs wrap normally. Wrap
2fa label/element in div and only show if 2fa not disabled. Also
wrap" remember me" and label in div to put in block. Fix indents.

Relace threedface it ButtonFace - threedface dericated
fix a couple of syntax errors

Set all var of --clr* to use inherit as fallback.

Remove uneeded comments
check-in: cdb1dc4f1d user: rouilj tags: trunk

user.2fa.html:

add checbox to enable 2fa.

HotpTotp.py:

allow password change for TOTP check that secret_counter in [0, -2]
if missing from newvalues.

2fa.py:

TOTP added

module docstring improved. includes config.ini setting.

Implmented abilty to disable hotp and/or totp.

If hotp/totp disabled can optionally fail logins for users using
the method

TOTP uses OTP session store for saving TOTP's to prevent replay
attack

TOTP symmetric windowing to sync to token allowed, but not enabled
by default.

cleaner flow by returning early in Generate2faSecret::handle

general cleanup

Makes it easier to upload.

Also about now can handle case where tracker_version isn't found.
Also users with Admin Role have access to details.
check-in: 9481019583 user: rouilj tags: trunk

Set a property on the db handle in the 2fa generator action.

In the detector look for this property. If the secret_2fa changes and
the property is missing and the transaction source is not cli, reject
the change. This prevents the user from submitting a form with a
secret like 32 A's.

Sanity check the state of secret_counter and secret_2fa. Look for
counter != -1 if secret == '-' or vice versa.

Fix reading the window from the config file.
check-in: be433d9dc0 user: rouilj tags: trunk

html/page.html:
add field for entring OTP

html/user.item.html:
add link to OTP management page

html/user.2fa.html:
OTP management page

interfaces.py:
change password strength wrapper for password change to allow '-'
if password scheme is plaintext. This is the unenrolled password
as the form parser prevents setting an empty password.

schema.py:
add properties to user class for storing HOP counter/sequence number
and secret code

detectors/HotpTotp.py
enforce rules for secret code and how secret code and sequence
variables can be changed.

extensions/2fa.py
template functions for user.2fa.html including QR code generation
(if qrcode library installed). Actions to regenerate 2FA code and
login wrapper that uses 2FA.

lib/onetimepass/__init__.py
library implementing HOTP/TOTP
check-in: 6bbfabaa4b user: rouilj tags: trunk

New reset sets no margin for paragraphs.
check-in: 22acf6eb3e user: rouilj tags: trunk

Added a div around file input that's inline-block. So newly added
file inputs align on the left to the edge of the div.

Also detect missing elements used by in page javascript for message
search. Return if element is missing. Last commit hid the element when
a new issue page is displayed. This commit prevents the javascript
looking for the control from throwing an error.
check-in: 626475ebdb user: rouilj tags: trunk

Active message filtering box was being displayed when creating a new
issue.
check-in: 7836905482 user: rouilj tags: trunk

Apprently has to be first to work right. This will make
the timing a little slower but....
check-in: aabd76386d user: rouilj tags: trunk

Beacon API code cribbed from

https://calendar.perfplanet.com/2020/beaconing-in-practice

with fallback to Image beacon that already existed.
check-in: 814ae41abd user: rouilj tags: trunk

A copy has multiple encoding for it. png image, unicode string etc.
On paste it was pasting the png as well. Once we have handled text
paste, prevent the default action that would add a second text copy
to the textarea.

Also make sure preventDefault is called in other places it should be.
check-in: a93202c9ff user: rouilj tags: trunk

Removed dropzone using changenote as the drop zone.

The following seem to work:

drag/drop files - attached if on first file input
drag/drop file - attached
copy/paste file - attached
drag/drop text - text/plain inserted in changenote at cursor
copy/paste text - inserted at changenote at cursor

added label at bottom of textarea.
check-in: 4cbf95252a user: rouilj tags: trunk

It was catching url fragments like .../issue8#22a and mangling the
text and href params.

Make preceeding space required. His works for # <digits> at the
beginning of a line in a message but not at the beginning of a
message.
check-in: 330f449b01 user: rouilj tags: trunk

Take same generated nested list code and use with ross-angus css plus
my additions to provide a vertically oriented tree with details.

changes class on ul from htree to tree.
check-in: 73842a7e5c user: rouilj tags: trunk