merge ja/newfrontend

.gitignore

@@ -11,7 +11,6 @@ application.pid
 *.iml
 npm-debug.log
 /webapp/node
-/webapp/node_modules
 /webapp/src/main/resources/new/js/bundle.min.js
 .sass-cache/
 /mavenplugin/target/
@@ -29,7 +28,15 @@ release.properties
 /docs/.jekyll-cache/
 /docs/_site/
 /.java-version
-/node_modules/
+# Ignore node_modules everywhere
+**/node_modules/
+# Vite/Node caches and outputs
+**/.vite/
+**/.eslintcache
+**/.parcel-cache/
+**/.turbo/
+**/.cache/
+**/*.tsbuildinfo
 /tmp/
 /local/
 .vscode/

AGENTS.md

@@ -0,0 +1,19 @@
+Agent Guide (Codex assistants)
+==============================
+
+Purpose
+- Document conventions and expectations for assistants working in this repo.
+
+General Guidance
+- Default to minimal, purposeful changes; avoid gratuitous complexity.
+- Keep docs and tracker entries in sync with work you land.
+
+When you see "finalize commit"
+- Review all touched code for the simplest implementation that meets the task; suggest simplifications if possible.
+- Update relevant docs (e.g., design notes, README snippets) to reflect the change.
+- Update `dev-docs/tracker.md`: add new items or remove items that are done/no longer relevant (no "Done" section).
+- Propose a concise commit message that fits the change.
+
+Notes
+- For frontend tooling, reuse the Maven-managed Node/npm (see `webapp/use_local_npm.sh`).
+- New frontend lives under `webapp/new-frontend` and is served at `/n/`.

cli/src/main/java/com/box/l10n/mojito/cli/command/PushCommand.java

@@ -7,6 +7,7 @@
 import com.box.l10n.mojito.cli.filefinder.FileMatch;
 import com.box.l10n.mojito.cli.filefinder.file.FileType;
 import com.box.l10n.mojito.rest.client.RepositoryClient;
+import com.box.l10n.mojito.rest.entity.LeveragingType;
 import com.box.l10n.mojito.rest.entity.Repository;
 import com.box.l10n.mojito.rest.entity.SourceAsset;
 import com.ibm.icu.text.MessageFormat;
@@ -147,6 +148,13 @@ public class PushCommand extends Command {
       converter = AssetMappingConverter.class)
   Map<String, String> assetMapping;
 
+  @Parameter(
+      names = {"--leveraging-type"},
+      required = false,
+      description =
+          "Leveraging strategy during push: LEGACY_SOURCE, ASSET_SOURCE_AND_COMMENT, or CROSS_ASSET_FALLBACK")
+  LeveragingType leveragingType = LeveragingType.LEGACY_SOURCE;
+
   @Autowired RepositoryClient repositoryClient;
 
   @Autowired CommandHelper commandHelper;
@@ -229,6 +237,7 @@ public void execute() throws CommandException {
                   sourceAsset.setFilterOptions(
                       commandHelper.getFilterOptionsOrDefaults(
                           sourceFileMatch.getFileType(), filterOptionsParam));
+                  sourceAsset.setLeveragingType(leveragingType);
 
                   return sourceAsset;
                 });

cli/src/main/java/com/box/l10n/mojito/cli/command/UserCreateCommand.java

@@ -9,6 +9,9 @@
 import com.box.l10n.mojito.rest.client.exception.ResourceNotCreatedException;
 import com.box.l10n.mojito.rest.entity.Role;
 import com.box.l10n.mojito.rest.entity.User;
+import java.security.SecureRandom;
+import java.util.Base64;
+import java.util.List;
 import org.fusesource.jansi.Ansi;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -70,18 +73,61 @@ public class UserCreateCommand extends Command {
       description = Param.COMMON_NAME_DESCRIPTION)
   String commonName;
 
+  @Parameter(
+      names = {"--locales", "-l"},
+      variableArity = true,
+      description = "List of locales (BCP47 tags) translators can work on, e.g. fr-FR ja-JP")
+  List<String> locales;
+
+  @Parameter(
+      names = {"--generate-password", "-gp"},
+      description = "Generate a secure random password instead of prompting")
+  boolean generatePassword = false;
+
   @Autowired Console console;
 
+  private static final SecureRandom SECURE_RANDOM = new SecureRandom();
+
   @Override
   protected void execute() throws CommandException {
     consoleWriter.a("Create user: ").fg(Ansi.Color.CYAN).a(username).println();
 
     try {
-      consoleWriter.a("Enter new password for " + username + ":").println();
-      String password = console.readPassword();
+      String password;
+      if (generatePassword) {
+        password = generateSecurePassword();
+        consoleWriter
+            .a("Generated password for ")
+            .fg(Ansi.Color.CYAN)
+            .a(username)
+            .a(": ")
+            .fg(Ansi.Color.YELLOW)
+            .a(password)
+            .println();
+      } else {
+        consoleWriter.a("Enter new password for " + username + ":").println();
+        password = console.readPassword();
+      }
 
       Role role = Role.fromString(rolename);
-      User user = userClient.createUser(username, password, role, surname, givenName, commonName);
+
+      User user;
+      if (Role.ROLE_TRANSLATOR.equals(role)) {
+        boolean hasLocales = locales != null && !locales.isEmpty();
+        boolean canTranslateAllLocales = !hasLocales;
+        user =
+            userClient.createUser(
+                username,
+                password,
+                role,
+                surname,
+                givenName,
+                commonName,
+                locales,
+                canTranslateAllLocales);
+      } else {
+        user = userClient.createUser(username, password, role, surname, givenName, commonName);
+      }
       consoleWriter
           .newLine()
           .a("created --> user: ")
@@ -92,4 +138,10 @@ protected void execute() throws CommandException {
       throw new CommandException(ex.getMessage(), ex);
     }
   }
+
+  private String generateSecurePassword() {
+    byte[] bytes = new byte[18];
+    SECURE_RANDOM.nextBytes(bytes);
+    return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
+  }
 }

cli/src/test/java/com/box/l10n/mojito/cli/command/UserCreateCommandTest.java

@@ -1,6 +1,7 @@
 package com.box.l10n.mojito.cli.command;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -11,6 +12,10 @@
 import com.box.l10n.mojito.entity.security.user.User;
 import com.box.l10n.mojito.security.Role;
 import com.box.l10n.mojito.service.security.user.UserRepository;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Collectors;
 import org.junit.Test;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
@@ -62,7 +67,46 @@ public void testCreateUserWithDuplicatedUsername() throws Exception {
         outputCapture.toString().contains("User with username [" + username + "] already exists"));
   }
 
+  @Test
+  public void testCreateUserWithGeneratedPassword() throws Exception {
+
+    String username = testIdWatcher.getEntityName("user");
+    String commonName = createTestUser(username, null, null, true);
+
+    User user = userRepository.findByUsername(username);
+    assertEquals(commonName, user.getCommonName());
+    assertTrue(outputCapture.toString().contains("Generated password for " + username + ":"));
+  }
+
+  @Test
+  public void testCreateTranslatorWithLocales() throws Exception {
+
+    String username = testIdWatcher.getEntityName("user");
+    List<String> locales = Arrays.asList("fr-FR", "ja-JP");
+    String commonName = createTestUser(username, "TRANSLATOR", locales);
+
+    User user = userRepository.findByUsername(username);
+    assertEquals(commonName, user.getCommonName());
+    assertFalse(user.getCanTranslateAllLocales());
+    assertEquals(
+        locales.stream().collect(Collectors.toSet()),
+        user.getUserLocales().stream()
+            .map(userLocale -> userLocale.getLocale().getBcp47Tag())
+            .collect(Collectors.toSet()));
+  }
+
   private String createTestUser(String username, String role) throws Exception {
+    return createTestUser(username, role, null);
+  }
+
+  private String createTestUser(String username, String role, List<String> localeTags)
+      throws Exception {
+    return createTestUser(username, role, localeTags, false);
+  }
+
+  private String createTestUser(
+      String username, String role, List<String> localeTags, boolean generatePassword)
+      throws Exception {
     String surname = "Mojito";
     String givenName = "Test";
     String commonName = "Test Mojito " + username;
@@ -83,32 +127,34 @@ public String answer(InvocationOnMock invocation) throws Throwable {
     userCreateCommand.console = mockConsole;
 
     logger.debug("Creating user with username: {}", username);
-    if (role == null) {
-      l10nJCommander.run(
-          "user-create",
-          Param.USERNAME_SHORT,
-          username,
-          Param.SURNAME_SHORT,
-          surname,
-          Param.GIVEN_NAME_SHORT,
-          givenName,
-          Param.COMMON_NAME_SHORT,
-          commonName);
-    } else {
-      l10nJCommander.run(
-          "user-create",
-          Param.USERNAME_SHORT,
-          username,
-          Param.ROLE_SHORT,
-          role,
-          Param.SURNAME_SHORT,
-          surname,
-          Param.GIVEN_NAME_SHORT,
-          givenName,
-          Param.COMMON_NAME_SHORT,
-          commonName);
+    List<String> params =
+        new ArrayList<>(
+            Arrays.asList(
+                "user-create",
+                Param.USERNAME_SHORT,
+                username,
+                Param.SURNAME_SHORT,
+                surname,
+                Param.GIVEN_NAME_SHORT,
+                givenName,
+                Param.COMMON_NAME_SHORT,
+                commonName));
+
+    if (role != null) {
+      params.addAll(Arrays.asList(Param.ROLE_SHORT, role));
+    }
+
+    if (localeTags != null && !localeTags.isEmpty()) {
+      params.add("-l");
+      params.addAll(localeTags);
     }
 
+    if (generatePassword) {
+      params.add("-gp");
+    }
+
+    l10nJCommander.run(params.toArray(new String[0]));
+
     assertTrue(outputCapture.toString().contains("created --> user: "));
     return commonName;
   }

cli/src/test/resources/com/box/l10n/mojito/cli/command/PullCommandTest_IO/pullAndroidStringsSkipEmpty/expected/target/.gitkeep

@@ -0,0 +1 @@
+

dev-docs/README.md

@@ -0,0 +1,13 @@
+Dev Docs for Codex
+==================
+
+This directory holds design docs and working documents used by Codex during implementation. Record key decisions and context here.
+
+Conventions
+- Keep this separate from the public site content under `docs/`.
+- Design docs live in `dev-docs/design/` and use numeric prefixes for ordering: `001-title.md`, `002-title.md`, ... (pad to 3+ digits).
+- Increment the number for each new design doc to keep chronological order without exposing dates.
+
+Tracker
+- Use `dev-docs/tracker.md` to capture improvement ideas/tech debt before they become full design docs.
+- When an item becomes active, promote it into a numbered design doc.

dev-docs/design/001-new-frontend-shell.md

@@ -0,0 +1,30 @@
+Mojito New Frontend Shell (React + Vite)
+=======================================
+
+Context
+- We are introducing a new frontend that coexists with the legacy UI.
+- It should be production-ready, incrementally extensible, and deploy inside the existing Spring Boot app.
+
+Decisions
+- Stack: React + Vite + TypeScript.
+- Served path: `/n/` (Vite `base: '/n/'`).
+- Output path: `webapp/target/classes/public/n` so Spring Boot serves it from the classpath.
+- Build integration: `frontend-maven-plugin` in `webapp/pom.xml` runs `npm install` and `npm run build` inside `webapp/new-frontend` during `compile`.
+- Dev proxy: Vite proxies `/api/*` to `http://localhost:8080`.
+- Server forwarding: `NewFrontendController` forwards `/n` and client-side `/n/**` (except assets/files) to `/n/index.html` so deep links load the SPA.
+- Security: `/n/**` is allowlisted in `WebSecurityJWTConfig` so the SPA can load under stateless JWT mode.
+
+Dev Workflow
+- Backend: `cd webapp && mvn spring-boot:run -Dspring-boot.run.jvmArguments="-Dspring.config.additional-location=optional:file://$HOME/.l10n/config/webapp/ -Dspring.profiles.active=$USER,npm -Duser.timezone=UTC"`
+- Frontend: `cd webapp/new-frontend && npm install && npm run dev` (default `http://localhost:5173`).
+- Packaged app: `http://localhost:8080/n/`.
+
+Implementation Notes
+- Location: `webapp/new-frontend` with `vite.config.ts` configured to write into `../target/classes/public/n`.
+- Keep all new UI assets under this folder; do not mix with legacy webpack output.
+- Ensure `.gitignore` excludes Node artifacts globally (`**/node_modules/`, `**/.vite/`, etc.).
+
+Open Questions / Next Steps
+- Routing strategy and auth integration for `/n/` paths.
+- Add ESLint/Prettier/Vitest.
+- Establish UI component conventions and theming.

dev-docs/design/002-new-frontend-tooling.md

@@ -0,0 +1,27 @@
+New Frontend Tooling (ESLint/Prettier/Vitest)
+=============================================
+
+Context
+- The new Vite/React/TS frontend (`webapp/new-frontend`) is currently bare-bones with no lint/format/test guardrails.
+- We want lightweight defaults before building pages so conventions stick and CI can enforce them.
+
+Goals
+- Add ESLint + Prettier with sensible defaults for React + TypeScript and keep configs minimal (now includes simple-import-sort for imports/exports).
+- Add Vitest + @testing-library/react for unit/component tests.
+- Provide npm scripts that match repo conventions (`lint`, `lint:fix`, `format`, `format:check`, `test`, `test:watch`).
+- Keep noise low: ignore build output/node_modules; align with Maven-managed Node/npm notes.
+
+Non-goals
+- No CI wiring yet; no strict style bikeshedding. Just defaults that can evolve.
+- No storybook/e2e yet.
+
+Plan (narrow)
+- Install dev deps: eslint, @typescript-eslint/parser/plugin, eslint-plugin-react(+hooks), eslint-plugin-react-refresh, eslint-config-prettier; prettier + plugins for json/yaml/markdown; vitest + @testing-library/react + jsdom; @types/node for tests.
+- Add `eslint.config.js` (flat config) and `.prettierrc.cjs` + `.prettierignore`.
+- Create basic `vitest.config.ts` aligned with Vite, jsdom environment, and path setup.
+- Add a starter React component test to verify wiring.
+- Add npm scripts and update docs if needed.
+
+Open questions
+- Do we enforce import sorting? (decided yes, using simple-import-sort, auto-fixed by eslint --fix.)
+- JSX runtime: use React 17 classic vs. automatic (Vite default uses automatic). Align ESLint config with Vite default.

dev-docs/design/003-new-frontend-routing.md

@@ -0,0 +1,28 @@
+New Frontend Routing + Shell Layout
+===================================
+
+Context
+- The new frontend only rendered a bare headline; we need routing scaffolding to grow feature pages.
+- SPA lives under `/n`, so client routing must respect that base path.
+
+Goals
+- Adopt React Router (v7) with `BrowserRouter` basename `/n` to align with server routing and deep links.
+- Introduce a shared shell layout with top navigation and routed content slots.
+- Provide initial routes for Repositories and Workbench with sensible defaults/redirects.
+- Establish baseline theming tokens and page structure CSS for light/dark support.
+
+Non-goals
+- No data fetching, auth, or real page content yet—routes are placeholders.
+- No design system or component library decisions; styles are minimal tokens/layout only.
+- No 404/500 UX polish beyond redirecting unknown paths.
+
+Plan (narrow)
+- Add `react-router-dom@^7` dependency.
+- Wrap `App` in `BrowserRouter` (basename `/n`), define `Routes`/`Route` tree with a shared `AppLayout` using `Outlet`.
+- Provide nav links for `/repositories` and `/workbench`; redirect `/` and fallthrough paths to `/repositories`.
+- Add `app.css` with CSS variables (colors, spacing, radius) and shell layout styles, and import it in `App.tsx`.
+
+Open questions
+- Should navigation highlight active routes or adopt a design-system component?
+- Do we want per-route code splitting once pages grow?
+- Where should shared tokens live long-term (global CSS vs. theming system)?