Conversation
…figuration and setup
❌ Issue Linking RequiredThis PR could not be linked to an issue. All PRs must be linked to an issue for tracking purposes. How to fix this:Option 1: Add keyword to PR body (Recommended - auto-removes this comment)
Why is this required?Issue linking ensures proper tracking, documentation, and helps maintain project history. It connects your code changes to the problem they solve.--- This comment was automatically generated by the issue linking workflow |
github-actions
bot
added
the
Area : Frontend
|
Claude finished @rjvelazco's task in 2m 40s —— View job PR Review
This is a WIP PR and several issues need to be resolved before it's merge-ready. 🔴 Critical1. Hardcoded JWT token committed to the repo
A real JWT token with a 2029 expiry is in the committed code. The "local demo only" comment does not change the fact that this token is now in git history permanently and usable by anyone who has read access to the repo. All three API services ( Beyond just removing the value, the config file itself is the wrong pattern for a shared library. The consuming app should provide these values via an injection token: export const DOT_CMS_CONFIG = new InjectionToken<{ baseUrl: string; authToken: string }>('DOT_CMS_CONFIG');Services would then 2.
expect(compiled.querySelector('h1')?.textContent).toContain('Hello, block-editor');The 3. Out-of-bounds
🟡 Medium4.
extensions: createEditorExtensions(this.menuService, this.allowedBlocks())
5. Commented-out loading state in
6. Removed
8 lines of 7.
8. No user-visible upload error feedback
Upload failures silently 🔵 Low / Informational9. Unused scaffolding files in the lib
10.
Hard-coded 11.
Uploads always publish to the site root folder. This should be configurable. SummaryThree things block merge: the hardcoded token (security), the broken test (CI), and the out-of-bounds activeIndex (crash). Items 4–8 should be addressed before this leaves WIP. Items 9–11 are fine to track separately. |
|
Rollback Safety Analysis - Safe to Roll Back. All 9 changed files are frontend Angular config only (new-block-editor library scaffold). Label AI: Safe To Rollback applied. |
… the new Block Editor V1
…older enhancements
…d error handling and empty state management
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 4 potential issues.
Bugbot Autofix is kicking off a free cloud agent to fix these issues. This run is complimentary, but you can enable autofix for all future PRs in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 77fd1d1. Configure here.
| */ | ||
| export const DOT_CMS_BASE_URL = 'http://localhost:8080'; | ||
| export const DOT_CMS_AUTH_TOKEN = | ||
| 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhcGljNjI1Yjg1NC0zYzc2LTRjMjItYTc0Yy00MWI1M2NkYmYwMzkiLCJ4bW9kIjoxNzc1NzY3MDM0MDAwLCJuYmYiOjE3NzU3NjcwMzQsImlzcyI6ImRvdGNtcy1wcm9kdWN0aW9uIiwibGFiZWwiOiJkZXYiLCJleHAiOjE4NzA0MDE2MDAsImlhdCI6MTc3NTc2NzAzNCwianRpIjoiOGI1M2VmNmYtNzA4OS00NThmLThjMjQtNDMzN2Y1MmNiMGRmIn0.4Y4SMqhMDG0vJ4xbMTZ2AtSAIeyB5NEgZ7yIUMWkASg'; |
There was a problem hiding this comment.
Hardcoded JWT auth token committed to repository
High Severity
A full JWT token is hardcoded in DOT_CMS_AUTH_TOKEN and will be committed to the repository. Even though the comment says "local demo," this token is used by multiple services (DotCmsUploadService, DotCmsContentletService, DotCmsContentTypeService) for Authorization: Bearer headers against a dotCMS instance. This token has an expiry date in 2029 and is now exposed in version control history permanently.
Reviewed by Cursor Bugbot for commit 77fd1d1. Configure here.
| this.commandFn = null; | ||
| // isOpen and clientRectFn unchanged — menu is already visible and positioned | ||
| }); | ||
| } |
There was a problem hiding this comment.
Commented-out state updates cause stale menu display
Medium Severity
In openSubmenu(), the lines this.items.set([]), this.activeIndex.set(0), and this.isLoading.set(true) are all commented out. Similarly in setItems(), this.activeIndex.set(0) and this.isLoading.set(false) are commented out. This means the loading spinner never appears during async content-type fetches, stale items from the previous menu remain visible while loading, and activeIndex isn't reset when new sub-menu items arrive — risking an out-of-bounds selection on Enter.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 77fd1d1. Configure here.
| } | ||
| }) | ||
| ] | ||
| }; |
There was a problem hiding this comment.
Unused library files: app config, routes, and spec
Low Severity
app.config.ts, app.routes.ts, and app.spec.ts in libs/new-block-editor/src/lib/ are never imported by anything in the codebase. The app.config.ts sets up provideRouter with empty routes and PrimeNG theming that no consumer uses. The app.spec.ts tests App for an h1 containing "Hello, block-editor" which doesn't exist in the actual App template. These appear to be leftover scaffolding files.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 77fd1d1. Configure here.
| user-select: none !important; | ||
| } | ||
|
|
||
| code { |
There was a problem hiding this comment.
Shared global code CSS removed affecting other consumers
Medium Severity
The global code element styling (color, background, padding, font-family, line-break) was removed from the shared styles.scss in libs/dotcms-scss/angular/. This is a shared stylesheet imported by multiple applications, not just the block editor. Removing this rule may break code element rendering across all consuming apps that relied on this global style.
Reviewed by Cursor Bugbot for commit 77fd1d1. Configure here.
…o dialogs, enhancing search and display functionality
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
Rollback Safety Analysis
|
|
Rollback Safety Analysis - Safe to Roll Back. All 57 changed files are frontend Angular/TypeScript only (new-block-editor library scaffold, block-editor app refactor, SCSS, package.json). No database migrations, Elasticsearch mapping changes, API contract changes, or any backend code modified. Label AI: Safe To Rollback applied. |
1 participant
WIP
Videos
video.mov
Note
High Risk
High risk because this is a large refactor that swaps the block editor app to a new standalone editor implementation, upgrades TipTap/ngx-tiptap major versions, and adds dotCMS upload/search integrations including a hardcoded auth token/base URL in code.
Overview
Replaces the
dotcms-block-editorapp’s NgModule-based bootstrap with Angular standalonebootstrapApplicationand points the app at the newEditorComponentexported from@dotcms/new-block-editor, alongside updated Angular build target config (new executor/outputPath structure, dev config, baseHref).Adds a new
new-block-editorlibrary implementing an experimental TipTap v3-based editor with slash menu, toolbar, drag-handle gutter, link/image/video/table dialogs, emoji picker, upload placeholders, and dotCMS-backed asset/content-type search + upload services.Updates global styling for the new editor UI (Tailwind layers, typography plugin, Material Symbols, TipTap/table/link/upload-placeholder styles) and bumps editor-related dependencies (TipTap v3,
ngx-tiptap, Floating UI, emoji-mart); also removes a shared SCSScodestyle block.Reviewed by Cursor Bugbot for commit 77fd1d1. Bugbot is set up for automated code reviews on this repo. Configure here.