🐛 Avoid self reference on dropdown options

SECURITY.md

@@ -2,4 +2,30 @@
 
 ## Reporting a Vulnerability
 
-Please report security issues to `support@penpot.app`
+We take the security of this project seriously. If you have discovered
+a security vulnerability, please do **not** open a public issue.
+
+Please report vulnerabilities via email to: **[support@penpot.app]**
+
+
+### What to include:
+
+* A brief description of the vulnerability.
+* Steps to reproduce the issue.
+* Potential impact if exploited.
+
+We appreciate your patience and your commitment to **responsible disclosure**.
+
+---
+
+## Security Contributors
+
+We are incredibly grateful to the following individuals and
+organizations for their help in keeping this project safe.
+
+* **Ali Maharramli** – for identifying critical path traversal vulnerability
+
+
+> **Note:** This list is a work in progress. If you have contributed
+> to the security of this project and would like to be recognized (or
+> prefer to remain anonymous), please let us know.

backend/scripts/_env

@@ -29,8 +29,6 @@ export PENPOT_FLAGS="\
        enable-user-feedback \
        disable-secure-session-cookies \
        enable-smtp \
-       enable-cors \
-       disable-secure-session-cookies \
        enable-prepl-server \
        enable-urepl-server \
        enable-rpc-climit \

backend/src/app/http/middleware.clj

@@ -213,14 +213,14 @@
       (assoc "access-control-allow-origin" origin)
       (assoc "access-control-allow-methods" "GET,POST,DELETE,OPTIONS,PUT,HEAD,PATCH")
       (assoc "access-control-allow-credentials" "true")
-      (assoc "access-control-expose-headers" "content-type, set-cookie")
-      (assoc "access-control-allow-headers" "x-frontend-version, x-client, x-requested-width, content-type, accept, cookie")))
+      (assoc "access-control-expose-headers" "x-requested-with, content-type, cookie")
+      (assoc "access-control-allow-headers" "x-frontend-version, content-type, accept, x-requested-width")))
 
 (defn wrap-cors
   [handler]
   (fn [request]
     (let [response (if (= (yreq/method request) :options)
-                     {::yres/status 204}
+                     {::yres/status 200}
                      (handler request))
           origin   (yreq/get-header request "origin")]
       (update response ::yres/headers with-cors-headers origin))))

docker/images/docker-compose.yaml

@@ -198,13 +198,6 @@ services:
       ## Valkey (or previously Redis) is used for the websockets notifications.
       PENPOT_REDIS_URI: redis://penpot-valkey/0
 
-  penpot-mcp:
-    image: penpotapp/mcp:${PENPOT_VERSION:-latest}
-    restart: always
-
-    networks:
-      - penpot
-
   penpot-postgres:
     image: "postgres:15"
     restart: always

frontend/src/app/main/ui/ds/controls/shared/options_dropdown.cljs

@@ -35,6 +35,7 @@
 (def ^:private schema:options-dropdown
   [:map
    [:ref {:optional true} fn?]
+   [:wrapper-ref {:optional true} :any]
    [:on-click fn?]
    [:options [:vector schema:option]]
    [:selected {:optional true} :any]
@@ -83,6 +84,7 @@
                           :name name
                           :resolved (get option :resolved-value)
                           :ref ref
+                          :role "option"
                           :focused (= id focused)
                           :on-click on-click}]
 
@@ -94,6 +96,7 @@
                     :aria-label (get option :aria-label)
                     :icon (get option :icon)
                     :ref ref
+                    :role "option"
                     :focused (= id focused)
                     :dimmed (true? (:dimmed option))
                     :on-click on-click}]))))
@@ -101,7 +104,7 @@
 
 (mf/defc options-dropdown*
   {::mf/schema schema:options-dropdown}
-  [{:keys [ref on-click options selected focused empty-to-end align] :rest props}]
+  [{:keys [ref on-click options selected focused empty-to-end align wrapper-ref] :rest props}]
   (let [align
         (d/nilv align :left)
 
@@ -110,6 +113,7 @@
                          {:class (stl/css-case :option-list true
                                                :left-align (= align :left)
                                                :right-align (= align :right))
+                          :ref wrapper-ref
                           :tab-index "-1"
                           :role "listbox"})
 

frontend/src/app/main/ui/ds/controls/utilities/utils.cljs

@@ -0,0 +1,95 @@
+(ns app.main.ui.ds.controls.utilities.utils
+  (:require
+   [app.common.data.macros :as dm]
+   [app.common.types.token :as cto]
+   [app.util.i18n :refer [tr]]
+   [cuerdas.core :as str]))
+
+(defn- token->dropdown-option
+  [token]
+  {:id (str (get token :id))
+   :type :token
+   :resolved-value (get token :value)
+   :name (get token :name)})
+
+(defn- generate-dropdown-options
+  [tokens no-sets]
+  (if (empty? tokens)
+    [{:type :empty
+      :label (if no-sets
+               (tr "ds.inputs.numeric-input.no-applicable-tokens")
+               (tr "ds.inputs.numeric-input.no-matches"))}]
+    (->> tokens
+         (map (fn [[type items]]
+                (cons {:group true
+                       :type  :group
+                       :id (dm/str "group-" (name type))
+                       :name  (name type)}
+                      (map token->dropdown-option items))))
+         (interpose [{:separator true
+                      :id "separator"
+                      :type :separator}])
+         (apply concat)
+         (vec)
+         (not-empty))))
+
+(defn- extract-partial-brace-text
+  [s]
+  (when-let [start (str/last-index-of s "{")]
+    (subs s (inc start))))
+
+(defn- filter-token-groups-by-name
+  [tokens filter-text]
+  (let [lc-filter (str/lower filter-text)]
+    (into {}
+          (keep (fn [[group tokens]]
+                  (let [filtered (filter #(str/includes? (str/lower (:name %)) lc-filter) tokens)]
+                    (when (seq filtered)
+                      [group filtered]))))
+          tokens)))
+
+(defn- sort-groups-and-tokens
+  "Sorts both the groups and the tokens inside them alphabetically.
+
+   Input:
+   A map where:
+   - keys are groups (keywords or strings, e.g. :dimensions, :colors)
+   - values are vectors of token maps, each containing at least a :name key
+
+   Example input:
+   {:dimensions [{:name \"tres\"} {:name \"quini\"}]
+    :colors    [{:name \"azul\"} {:name \"rojo\"}]}
+
+   Output:
+   A sorted map where:
+   - groups are ordered alphabetically by key
+   - tokens inside each group are sorted alphabetically by :name
+
+   Example output:
+   {:colors    [{:name \"azul\"} {:name \"rojo\"}]
+    :dimensions [{:name \"quini\"} {:name \"tres\"}]}"
+
+  [groups->tokens]
+  (into (sorted-map) ;; ensure groups are ordered alphabetically by their key
+        (for [[group tokens] groups->tokens]
+          [group (sort-by :name tokens)])))
+
+(defn get-token-dropdown-options
+  [tokens filter-term]
+  (delay
+    (let [tokens  (if (delay? tokens) @tokens tokens)
+
+          sorted-tokens (sort-groups-and-tokens tokens)
+          partial (extract-partial-brace-text filter-term)
+          options (if (seq partial)
+                    (filter-token-groups-by-name sorted-tokens partial)
+                    sorted-tokens)
+          no-sets? (nil? sorted-tokens)]
+      (generate-dropdown-options options no-sets?))))
+
+(defn filter-tokens-for-input
+  [raw-tokens input-type]
+  (delay
+    (-> (deref raw-tokens)
+        (select-keys (get cto/tokens-by-input input-type))
+        (not-empty))))

frontend/src/app/main/ui/workspace/tokens/management.cljs

@@ -143,8 +143,7 @@
            (let [token-ids (set tokens-in-path-ids)
                  remaining-tokens (filter (fn [token]
                                             (not (contains? token-ids (:id token))))
-                                          selected-token-set-tokens)
-                 _ (prn "Remaining tokens:" remaining-tokens)]
+                                          selected-token-set-tokens)]
              (seq remaining-tokens))))
 
         delete-token

frontend/src/app/main/ui/workspace/tokens/management/forms/border_radius.cljs

@@ -0,0 +1,20 @@
+
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.main.ui.workspace.tokens.management.forms.border-radius
+  (:require
+   [app.main.ui.workspace.tokens.management.forms.controls :as token.controls]
+   [app.main.ui.workspace.tokens.management.forms.generic-form :as generic]
+   [rumext.v2 :as mf]))
+
+
+(mf/defc form*
+  [{:keys [token token-type] :rest props}]
+  (let [props (mf/spread-props props {:token token
+                                      :token-type token-type
+                                      :input-component token.controls/combobox*})]
+    [:> generic/form* props]))

frontend/src/app/main/ui/workspace/tokens/management/forms/controls.cljs

@@ -2,6 +2,7 @@
   (:require
    [app.common.data.macros :as dm]
    [app.main.ui.workspace.tokens.management.forms.controls.color-input :as color]
+   [app.main.ui.workspace.tokens.management.forms.controls.combobox :as combobox]
    [app.main.ui.workspace.tokens.management.forms.controls.fonts-combobox :as fonts]
    [app.main.ui.workspace.tokens.management.forms.controls.input :as input]
    [app.main.ui.workspace.tokens.management.forms.controls.select :as select]))
@@ -16,4 +17,6 @@
 (dm/export fonts/fonts-combobox*)
 (dm/export fonts/composite-fonts-combobox*)
 
-(dm/export select/select-indexed*)
+(dm/export select/select-indexed*)
+
+(dm/export combobox/combobox*)

frontend/src/app/main/ui/workspace/tokens/management/forms/controls/combobox.cljs

@@ -0,0 +1,410 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.main.ui.workspace.tokens.management.forms.controls.combobox
+  (:require-macros [app.main.style :as stl])
+  (:require
+   [app.common.data :as d]
+   [app.common.types.token :as cto]
+   [app.common.types.tokens-lib :as ctob]
+   [app.main.data.style-dictionary :as sd]
+   [app.main.ui.context :as muc]
+   [app.main.ui.ds.buttons.icon-button :refer [icon-button*]]
+   [app.main.ui.ds.controls.input :as ds]
+   [app.main.ui.ds.controls.select :refer [get-option]]
+   [app.main.ui.ds.controls.shared.options-dropdown :refer [options-dropdown*]]
+   [app.main.ui.ds.controls.utilities.utils :as csu]
+   [app.main.ui.ds.foundations.assets.icon :as i]
+   [app.main.ui.forms :as fc]
+   [app.util.dom :as dom]
+   [app.util.forms :as fm]
+   [app.util.i18n :refer [tr]]
+   [app.util.keyboard :as kbd]
+   [app.util.object :as obj]
+   [beicon.v2.core :as rx]
+   [cuerdas.core :as str]
+   [rumext.v2 :as mf]))
+
+(defn- focusable-option?
+  [option]
+  (and (:id option)
+       (not= :group (:type option))
+       (not= :separator (:type option))))
+
+(defn- first-focusable-id
+  [options]
+  (some #(when (focusable-option? %) (:id %)) options))
+
+(defn next-focus-id
+  [options focused-id direction]
+  (let [focusable (filter focusable-option? options)
+        ids (map :id focusable)
+        idx (.indexOf (clj->js ids) focused-id)
+        next-idx (case direction
+                   :down (min (dec (count ids)) (inc (if (= idx -1) -1 idx)))
+                   :up   (max 0 (dec (if (= idx -1) 0 idx))))]
+    (nth ids next-idx nil)))
+
+
+(defn extract-partial-token
+  [value cursor]
+  (let [text-before (subs value 0 cursor)
+        last-open  (str/last-index-of text-before "{")
+        last-close (str/last-index-of text-before "}")]
+    (when (and last-open (or (nil? last-close) (> last-open last-close)))
+      {:start last-open
+       :partial (subs text-before (inc last-open))})))
+
+(defn replace-active-token
+  [value cursor new-name]
+
+  (let [before     (subs value 0 cursor)
+        last-open  (str/last-index-of before "{")
+        last-close (str/last-index-of before "}")]
+
+    (if (and last-open
+             (or (nil? last-close)
+                 (> last-open last-close)))
+
+      (let [after-start (subs value last-open)
+            close-pos   (str/index-of after-start "}")
+            end         (if close-pos
+                          (+ last-open close-pos 1)
+                          cursor)]
+        (str (subs value 0 last-open)
+             "{" new-name "}"
+             (subs value end)))
+      (str (subs value 0 cursor)
+           "{" new-name "}"
+           (subs value cursor)))))
+
+(defn active-token [value input-node]
+  (let [cursor (.-selectionStart input-node)]
+    (extract-partial-token value cursor)))
+
+(defn remove-self-token [filtered-options current-token]
+  (let [group (:type current-token)
+        current-id (:id current-token)
+        filtered-options (deref filtered-options)]
+    (update filtered-options group
+            (fn [options]
+              (remove #(= (:id %) current-id) options)))))
+
+
+(defn- select-option-by-id
+  [id options-ref input-node value]
+  (let [cursor     (.-selectionStart input-node)
+        options    (mf/ref-val options-ref)
+        options    (if (delay? options) @options options)
+
+        option     (get-option options id)
+        name       (:name option)
+        final-val  (replace-active-token value cursor name)]
+    final-val))
+
+(defn- resolve-value
+  [tokens prev-token token-name value]
+  (let [valid-token-name?
+        (and (string? token-name)
+             (re-matches  cto/token-name-validation-regex token-name))
+
+        token
+        {:value value
+         :name (if (or (not valid-token-name?) (str/blank? token-name))
+                 "__PENPOT__TOKEN__NAME__PLACEHOLDER__"
+                 token-name)}
+        tokens
+        (-> tokens
+            ;; Remove previous token when renaming a token
+            (dissoc (:name prev-token))
+            (update (:name token) #(ctob/make-token (merge % prev-token token))))]
+
+    (->> tokens
+         (sd/resolve-tokens-interactive)
+         (rx/mapcat
+          (fn [resolved-tokens]
+            (let [{:keys [errors resolved-value] :as resolved-token} (get resolved-tokens (:name token))]
+              (if resolved-value
+                (rx/of {:value resolved-value})
+                (rx/of {:error (first errors)}))))))))
+
+(mf/defc combobox*
+  [{:keys [name tokens token token-type empty-to-end ref] :rest props}]
+
+  (let [form              (mf/use-ctx fc/context)
+        _ (prn "token" token)
+
+        input-name        name
+        token-name        (get-in @form [:data :name] nil)
+
+        is-open*          (mf/use-state false)
+        is-open           (deref is-open*)
+
+        listbox-id        (mf/use-id)
+        filter-term*      (mf/use-state "")
+        filter-term       (deref filter-term*)
+
+        focused-id*       (mf/use-state nil)
+        focused-id        (deref focused-id*)
+
+        options-ref       (mf/use-ref nil)
+        dropdown-ref      (mf/use-ref nil)
+        internal-ref      (mf/use-ref nil)
+        nodes-ref         (mf/use-ref nil)
+        icon-button-ref   (mf/use-ref nil)
+        ref               (or ref internal-ref)
+
+        touched?
+        (and (contains? (:data @form) input-name)
+             (get-in @form [:touched input-name]))
+
+        error
+        (get-in @form [:errors input-name])
+
+        value
+        (get-in @form [:data input-name] "")
+
+        raw-tokens-by-type (mf/use-ctx muc/active-tokens-by-type)
+
+        filtered-tokens-by-type
+        (mf/with-memo [raw-tokens-by-type token-type]
+          (csu/filter-tokens-for-input raw-tokens-by-type token-type))
+
+        visible-options
+        (mf/with-memo [filtered-tokens-by-type token]
+          (if token
+            (remove-self-token filtered-tokens-by-type token)
+            filtered-tokens-by-type))
+
+        dropdown-options
+        (mf/with-memo [visible-options filter-term]
+          (csu/get-token-dropdown-options visible-options (str "{" filter-term)))
+
+        set-option-ref
+        (mf/use-fn
+         (fn [node]
+           (let [state (mf/ref-val nodes-ref)
+                 state (d/nilv state #js {})
+                 id    (dom/get-data node "id")
+                 state (obj/set! state id node)]
+             (mf/set-ref-val! nodes-ref state))))
+
+        toggle-dropdown
+        (mf/use-fn
+         (mf/deps)
+         (fn [event]
+           (dom/prevent-default event)
+           (swap! is-open* not)))
+
+        resolve-stream
+        (mf/with-memo [token]
+          (if (contains? token :value)
+            (rx/behavior-subject (:value token))
+            (rx/subject)))
+
+        on-change
+        (mf/use-fn
+         (mf/deps resolve-stream input-name form)
+         (fn [event]
+           (let [node   (dom/get-target event)
+                 value  (dom/get-input-value node)
+                 token  (active-token value node)]
+
+             (fm/on-input-change form input-name value)
+             (rx/push! resolve-stream value)
+
+             (if token
+               (do
+                 (reset! is-open* true)
+                 (reset! filter-term* (:partial token)))
+               (do
+                 (reset! is-open* false)
+                 (reset! filter-term* ""))))))
+
+        on-option-click
+        (mf/use-fn
+         (mf/deps value resolve-stream ref)
+         (fn [event]
+           (let [input-node (mf/ref-val ref)
+                 node       (dom/get-current-target event)
+                 id         (dom/get-data node "id")
+                 final-val  (select-option-by-id id options-ref input-node value)]
+
+             (fm/on-input-change form input-name final-val true)
+             (rx/push! resolve-stream final-val)
+
+             (reset! filter-term* "")
+             (reset! is-open* false)
+
+             (dom/focus! input-node)
+             (let [new-cursor (+ (str/index-of final-val "}") 1)]
+               (set! (.-selectionStart input-node) new-cursor)
+               (set! (.-selectionEnd input-node) new-cursor)))))
+
+        on-option-enter
+        (mf/use-fn
+         (mf/deps focused-id value resolve-stream)
+         (fn [_]
+           (let [input-node (mf/ref-val ref)
+                 final-val  (select-option-by-id focused-id options-ref input-node value)]
+             (fm/on-input-change form input-name final-val true)
+             (rx/push! resolve-stream final-val)
+             (reset! filter-term* "")
+             (reset! is-open* false))))
+
+        on-key-down
+        (mf/use-fn
+         (mf/deps is-open focused-id)
+         (fn [event]
+           (let [up?            (kbd/up-arrow? event)
+                 down?          (kbd/down-arrow? event)
+                 enter?         (kbd/enter? event)
+                 esc?           (kbd/esc? event)
+                 open-dropdown  (kbd/is-key? event "{")
+                 close-dropdown (kbd/is-key? event "}")
+                 options        (mf/ref-val options-ref)
+                 options        (if (delay? options) @options options)]
+
+             (cond
+               open-dropdown
+               (reset! is-open* true)
+
+               close-dropdown
+               (reset! is-open* false)
+
+               down?
+               (do
+                 (dom/prevent-default event)
+                 (if is-open
+                   (let [next-id (next-focus-id options focused-id :down)]
+                     (reset! focused-id* next-id))
+                   (when (some? @filtered-tokens-by-type)
+                     (do
+                       (toggle-dropdown event)
+                       (reset! focused-id* (first-focusable-id options))))))
+
+               up?
+               (when is-open
+                 (dom/prevent-default event)
+                 (let [next-id (next-focus-id options focused-id :up)]
+                   (reset! focused-id* next-id)))
+
+               enter?
+               (do
+                 (dom/prevent-default event)
+                 (if is-open
+                   (on-option-enter event)
+                   (do
+                     (reset! focused-id* (first-focusable-id options))
+                     (toggle-dropdown event))))
+
+               esc?
+               (do
+                 (dom/prevent-default event)
+                 (reset! is-open* false))))))
+
+        handle-blur
+        (fn [event]
+          (let [input-node    (mf/ref-val ref)
+                dropdown-node (mf/ref-val dropdown-ref)
+                next-focus    (.-relatedTarget event)]
+
+            (when (and next-focus
+                       (not (dom/child? next-focus input-node))
+                       (not (dom/child? next-focus dropdown-node)))
+              (reset! is-open* false))))
+
+        hint*
+        (mf/use-state {})
+
+        hint
+        (deref hint*)
+
+        props
+        (mf/spread-props props {:on-change on-change
+                                :value value
+                                :variant "comfortable"
+                                :hint-message (:message hint)
+                                :on-key-down on-key-down
+                                :hint-type (:type hint)
+                                :ref ref
+                                :role "combobox"
+                                :aria-activedescendant focused-id
+                                :aria-controls listbox-id
+                                :aria-expanded is-open
+                                :slot-end
+                                (when (some? @filtered-tokens-by-type)
+                                  (mf/html
+                                   [:> icon-button*
+                                    {:variant "action"
+                                     :icon i/arrow-down
+                                     :ref icon-button-ref
+                                     :tooltip-class (stl/css :button-tooltip)
+                                     :class (stl/css :invisible-button)
+                                     :tab-index "-1"
+                                     :aria-label (tr "ds.inputs.numeric-input.open-token-list-dropdown")
+                                     :on-click toggle-dropdown}]))})
+        props
+        (if (and error touched?)
+          (mf/spread-props props {:hint-type "error"
+                                  :hint-message (:message error)})
+          props)]
+
+    (mf/with-effect [resolve-stream tokens token input-name token-name]
+      (let [subs (->> resolve-stream
+                      (rx/debounce 300)
+                      (rx/mapcat (partial resolve-value tokens token token-name))
+                      (rx/map (fn [result]
+                                (d/update-when result :error
+                                               (fn [error]
+                                                 ((:error/fn error) (:error/value error))))))
+                      (rx/subs! (fn [{:keys [error value]}]
+                                  (let [touched? (get-in @form [:touched input-name])]
+                                    (when touched?
+                                      (if error
+                                        (do
+                                          (swap! form assoc-in [:extra-errors input-name] {:message error})
+                                          (reset! hint* {:message error :type "error"}))
+                                        (let [message (tr "workspace.tokens.resolved-value" value)]
+                                          (swap! form update :extra-errors dissoc input-name)
+                                          (reset! hint* {:message message :type "hint"}))))))))]
+        (fn []
+          (rx/dispose! subs))))
+
+    (mf/with-effect [dropdown-options]
+      (mf/set-ref-val! options-ref dropdown-options))
+
+    (mf/with-effect [is-open* ref nodes-ref]
+      (when @is-open*
+        (let [handler (fn [event]
+                        (let [input-node    (mf/ref-val ref)
+                              dropdown-node (mf/ref-val dropdown-ref)
+                              target        (dom/get-target event)]
+                          (when (and input-node dropdown-node
+                                     (not (dom/child? target input-node))
+                                     (not (dom/child? target dropdown-node)))
+                            (reset! is-open* false))))]
+
+          (.addEventListener js/document "mousedown" handler)
+
+          (fn []
+            (.removeEventListener js/document "mousedown" handler)))))
+
+    [:div {:class (stl/css :combobox-wrapper)
+           :on-blur handle-blur}
+     [:> ds/input* props]
+     (when ^boolean is-open
+       (let [options (if (delay? dropdown-options) @dropdown-options dropdown-options)]
+         [:> options-dropdown* {:on-click on-option-click
+                                :id listbox-id
+                                :options options
+                                :focused focused-id
+                                :selected nil
+                                :align :right
+                                :style {:top "56px"}
+                                :empty-to-end empty-to-end
+                                :wrapper-ref dropdown-ref
+                                :ref set-option-ref}]))]))

frontend/src/app/main/ui/workspace/tokens/management/forms/controls/combobox.scss

@@ -0,0 +1,3 @@
+.combobox-wrapper {
+  position: relative;
+}

frontend/src/app/main/ui/workspace/tokens/management/forms/form_container.cljs

@@ -9,6 +9,7 @@
    [app.common.data :as d]
    [app.common.types.tokens-lib :as ctob]
    [app.main.refs :as refs]
+   [app.main.ui.workspace.tokens.management.forms.border-radius :as test]
    [app.main.ui.workspace.tokens.management.forms.color :as color]
    [app.main.ui.workspace.tokens.management.forms.font-family :as font-family]
    [app.main.ui.workspace.tokens.management.forms.generic-form :as generic]
@@ -49,4 +50,5 @@
       :text-case [:> generic/form* text-case-props]
       :text-decoration [:> generic/form* text-decoration-props]
       :font-weight [:> generic/form* font-weight-props]
+      :border-radius [:> test/form* props]
       [:> generic/form* props])))

frontend/src/app/main/ui/workspace/tokens/management/forms/generic_form.cljs

@@ -21,6 +21,7 @@
    [app.main.data.workspace.tokens.remapping :as remap]
    [app.main.refs :as refs]
    [app.main.store :as st]
+   [app.main.ui.context :as muc]
    [app.main.ui.ds.buttons.button :refer [button*]]
    [app.main.ui.ds.foundations.assets.icon :as i]
    [app.main.ui.ds.foundations.typography.heading :refer [heading*]]
@@ -97,6 +98,10 @@
             (and (:name token) (:value token))
             (assoc (:name token) token)))
 
+        active-tokens-by-type
+        (mf/with-memo [tokens]
+          (delay (ctob/group-by-type tokens)))
+
         schema
         (mf/with-memo [tokens-tree-in-selected-set active-tab]
           (make-schema tokens-tree-in-selected-set active-tab))
@@ -224,78 +229,80 @@
                            error-message (first error-messages)]
                        (swap! form assoc-in [:extra-errors :value] {:message error-message}))))))))]
 
-    [:> fc/form* {:class (stl/css :form-wrapper)
-                  :form form
-                  :on-submit on-submit}
-     [:div {:class (stl/css :token-rows)}
+    [(mf/provider muc/active-tokens-by-type) {:value active-tokens-by-type}
+     [:> fc/form* {:class (stl/css :form-wrapper)
+                   :form form
+                   :on-submit on-submit}
+      [:div {:class (stl/css :token-rows)}
 
-      [:> heading* {:level 2 :typography "headline-medium" :class (stl/css :form-modal-title)}
-       (if (= action "edit")
-         (tr "workspace.tokens.edit-token" token-type)
-         (tr "workspace.tokens.create-token" token-type))]
+       [:> heading* {:level 2 :typography "headline-medium" :class (stl/css :form-modal-title)}
+        (if (= action "edit")
+          (tr "workspace.tokens.edit-token" token-type)
+          (tr "workspace.tokens.create-token" token-type))]
 
-      [:div {:class (stl/css :input-row)}
-       [:> fc/form-input* {:id "token-name"
-                           :name :name
-                           :label (tr "workspace.tokens.token-name")
-                           :placeholder (tr "workspace.tokens.enter-token-name" token-title)
-                           :max-length max-input-length
-                           :variant "comfortable"
-                           :trim true
-                           :auto-focus true}]]
+       [:div {:class (stl/css :input-row)}
+        [:> fc/form-input* {:id "token-name"
+                            :name :name
+                            :label (tr "workspace.tokens.token-name")
+                            :placeholder (tr "workspace.tokens.enter-token-name" token-title)
+                            :max-length max-input-length
+                            :variant "comfortable"
+                            :trim true
+                            :auto-focus true}]]
 
-      [:div {:class (stl/css :input-row)}
-       (case type
-         :indexed
-         [:> input-component
-          {:token          token
-           :tokens         tokens
-           :tab            active-tab
-           :value-subfield value-subfield
-           :handle-toggle  on-toggle-tab}]
+       [:div {:class (stl/css :input-row)}
+        (case type
+          :indexed
+          [:> input-component
+           {:token          token
+            :tokens         tokens
+            :tab            active-tab
+            :value-subfield value-subfield
+            :handle-toggle  on-toggle-tab}]
 
-         :composite
-         [:> input-component
-          {:token         token
-           :tokens        tokens
-           :tab           active-tab
-           :handle-toggle on-toggle-tab}]
+          :composite
+          [:> input-component
+           {:token         token
+            :tokens        tokens
+            :tab           active-tab
+            :handle-toggle on-toggle-tab}]
 
-         [:> input-component
-          {:placeholder (or input-value-placeholder
-                            (tr "workspace.tokens.token-value-enter"))
-           :label       (tr "workspace.tokens.token-value")
-           :name        :value
-           :token       token
-           :tokens      tokens}])]
+          [:> input-component
+           {:placeholder (or input-value-placeholder
+                             (tr "workspace.tokens.token-value-enter"))
+            :label       (tr "workspace.tokens.token-value")
+            :name        :value
+            :token       token
+            :token-type  token-type
+            :tokens      tokens}])]
 
-      [:div {:class (stl/css :input-row)}
-       [:> fc/form-input* {:id "token-description"
-                           :name :description
-                           :label (tr "workspace.tokens.token-description")
-                           :placeholder (tr "workspace.tokens.token-description")
-                           :max-length max-input-length
-                           :variant "comfortable"
-                           :is-optional true}]]
+       [:div {:class (stl/css :input-row)}
+        [:> fc/form-input* {:id "token-description"
+                            :name :description
+                            :label (tr "workspace.tokens.token-description")
+                            :placeholder (tr "workspace.tokens.token-description")
+                            :max-length max-input-length
+                            :variant "comfortable"
+                            :is-optional true}]]
 
-      [:div {:class (stl/css-case :button-row true
-                                  :with-delete (= action "edit"))}
-       (when (= action "edit")
-         [:> button* {:on-click on-delete-token
-                      :on-key-down handle-key-down-delete
-                      :class (stl/css :delete-btn)
-                      :type "button"
-                      :icon i/delete
-                      :variant "secondary"}
-          (tr "labels.delete")])
+       [:div {:class (stl/css-case :button-row true
+                                   :with-delete (= action "edit"))}
+        (when (= action "edit")
+          [:> button* {:on-click on-delete-token
+                       :on-key-down handle-key-down-delete
+                       :class (stl/css :delete-btn)
+                       :type "button"
+                       :icon i/delete
+                       :variant "secondary"}
+           (tr "labels.delete")])
 
-       [:> button* {:on-click on-cancel
-                    :on-key-down handle-key-down-cancel
-                    :type "button"
-                    :id "token-modal-cancel"
-                    :variant "secondary"}
-        (tr "labels.cancel")]
+        [:> button* {:on-click on-cancel
+                     :on-key-down handle-key-down-cancel
+                     :type "button"
+                     :id "token-modal-cancel"
+                     :variant "secondary"}
+         (tr "labels.cancel")]
 
-       [:> fc/form-submit* {:variant "primary"
-                            :on-submit on-submit}
-        (tr "labels.save")]]]]))
+        [:> fc/form-submit* {:variant "primary"
+                             :on-submit on-submit}
+         (tr "labels.save")]]]]]))

plugins/apps/e2e/src/plugins.spec.ts

@@ -11,7 +11,7 @@ import comments from './plugins/create-comments';
 import { Agent } from './utils/agent';
 
 describe('Plugins', () => {
-  it.only('create board - text - rectable', async () => {
+  it('create board - text - rectable', async () => {
     const agent = await Agent();
     const result = await agent.runCode(testingPlugin.toString(), {
       screenshot: 'create-board-text-rect',

plugins/apps/e2e/src/utils/agent.ts

@@ -56,13 +56,10 @@ export async function Agent() {
   console.log('File URL:', fileUrl);
 
   console.log('Launching browser...');
-  const browser = await puppeteer.launch({args: ['--ignore-certificate-errors']});
+  const browser = await puppeteer.launch({});
   const page = await browser.newPage();
 
   await page.setViewport({ width: 1920, height: 1080 });
-  await page.setExtraHTTPHeaders({
-    'X-Client': 'plugins/e2e:puppeter',
-  });
 
   console.log('Setting authentication cookie...');
   page.setCookie({

plugins/apps/e2e/src/utils/api.ts

@@ -1,38 +1,27 @@
 import { FileRpc } from '../models/file-rpc.model';
 
-const apiUrl = 'https://localhost:3449';
+const apiUrl = 'http://localhost:3449';
 
 export async function PenpotApi() {
   if (!process.env['E2E_LOGIN_EMAIL']) {
     throw new Error('E2E_LOGIN_EMAIL not set');
   }
 
-  const body = JSON.stringify({
-    'email': process.env['E2E_LOGIN_EMAIL'],
-    'password': process.env['E2E_LOGIN_PASSWORD'],
-  });
-
   const resultLoginRequest = await fetch(
-    `${apiUrl}/api/main/methods/login-with-password`,
+    `${apiUrl}/api/rpc/command/login-with-password`,
     {
-      credentials: 'include',
       method: 'POST',
       headers: {
-        'Content-Type': 'application/json'
+        'Content-Type': 'application/transit+json',
       },
-      body: body
+      body: JSON.stringify({
+        '~:email': process.env['E2E_LOGIN_EMAIL'],
+        '~:password': process.env['E2E_LOGIN_PASSWORD'],
+      }),
     },
   );
 
-  console.log("AAAAAAAAAAAA", 1, apiUrl)
-  // console.log("AAAAAAAAAAAA", 2, resultLoginRequest);
-
-  console.dir(resultLoginRequest.headers, {depth:20});
-  console.log('Document Cookies:', window.document.cookie);
-
   const loginData = await resultLoginRequest.json();
-
-
   const authToken = resultLoginRequest.headers
     .get('set-cookie')
     ?.split(';')
@@ -46,7 +35,7 @@ export async function PenpotApi() {
     getAuth: () => authToken,
     createFile: async () => {
       const createFileRequest = await fetch(
-        `${apiUrl}/api/main/methods/create-file`,
+        `${apiUrl}/api/rpc/command/create-file`,
         {
           method: 'POST',
           headers: {
@@ -76,7 +65,7 @@ export async function PenpotApi() {
     },
     deleteFile: async (fileId: string) => {
       const deleteFileRequest = await fetch(
-        `${apiUrl}/api/main/methods/delete-file`,
+        `${apiUrl}/api/rpc/command/delete-file`,
         {
           method: 'POST',
           headers: {

plugins/apps/e2e/vite.config.ts

@@ -14,6 +14,6 @@ export default defineConfig({
       reportsDirectory: '../coverage/e2e',
       provider: 'v8',
     },
-    setupFiles: ['dotenv/config', 'vitest.setup.ts']
+    setupFiles: ['dotenv/config'],
   },
 });

plugins/apps/e2e/vitest.setup.ts

@@ -1,3 +0,0 @@
-// import { vi } from 'vitest';
-
-window.location.href = 'https://localhost:3449';

plugins/docs/test-e2e.md

@@ -4,7 +4,7 @@
 
 1. **Configure Environment Variables**
 
-   Create and populate the `apps/e2e/.env` file with a valid user mail & password:
+   Create and populate the `.env` file with a valid user mail & password:
 
    ```env
    E2E_LOGIN_EMAIL="test@penpot.app"
@@ -24,7 +24,7 @@
 
 1. **Adding Tests**
 
-   Place your test files in the `apps/e2e/src/**/*.spec.ts` directory. Below is an example of a test file:
+   Place your test files in the `/apps/e2e/src/**/*.spec.ts` directory. Below is an example of a test file:
 
    ```ts
    import testingPlugin from './plugins/create-board-text-rect';