Skip to content

feat(threaded-annotations): Bump to 1.89.1 with edit, copy link, reply permissions#752

Open
jackiejou wants to merge 5 commits into
box:masterfrom
jackiejou:chore/bump-threaded-annotations-1.89.1
Open

feat(threaded-annotations): Bump to 1.89.1 with edit, copy link, reply permissions#752
jackiejou wants to merge 5 commits into
box:masterfrom
jackiejou:chore/bump-threaded-annotations-1.89.1

Conversation

@jackiejou
Copy link
Copy Markdown
Collaborator

@jackiejou jackiejou commented May 14, 2026

Summary

This PR bumps @box/threaded-annotations from ^1.86.0 to ^1.89.1 and wires up the new capabilities the upgrade enables.

Dep bump

  • @box/threaded-annotations: ^1.86.0 to ^1.89.1
  • Peer ranges in both devDependencies and peerDependencies updated to match the new peer contract: @box/blueprint-web ^14.30.0, @box/blueprint-web-assets ^4.117.2, @box/collaboration-popover ^1.62.3, @box/readable-time ^1.41.3, @box/user-selector ^1.76.3.
  • Lockfile regenerated and deduplicated.

Root-message edit

  • PopupV2 now passes onEdit to ThreadedAnnotationsV2. When the edited id matches the root annotation, it dispatches updateAnnotationAction({ payload: { message } }). Reply edits stay no-op because the corresponding reply-edit endpoint is not exposed by the shared API client.

Backend-driven reply permissions

  • Added ReplyPermissions and optional Reply.permissions.
  • replyToTextMessage now reads reply.permissions.can_* from the backend instead of hardcoding all to false/true.
  • canEdit on replies stays forced to false so the Edit menu item never renders for messages that have no working save path.
  • canReply on both the reply and description paths defaults to false (matching the other permission defaults) so viewer-only users do not see Reply UI that would fail server-side.
  • descriptionToTextMessage reads author, id, created_at, and permissions only from the Annotation (not from the sparse description object). Root-message author and permissions belong to the annotation.

onCopyLink plumbing

  • New optional onCopyLink: (id: string) => void on AnnotationsOptions and BaseAnnotator.Options.
  • Stored on the annotator instance, passed through each annotator's manager.render({ callbacks }), forwarded by PopupManager, delivered via a new AnnotationCallbacksContext inside withProviders, and consumed in PopupV2 with React.useContext.
  • Consumer owns URL construction, clipboard writes, and feedback. When omitted, the thread UI hides the Copy link menu item.
  • Follow-up in box-content-preview and EndUserApp is required to actually surface the option to end consumers; until then this is wiring-only and safe to ship.

Test coverage

  • Adapter permission mapping covered for default-omitted and fully-populated backend payloads.
  • PopupV2 covers the new onEdit dispatch branch, the reply-edit no-op, and onCopyLink forwarding from context.
  • Annotator + PopupManager tests assert the new callbacks arg shape.
  • BaseAnnotator test covers the new onCopyLink field.

Test plan

  • yarn test --watchAll=false (958 tests pass)
  • yarn lint:ts (type check + lint clean)
  • Manual: edit a root annotation in the sample app, verify PUT fires and message updates
  • Manual: verify Copy link menu item stays hidden when onCopyLink is not supplied (follow-up consumer PRs required to exercise the positive path)

Also bumps the @box/* peer ranges (blueprint-web, blueprint-web-assets,
collaboration-popover, readable-time, user-selector) to match the new
peerDependencies required by @box/threaded-annotations 1.89.1.
@jackiejou jackiejou requested a review from a team as a code owner May 14, 2026 17:07
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 14, 2026

- PopupV2 now dispatches updateAnnotationAction via ThreadedAnnotationsV2's
  onEdit prop when the edited id matches the root annotation. Reply edits
  stay no-op because the corresponding endpoint isn't exposed.
- replyToTextMessage reads reply.permissions from the backend payload
  instead of hardcoding false/true. canEdit stays false on replies to
  keep the Edit menu item hidden. Reply and description canReply default
  to false, matching the other permission defaults.
- New optional onCopyLink callback on AnnotationsOptions/BaseAnnotator
  threaded through a React context to PopupV2 and passed to
  ThreadedAnnotationsV2. When omitted, the thread UI hides the Copy link
  menu item.
@jackiejou jackiejou changed the title chore(deps): Bump @box/threaded-annotations to 1.89.1 feat(threaded-annotations): Bump to 1.89.1 with edit, copy link, reply permissions May 14, 2026
jackiejou added 3 commits May 14, 2026 13:30
Threaded-annotations renders Copy link on every message and passes the
clicked message id. PopupV2 now wraps the consumer callback so any click
forwards the root annotation id together with the file version id read
from store options. Lets the consumer build a versioned deep link
without any branching.
Two same-typed positional strings let consumers transpose annotationId
and fileVersionId without a compile-time signal. Switching to an object
arg removes the swap risk and lets future fields land additively.
Also adds a test covering the path where fileVersionId is absent so the
Copy link entry stays hidden.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant