fix(ui): round-3 polish — container list, bundle upload, toast severity

[hmoreras]

Summary

Round 3 of UI consistency fixes for the post-Lara-theme portlet polish (part of #35274). Four related areas:

Container list (dot-container-list)

• Right-click anywhere on a row now opens the action context menu — previously pContextMenuRow was set on each <tr> but no <p-contextMenu> was attached, so the directive was a no-op. Fixed by wiring a <p-contextMenu> via viewChild and a (contextmenu) handler that reuses the existing setContainerActions() entries, matching the pattern already used by the template list.
• 3-dot action button is now hover-only (Tailwind group / group-hover:opacity-100), matching other list portlets. <dot-action-menu-button> replaced with a <p-button pi-ellipsis-v> that opens the same context menu, so right-click and the button share one source of truth.
• Fixed a @ViewChild('actionsMenu') regression: once a signal-based viewChild was declared for the context menu, the legacy decorator started resolving to the wrong component at runtime (ContextMenu instead of Menu), breaking handleActionMenuOpen. Migrating actionsMenu to the signal API restores correct resolution.
• Spec updated: added the window.matchMedia jsdom polyfill required by PrimeNG ContextMenu, and converted the action-menu DOM assertions to call setContainerActions() directly.

Bundle upload dialog (view_publish_tool.jsp)

• Replaced the raw <input type="file"> with a dojox.form.Uploader widget so the dialog matches the dijit styling of the surrounding portlet, and added a localized filename label.
• Worked around two bugs in the custom Dojo build's Uploader:
  1. Uploader._createInput() does not forward the accept attribute to its internal <input type="file">, so any file could be picked. applyBundleAcceptFilter() walks the widget's domNode and sets accept=".tar.gz,.gz,.tgz" on the real file input. Re-applied on every dialog open because uploader.reset() recreates the input.
  2. The widget only fires an onChange event — no visible element is updated — so the label kept reading "No file chosen" even after a pick. updateBundleFileNameDisplay() is wired to onChange in dojo.ready() and reflects the selection.
• Spacing + action-bar margin tweaks so the new controls sit cleanly.

Before

After

Toast severity (dot-message-display)

• PrimeNG Toast expects severity 'warn', but DotMessageSeverity emits 'WARNING'. Map 'warning' → 'warn' before calling MessageService.add() so warning toasts pick up the warn style. SCSS class renamed (.warning → .warn) to stay in sync.

Before

After

Container service (dot-containers.service)

• copy() switched from PUT to POST — the backend _copy endpoint is a POST, and the PUT was returning 405.

Related

Part of #35274

Test plan

• yarn nx test dotcms-ui --testPathPattern=container-list.component.spec passes
• Right-click on a container row opens the context menu with the correct actions (Publish/Unpublish/Duplicate for a working container; Unarchive/Delete for an archived one)
• 3-dot button on a container row is hidden by default and fades in on hover; clicking it opens the same menu
• Archived/system/file containers do not show the 3-dot or right-click menu (disableInteraction respected)
• Upload Bundle dialog: the OS file picker only lets you select .tar.gz, .gz, .tgz files
• After picking a file, the filename replaces "No file chosen" in the dialog
• Reopening the dialog resets the filename label
• Copying a container succeeds (previously returned 405)
• Triggering a warning toast (e.g. DotMessageDisplayService.push({ severity: DotMessageSeverity.WARNING, ... })) displays with the warn style rather than the default

🤖 Generated with Claude Code

[claude]

Claude finished @hmoreras's task in 2m 34s —— View job

---

PR Review

• Gather context
• Read changed files
• Analyze for bugs, risks, design issues
• Post review

---

The core fixes (PUT→POST for _copy, WARNING→warn severity mapping, viewChild migration, context-menu wiring) are correct. A few things worth flagging:

1. innerHTML with user-supplied filename (JSP — view_publish_tool.jsp:259)

display.innerHTML = names.join(", ");

names is populated from f.name (File objects from the OS picker). A filename like <img src=x onerror=alert(1)>.tar.gz would execute JS in the admin portal — self-XSS, but a real browser security finding. Use textContent instead:

display.textContent = names.join(", ");

Fix this →

2. Dead form action attribute (JSP — line 421)

<form action="/DotAjaxDirector/com.dotcms.publisher.ajax.RemotePublishAjaxAction/cmd/uploadBundle" ...>

Upload now goes through fetch("/api/bundle/sync", ...). The form's action attribute is dead code — it's never submitted. Low risk since there's no submit button, but it's misleading and points to a legacy endpoint that may have different auth/validation semantics. Consider removing.

3. Redundant (contextmenu) on the last <td> (container-list.component.html:132)

<td style="width: 5%" (contextmenu)="setContextMenu($event, rowData)">

The <tr> already has (contextmenu)="setContextMenu($event, rowData)". Since setContextMenu calls event.stopPropagation(), the td handler fires first and stops propagation — net behavior is identical, but it's a confusing duplicate. Remove the (contextmenu) from the <td>.

4. Duplicate preventDefault/stopPropagation in setContextMenu (container-list.component.ts:184)

setContextMenu(event: Event, container: DotContainer): void {
    if (container.disableInteraction) {
        event.preventDefault();   // ← duplicated
        event.stopPropagation();  // ← duplicated
        return;
    }
    event.preventDefault();
    event.stopPropagation();
    ...
}

These two calls are unconditional — move them before the guard to eliminate the duplication.

5. contextMenuItems is not a signal (container-list.component.ts:92)

Reviewer raised this in the previous round; it was noted as non-breaking (no OnPush yet). Still unaddressed. Not a bug, but the migration is already 90% done (actionsMenu and tableRows are signals); leaving this one plain is inconsistent.

6. warning icon test may not render inside <p-toast> (dot-message-display.component.spec.ts:132)

The new test at line 132 asserts icon.name === 'warning'. <p-toast> renders content inside its overlay/template lazily. If PrimeNG's NoopAnimations environment doesn't flush the toast message into the DOM, By.css('dot-icon') would return the ERROR message icon from the previous test's dotMessageDisplayServiceMock.messages$ emission (the stream is shared). The test should ensure only the WARNING message is in flight when it asserts. Worth verifying the test actually catches a regression.

No issues with:

• PUT→POST fix for _copy is correct
• WARNING→warn severity mapping and SCSS .warning→.warn rename are consistent
• viewChild signal migration for actionsMenu/tableRows is correct
• applyBundleAcceptFilter / getBundleUploadFile Dojo workarounds are well-documented
• window.matchMedia polyfill in spec is necessary and correct