feat(KAN-68): add visual Markdown ticket description editor

2026-09-30 11:20:50 +02:00
25 changed files with 202 additions and 453 deletions
@@ -1,18 +1,78 @@
-name: test_and_check_app
-description: Build the test image and run all application checks
+name: "Lint and Test APP"
+description: "Run Pint and the Pest test suite"

 runs:
  using: composite
  steps:
-    - name: Test and check app
-      shell: bash
-      run: |
-        set -Eeuo pipefail
+    - name: Setup PHP
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #v2.37.2
+      with:
+        php-version: "8.5"
+        extensions: mbstring, pdo_sqlite
+        coverage: none
+        tools: composer:v2

-        docker buildx build \
-          --file Dockerfile \
-          --target test \
-          --tag "local/kanbangit-test:${GITHUB_SHA}" \
-          --progress plain \
-          --load \
-          .
+    - name: Verify Composer lockfile
+      run: |
+        if [ ! -f composer.lock ]; then
+          echo "::error::composer.lock not found"
+          exit 1
+        fi
+      shell: bash
+
+    - name: Get Composer cache directory
+      id: composer_cache
+      run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+      shell: bash
+
+    - name: Cache Composer packages
+      uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+      with:
+        path: ${{ steps.composer_cache.outputs.dir }}
+        key: ${{ runner.os }}-php-8.5-${{ hashFiles('composer.lock') }}
+
+    - name: Setup pnpm
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
+      with:
+        package-json-file: package.json
+
+    - name: Setup Node.js
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 22
+        cache: "pnpm"
+        cache-dependency-path: "pnpm-lock.yaml"
+
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+      shell: bash
+
+    - name: Prepare environment file
+      run: cp .env.example .env
+      shell: bash
+
+    - name: Install dependencies
+      run: composer install --no-interaction --prefer-dist --no-progress
+      shell: bash
+
+    - name: Generate application key
+      run: php artisan key:generate
+      shell: bash
+
+    - name: Generate Wayfinder routes and actions
+      run: php artisan wayfinder:generate --with-form
+      shell: bash
+
+    - name: Run independent application checks
+      run: |
+        pnpm exec concurrently \
+          --names frontend,backend \
+          --prefix-colors cyan,magenta \
+          --kill-others-on-fail \
+          "composer run ci:frontend" \
+          "composer run ci:backend"
+      shell: bash
+
+    - name: Run Laravel tests
+      run: composer run ci:test
+      shell: bash
@@ -9,6 +9,7 @@ on:
  pull_request:
    branches:
      - main
+      - fix/dependency-cves

 permissions:
  contents: read
@@ -3,7 +3,6 @@
 namespace App\Actions\Projects;

 use App\Models\Project;
-use Illuminate\Support\Facades\DB;

 class DeleteProject
 {
@@ -11,12 +10,7 @@ class DeleteProject
    {
        $projectName = $project->name;

-        DB::transaction(function () use ($project): void {
-            $baseTemplate = $project->baseTemplate()->first();
-
-            $project->delete();
-            $baseTemplate?->delete();
-        });
+        $project->delete();

        return $projectName;
    }
@@ -17,21 +17,18 @@ class StoreProjectTicketLink
    ) {}

    /**
-     * @param  array{linked_ticket_id: int, ticket_link_type_id: int, link_direction?: 'source'|'counterpart'}  $validated
+     * @param  array{linked_ticket_id: int, ticket_link_type_id: int}  $validated
     */
    public function handle(Project $project, Ticket $ticket, User $user, array $validated): TicketLink
    {
        $linkedTicketId = Arr::get($validated, 'linked_ticket_id');
        $ticketLinkTypeId = Arr::get($validated, 'ticket_link_type_id');
-        $isSourceTicket = Arr::get($validated, 'link_direction', 'source') === 'source';

        $linkedTicket = Ticket::query()
            ->where('project_id', $project->id)
            ->findOrFail($linkedTicketId);
-        $sourceTicket = $isSourceTicket ? $ticket : $linkedTicket;
-        $targetTicket = $isSourceTicket ? $linkedTicket : $ticket;

-        return DB::transaction(function () use ($linkedTicket, $user, $ticketLinkTypeId, $ticket, $sourceTicket, $targetTicket, $isSourceTicket): TicketLink {
+        return DB::transaction(function () use ($linkedTicket, $user, $ticketLinkTypeId, $ticket): TicketLink {
            Ticket::query()
                ->whereKey([$ticket->id, $linkedTicket->id])
                ->orderBy('id')
@@ -53,31 +50,31 @@ class StoreProjectTicketLink

            if ($ticketLink === null) {
                $ticketLink = TicketLink::query()->create([
-                    'source_ticket_id' => $sourceTicket->id,
-                    'target_ticket_id' => $targetTicket->id,
+                    'source_ticket_id' => $ticket->id,
+                    'target_ticket_id' => $linkedTicket->id,
                    'ticket_link_type_id' => $ticketLinkTypeId,
                ]);
            } else {
                $ticketLink->update([
-                    'source_ticket_id' => $sourceTicket->id,
-                    'target_ticket_id' => $targetTicket->id,
+                    'source_ticket_id' => $ticket->id,
+                    'target_ticket_id' => $linkedTicket->id,
                    'ticket_link_type_id' => $ticketLinkTypeId,
                ]);
            }

            $ticketLink->load('ticketLinkType');

-            $ticketLabel = $ticketLink->ticketLinkType->labelForSource($isSourceTicket);
-            $linkedTicketLabel = $ticketLink->ticketLinkType->labelForSource(! $isSourceTicket);
+            $sourceLabel = $ticketLink->ticketLinkType->labelForSource(true);
+            $targetLabel = $ticketLink->ticketLinkType->labelForSource(false);

            $this->createTicketWorklogEntry->handle(
                $ticket,
                $user,
                TicketWorklogEntryType::LinkUpdated,
-                "Linked {$linkedTicket->ticket_key} as {$ticketLabel}.",
+                "Linked {$linkedTicket->ticket_key} as {$sourceLabel}.",
                [
                    'linked_ticket_key' => $linkedTicket->ticket_key,
-                    'ticket_link_type' => $ticketLabel,
+                    'ticket_link_type' => $sourceLabel,
                ],
            );

@@ -85,10 +82,10 @@ class StoreProjectTicketLink
                $linkedTicket,
                $user,
                TicketWorklogEntryType::LinkUpdated,
-                "Linked {$ticket->ticket_key} as {$linkedTicketLabel}.",
+                "Linked {$ticket->ticket_key} as {$targetLabel}.",
                [
                    'linked_ticket_key' => $ticket->ticket_key,
-                    'ticket_link_type' => $linkedTicketLabel,
+                    'ticket_link_type' => $targetLabel,
                ],
            );

@@ -36,12 +36,11 @@ class ProjectTicketLinkController extends ApiController

        $ticketLink = $this->storeProjectTicketLink->handle($project, $ticket, $user, $request->validated());
        $ticketLink->setAttribute('current_ticket_id', $ticket->id);
-        $label = $ticketLink->ticketLinkType->labelForSource($ticketLink->source_ticket_id === $ticket->id);

        return TicketLinkResource::make($ticketLink->load(['sourceTicket', 'targetTicket', 'ticketLinkType']))
            ->additional([
                'meta' => [
-                    'message' => "{$label} link was saved.",
+                    'message' => "{$ticketLink->ticketLinkType->label} link was saved.",
                ],
            ])
            ->response()
@@ -34,10 +34,9 @@ class ProjectTicketLinkController extends Controller
        );

        $ticketLink = $this->storeProjectTicketLink->handle($project, $ticket, $user, $request->validated());
-        $label = $ticketLink->ticketLinkType->labelForSource($ticketLink->source_ticket_id === $ticket->id);

        return to_route('projects.tickets.show', [$project, $ticket])
-            ->with('status', "{$label} link was saved.");
+            ->with('status', "{$ticketLink->ticketLinkType->label} link was saved.");
    }

    public function destroy(
@@ -11,7 +11,7 @@ class DeleteProjectRequest extends FormRequest
 {
    public function authorize(): bool
    {
-        return $this->user()?->can('admin-project', $this->route('project')) ?? false;
+        return $this->user()?->can('access-admin') ?? false;
    }

    /**
@@ -42,7 +42,6 @@ class StoreTicketLinkRequest extends FormRequest
                    fn ($query) => $query->where('project_id', $project->id),
                ),
            ],
-            'link_direction' => ['sometimes', 'required', Rule::in(['source', 'counterpart'])],
        ];
    }

@@ -2007,16 +2007,16 @@
        },
        {
            "name": "league/commonmark",
-            "version": "2.10.3",
+            "version": "2.10.0",
            "source": {
                "type": "git",
                "url": "https://github.com/thephpleague/commonmark.git",
-                "reference": "6efbd9c472b91db0a3350fcd601c8332c2382e1f"
+                "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/6efbd9c472b91db0a3350fcd601c8332c2382e1f",
-                "reference": "6efbd9c472b91db0a3350fcd601c8332c2382e1f",
+                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/d2d1aa8b35e072966c89bc0c66cf926e56767dc4",
+                "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4",
                "shasum": ""
            },
            "require": {
@@ -2110,7 +2110,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-09-21T13:07:34+00:00"
+            "time": "2026-08-11T16:06:25+00:00"
        },
        {
            "name": "league/config",
@@ -15,7 +15,7 @@
        "dev": "vite",
        "lint": "eslint . --fix",
        "lint:check": "eslint .",
-        "types:check": "php artisan wayfinder:generate --with-form --no-interaction && vue-tsc --noEmit"
+        "types:check": "vue-tsc --noEmit"
    },
    "devDependencies": {
        "@eslint/js": "^9.39.4",
@@ -203,14 +203,6 @@ settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false

-overrides:
-  axios@>=1.13.0 <1.20.0: ^1.20.0
-  axios@>=1.15.0 <1.20.0: ^1.20.0
-  axios@>=1.15.1 <1.20.0: ^1.20.0
-  axios@>=1.15.2 <1.20.0: ^1.20.0
-  axios@>=1.16.1 <1.20.0: ^1.20.0
-  axios@>=1.17.0 <1.20.0: ^1.20.0
-
 importers:

  .:
@@ -1252,8 +1244,8 @@ packages:
    resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
    engines: {node: '>= 0.4'}

-  axios@1.20.0:
-    resolution: {integrity: sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==}
+  axios@1.19.0:
+    resolution: {integrity: sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==}

  balanced-match@1.0.2:
    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
@@ -2904,7 +2896,7 @@ snapshots:
  '@inertiajs/core@2.3.18(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1)':
    dependencies:
      '@types/lodash-es': 4.17.12
-      axios: 1.20.0(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1)
+      axios: 1.19.0(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1)
      laravel-precognition: 1.0.2(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1)
      lodash-es: 4.18.1
      qs: 6.16.0
@@ -3692,7 +3684,7 @@ snapshots:
    dependencies:
      possible-typed-array-names: 1.1.0

-  axios@1.20.0(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1):
+  axios@1.19.0(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1):
    dependencies:
      follow-redirects: 1.16.0(debug@4.4.3(supports-color@8.1.1))
      form-data: 4.0.6
@@ -4460,7 +4452,7 @@ snapshots:

  laravel-precognition@1.0.2(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1):
    dependencies:
-      axios: 1.20.0(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1)
+      axios: 1.19.0(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1)
      lodash-es: 4.18.1
    transitivePeerDependencies:
      - debug
@@ -7,10 +7,3 @@ minimumReleaseAgeExclude:
 allowBuilds:
  unrs-resolver: true
  vue-demi: true
-overrides:
-  axios@>=1.13.0 <1.20.0: ^1.20.0
-  axios@>=1.15.0 <1.20.0: ^1.20.0
-  axios@>=1.15.1 <1.20.0: ^1.20.0
-  axios@>=1.15.2 <1.20.0: ^1.20.0
-  axios@>=1.16.1 <1.20.0: ^1.20.0
-  axios@>=1.17.0 <1.20.0: ^1.20.0
@@ -12,12 +12,8 @@ import { Button } from '@/components/ui/button';
 import { Card, CardContent, CardHeader } from '@/components/ui/card';
 import { useFormProtection } from '@/composables/useFormProtection';
 import { useLocalization } from '@/composables/useLocalization';
-import { useTicketLinkActions } from '@/composables/useTicketLinkActions';
 import { show as showTicket } from '@/routes/projects/tickets';
-import type {
-    TicketDetailRelationshipsProps,
-    TicketLinkFormData,
-} from '@/types/ticket-detail';
+import type { TicketDetailRelationshipsProps } from '@/types/ticket-detail';

 const props = defineProps<TicketDetailRelationshipsProps>();
 defineEmits<{ editParent: [] }>();
@@ -37,17 +33,17 @@ const canAddLink = computed(
        props.ticketLinkTypes.length > 0 &&
        props.ticketLinkOptions.length > 0,
 );
-const form = useForm<TicketLinkFormData>({
+const form = useForm({
    ticket_link_type_id: props.ticketLinkTypes[0]?.id ?? '',
-    link_direction: 'source',
    linked_ticket_id: '',
 });
 const protection = useFormProtection(form, {
    isDirty: () => props.canEditTicket && form.isDirty,
 });
-const { actions, selectedAction, selectedActionLabel } = useTicketLinkActions(
-    () => props.ticketLinkTypes,
-    form,
+const selectedType = computed(() =>
+    props.ticketLinkTypes.find(
+        (type) => String(type.id) === String(form.ticket_link_type_id),
+    ),
 );
 const selectedTicket = computed(() =>
    props.ticketLinkOptions.find(
@@ -228,14 +224,16 @@ function submit(): void {
                    >
                        <TicketFormField
                            id="ticket_link_type_id"
-                            v-model="selectedAction"
+                            v-model="form.ticket_link_type_id"
                            kind="select"
-                            :label="t('ticketDetail.linkAction')"
-                            :options="actions"
-                            :error="
-                                form.errors.ticket_link_type_id ||
-                                form.errors.link_direction
+                            :label="t('ticketDetail.linkType')"
+                            :options="
+                                ticketLinkTypes.map((type) => ({
+                                    value: type.id,
+                                    label: type.label,
+                                }))
                            "
+                            :error="form.errors.ticket_link_type_id"
                            :disabled="form.processing"
                            required
                        />
@@ -262,19 +260,22 @@ function submit(): void {
                        />
                    </fieldset>
                    <p
-                        v-if="selectedActionLabel && selectedTicket"
+                        v-if="selectedType && selectedTicket"
                        aria-live="polite"
                        class="text-muted-foreground flex flex-wrap items-center gap-2 text-sm"
                    >
                        <span class="font-mono text-xs">{{
                            ticket.ticket_key
                        }}</span
-                        ><span>{{ selectedActionLabel }}</span
+                        ><span>{{ selectedType.label }}</span
                        ><ArrowRight class="size-4" aria-hidden="true" /><span
                            class="font-mono text-xs"
                            >{{ selectedTicket.ticket_key }}</span
                        >
                    </p>
+                    <p class="text-muted-foreground text-xs">
+                        {{ t('ticketRelationships.directionHelp') }}
+                    </p>
                    <Button
                        type="submit"
                        :disabled="form.processing || !selectedTicket"
@@ -1,8 +1,10 @@
 <script setup lang="ts">
 import { Link, useForm } from '@inertiajs/vue3';
-import { Unlink } from 'lucide-vue-next';
+import { ArrowDownLeft, ArrowUpRight, Unlink } from 'lucide-vue-next';
+import { computed } from 'vue';
 import { destroy } from '@/actions/App/Http/Controllers/ProjectTicketLinkController';
 import FormFeedback from '@/components/FormFeedback.vue';
+import { Badge } from '@/components/ui/badge';
 import { Button } from '@/components/ui/button';
 import { useFormProtection } from '@/composables/useFormProtection';
 import { useLocalization } from '@/composables/useLocalization';
@@ -18,6 +20,7 @@ const props = defineProps<{
 }>();
 const emit = defineEmits<{ removed: [] }>();
 const { t } = useLocalization();
+const outgoing = computed(() => props.link.source_ticket_id === props.ticketId);
 const form = useForm({});
 const protection = useFormProtection(form);
 function remove(): void {
@@ -44,6 +47,27 @@ function remove(): void {
        :data-ticket-link="link.id"
    >
        <div class="flex min-w-0 flex-wrap items-center gap-2">
+            <Badge
+                variant="outline"
+                class="text-muted-foreground max-w-full whitespace-normal"
+            >
+                <ArrowUpRight
+                    v-if="outgoing"
+                    class="size-3.5 shrink-0"
+                    aria-hidden="true"
+                /><ArrowDownLeft
+                    v-else
+                    class="size-3.5 shrink-0"
+                    aria-hidden="true"
+                />
+                {{
+                    t(
+                        outgoing
+                            ? 'ticketRelationships.outgoing'
+                            : 'ticketRelationships.incoming',
+                    )
+                }}
+            </Badge>
            <span class="text-muted-foreground font-mono text-xs">{{
                ticketKey
            }}</span>
@@ -1,57 +0,0 @@
-import { computed, toValue } from 'vue';
-import type { MaybeRefOrGetter } from 'vue';
-import type { TicketLinkTypeModel } from '@/types/models/ticket-link-type-model';
-import type {
-    TicketLinkActionOption,
-    TicketLinkFormData,
-} from '@/types/ticket-detail';
-
-export function useTicketLinkActions(
-    ticketLinkTypes: MaybeRefOrGetter<TicketLinkTypeModel[]>,
-    form: TicketLinkFormData,
-) {
-    const actions = computed<TicketLinkActionOption[]>(() =>
-        toValue(ticketLinkTypes).flatMap((type) => {
-            const choices: TicketLinkActionOption[] = [
-                {
-                    value: `${type.id}:source`,
-                    label: type.label,
-                    ticketLinkTypeId: type.id,
-                    direction: 'source',
-                },
-            ];
-            if (
-                type.counterpart_label &&
-                type.counterpart_label !== type.label
-            ) {
-                choices.push({
-                    value: `${type.id}:counterpart`,
-                    label: type.counterpart_label,
-                    ticketLinkTypeId: type.id,
-                    direction: 'counterpart',
-                });
-            }
-            return choices;
-        }),
-    );
-    const selectedAction = computed({
-        get: () => `${form.ticket_link_type_id}:${form.link_direction}`,
-        set: (value: string | number | null) => {
-            const action = actions.value.find(
-                (option) => option.value === value,
-            );
-            if (action) {
-                form.ticket_link_type_id = action.ticketLinkTypeId;
-                form.link_direction = action.direction;
-            }
-        },
-    });
-    const selectedActionLabel = computed(
-        () =>
-            actions.value.find(
-                (action) => action.value === selectedAction.value,
-            )?.label,
-    );
-
-    return { actions, selectedAction, selectedActionLabel };
-}
@@ -1213,7 +1213,7 @@ export const en = {
    'ticketDetail.linkedTickets': 'Linked tickets',
    'ticketDetail.linkedTicketsDescription':
        'Track cross-ticket relationships with project-defined link labels.',
-    'ticketDetail.linkAction': 'Action',
+    'ticketDetail.linkType': 'Link type',
    'ticketDetail.linkedTicket': 'Linked ticket',
    'ticketDetail.saveLink': 'Save link',
    'ticketDetail.noLinks':
@@ -1227,6 +1227,10 @@ export const en = {
        'Open a child ticket to change its parent. Expand a group to see its descendants.',
    'ticketRelationships.addLink': 'Add or update a link',
    'ticketRelationships.selectTicket': 'Select a ticket',
+    'ticketRelationships.directionHelp':
+        'The selected relationship points from this ticket to the linked ticket. Saving an existing pair updates its type and direction.',
+    'ticketRelationships.outgoing': 'Outgoing',
+    'ticketRelationships.incoming': 'Incoming',
    'ticketRelationships.removeLink': 'Remove link to {key}',
    'ticketRelationships.noTypes':
        'No link types are configured for this project.',
@@ -67,14 +67,3 @@ export type TicketBranchFormData = {
    branch_name: string;
    repository_connection_id: string;
 };
-export type TicketLinkFormData = {
-    ticket_link_type_id: number | string;
-    link_direction: 'source' | 'counterpart';
-    linked_ticket_id: number | string;
-};
-export type TicketLinkActionOption = {
-    value: string;
-    label: string;
-    ticketLinkTypeId: number;
-    direction: TicketLinkFormData['link_direction'];
-};
@@ -27,7 +27,7 @@ Route::prefix('projects')->name('projects.')->group(function (): void {
            });

            Route::delete('/', [ProjectController::class, 'destroy'])
-                ->middleware('can:admin-project,project')
+                ->middleware('can:access-admin')
                ->name('destroy');

            Route::middleware('can:admin-project,project')->group(function (): void {
@@ -291,14 +291,7 @@ class ProjectApiTest extends TestCase
            ->assertOk()
            ->assertJsonPath('data.key', 'CORE');

-        $this->withApplicationKey($user)
-            ->deleteJson(route('api.projects.destroy', $project), [
-                'confirmation_key' => 'CORE',
-            ])
-            ->assertForbidden();
-
-        $this->syncProjectPermissions($project, $admin, ['admin']);
-        $this->assertTrue($admin->can('admin-project', $project));
+        $this->syncGlobalPermissions($admin, ['admin']);

        $this->withApplicationKey($admin)
            ->deleteJson(route('api.projects.destroy', $project), [
@@ -293,49 +293,6 @@ class TicketApiTest extends TestCase
        $this->assertDatabaseCount('ticket_worklog_entries', 0);
    }

-    public function test_counterpart_link_direction_is_reflected_on_both_tickets_in_the_api(): void
-    {
-        [$user, $project] = $this->projectContext();
-        $status = $project->ticketStatuses()->firstOrFail();
-        $blockingTicket = $this->ticket($project, $status);
-        $blockedTicket = $this->ticket($project, $status, 2);
-        $linkType = TicketLinkType::factory()->for($project)->create([
-            'label' => 'Blocks',
-            'counterpart_label' => 'Blocked by',
-        ]);
-
-        $this->withApplicationKey($user)
-            ->postJson(route('api.projects.tickets.links.store', [$project, $blockedTicket]), [
-                'linked_ticket_id' => $blockingTicket->id,
-                'ticket_link_type_id' => $linkType->id,
-                'link_direction' => 'counterpart',
-            ])
-            ->assertCreated()
-            ->assertJsonPath('data.source_ticket_id', $blockingTicket->id)
-            ->assertJsonPath('data.target_ticket_id', $blockedTicket->id)
-            ->assertJsonPath('data.ticket_link_type.label', 'Blocked by')
-            ->assertJsonPath('meta.message', 'Blocked by link was saved.');
-
-        $this->withApplicationKey($user)
-            ->getJson(route('api.projects.tickets.show', [$project, $blockingTicket]))
-            ->assertOk()
-            ->assertJsonPath('data.linkedTickets.0.ticket_link_type.label', 'Blocks');
-
-        $this->withApplicationKey($user)
-            ->getJson(route('api.projects.tickets.show', [$project, $blockedTicket]))
-            ->assertOk()
-            ->assertJsonPath('data.linkedTickets.0.ticket_link_type.label', 'Blocked by');
-
-        $this->withApplicationKey($user)
-            ->postJson(route('api.projects.tickets.links.store', [$project, $blockedTicket]), [
-                'linked_ticket_id' => $blockingTicket->id,
-                'ticket_link_type_id' => $linkType->id,
-                'link_direction' => 'invalid',
-            ])
-            ->assertUnprocessable()
-            ->assertJsonValidationErrors('link_direction');
-    }
-
    public function test_ticket_links_and_branch_endpoints_are_available(): void
    {
        Http::preventStrayRequests();
@@ -817,75 +817,6 @@ class ProjectControllerTest extends TestCase
        ]);
    }

-    public function test_project_admins_can_delete_their_own_projects_and_reuse_the_key(): void
-    {
-        $user = User::factory()->create();
-        $this->syncGlobalPermissions($user, ['create']);
-
-        $this->actingAs($user)
-            ->post(route('projects.store'), [
-                'creation_mode' => 'scratch',
-                'name' => 'Core Platform',
-                'key' => 'CORE',
-            ])
-            ->assertRedirect();
-
-        $project = Project::query()->where('key', 'CORE')->firstOrFail();
-        $baseTemplateId = $project->project_template_id;
-        $this->assertTrue($user->can('admin-project', $project));
-
-        $this->actingAs($user)
-            ->delete(route('projects.destroy', $project), [
-                'confirmation_key' => 'CORE',
-            ])
-            ->assertRedirect(route('projects.index'));
-
-        $this->assertDatabaseMissing('projects', ['id' => $project->id]);
-        $this->assertDatabaseMissing('project_templates', ['id' => $baseTemplateId]);
-
-        $this->actingAs($user)
-            ->post(route('projects.store'), [
-                'creation_mode' => 'scratch',
-                'name' => 'New Core Platform',
-                'key' => 'CORE',
-            ])
-            ->assertRedirect();
-
-        $this->assertDatabaseHas('projects', [
-            'key' => 'CORE',
-            'name' => 'New Core Platform',
-        ]);
-    }
-
-    public function test_deleting_a_project_preserves_its_published_template_and_linked_projects(): void
-    {
-        $admin = User::factory()->admin()->create();
-        $project = Project::factory()->create(['key' => 'CORE']);
-        $otherProject = Project::factory()->create(['key' => 'OTHER']);
-        $template = ProjectTemplate::factory()->create([
-            'source_project_id' => $project->id,
-            'is_published' => true,
-        ]);
-
-        $project->update(['project_template_id' => $template->id]);
-        $otherProject->update(['project_template_id' => $template->id]);
-
-        $this->actingAs($admin)
-            ->delete(route('projects.destroy', $project), [
-                'confirmation_key' => 'CORE',
-            ])
-            ->assertRedirect(route('projects.index'));
-
-        $this->assertDatabaseHas('project_templates', [
-            'id' => $template->id,
-            'source_project_id' => null,
-        ]);
-        $this->assertDatabaseHas('projects', [
-            'id' => $otherProject->id,
-            'project_template_id' => $template->id,
-        ]);
-    }
-
    /**
     * Ensure project deletion requires the exact project key confirmation.
     */
@@ -910,18 +841,16 @@ class ProjectControllerTest extends TestCase
    }

    /**
-     * Ensure users without project administration cannot delete projects.
+     * Ensure non-admin users cannot delete projects.
     */
-    public function test_project_readers_cannot_delete_projects(): void
+    public function test_non_admin_users_cannot_delete_projects(): void
    {
        $user = User::factory()->create();
-        $otherProject = Project::factory()->create();
        $project = Project::factory()->create([
            'key' => 'CORE',
        ]);

-        $this->syncProjectPermissions($otherProject, $user, ['admin']);
-        $this->syncProjectPermissions($project, $user, ['view']);
+        $this->syncProjectPermissions($project, $user, ['admin']);

        $this->actingAs($user)
            ->delete(route('projects.destroy', $project), [
@@ -83,74 +83,6 @@ class ProjectTicketLinkControllerTest extends TestCase
        ]);
    }

-    public function test_counterpart_label_can_be_selected_from_the_current_ticket(): void
-    {
-        $user = User::factory()->create();
-        $project = Project::factory()->create(['key' => 'CORE']);
-
-        app(InitializeProjectTicketMetadata::class)->handle($project);
-
-        $priority = $project->ticketPriorities()->firstOrFail();
-        $taskType = $project->ticketTypes()->where('is_parent', false)->firstOrFail();
-        $ticketLinkType = TicketLinkType::factory()->for($project)->create([
-            'label' => 'Blocks',
-            'counterpart_label' => 'Blocked by',
-        ]);
-        $blockingTicket = Ticket::factory()->create([
-            'project_id' => $project->id,
-            'sequence_number' => 1,
-            'ticket_key' => 'CORE-1',
-            'ticket_priority_id' => $priority->id,
-            'ticket_type_id' => $taskType->id,
-        ]);
-        $blockedTicket = Ticket::factory()->create([
-            'project_id' => $project->id,
-            'sequence_number' => 2,
-            'ticket_key' => 'CORE-2',
-            'ticket_priority_id' => $priority->id,
-            'ticket_type_id' => $taskType->id,
-        ]);
-
-        $this->syncProjectPermissions($project, $user, ['edit', 'view']);
-
-        $this->actingAs($user)
-            ->post(route('projects.tickets.links.store', [$project, $blockedTicket]), [
-                'linked_ticket_id' => $blockingTicket->id,
-                'ticket_link_type_id' => $ticketLinkType->id,
-                'link_direction' => 'counterpart',
-            ])
-            ->assertRedirect(route('projects.tickets.show', [$project, $blockedTicket]))
-            ->assertSessionHas('status', 'Blocked by link was saved.');
-
-        $this->assertDatabaseHas('ticket_links', [
-            'source_ticket_id' => $blockingTicket->id,
-            'target_ticket_id' => $blockedTicket->id,
-            'ticket_link_type_id' => $ticketLinkType->id,
-        ]);
-        $this->assertDatabaseHas('ticket_worklog_entries', [
-            'ticket_id' => $blockedTicket->id,
-            'summary' => 'Linked CORE-1 as Blocked by.',
-        ]);
-        $this->assertDatabaseHas('ticket_worklog_entries', [
-            'ticket_id' => $blockingTicket->id,
-            'summary' => 'Linked CORE-2 as Blocks.',
-        ]);
-
-        $this->actingAs($user)
-            ->post(route('projects.tickets.links.store', [$project, $blockedTicket]), [
-                'linked_ticket_id' => $blockingTicket->id,
-                'ticket_link_type_id' => $ticketLinkType->id,
-                'link_direction' => 'source',
-            ])
-            ->assertSessionHas('status', 'Blocks link was saved.');
-
-        $this->assertSame(1, TicketLink::query()->count());
-        $this->assertDatabaseHas('ticket_links', [
-            'source_ticket_id' => $blockedTicket->id,
-            'target_ticket_id' => $blockingTicket->id,
-        ]);
-    }
-
    /**
     * Ensure ticket links cannot target the current ticket or a ticket from another project.
     */
@@ -212,15 +144,6 @@ class ProjectTicketLinkControllerTest extends TestCase
            ])
            ->assertRedirect(route('projects.tickets.show', [$project, $ticket]))
            ->assertSessionHasErrors('linked_ticket_id');
-
-        $this->actingAs($user)
-            ->from(route('projects.tickets.show', [$project, $ticket]))
-            ->post(route('projects.tickets.links.store', [$project, $ticket]), [
-                'linked_ticket_id' => $foreignTicket->id,
-                'ticket_link_type_id' => $ticketLinkType->id,
-                'link_direction' => 'sideways',
-            ])
-            ->assertSessionHasErrors('link_direction');
    }

    /**
@@ -5,7 +5,7 @@ import tailwind from '@tailwindcss/vite';
 import vue from '@vitejs/plugin-vue';
 import { createInertiaApp } from '@inertiajs/vue3';
 import { createServer } from 'vite';
-import { createSSRApp, h, reactive, ref } from 'vue';
+import { createSSRApp, h } from 'vue';
 import { renderToString } from 'vue/server-renderer';

 const serve = process.argv.includes('--serve');
@@ -398,11 +398,6 @@ if (serve) {
                } else {
                    params.delete('noLinks');
                    params.delete('linkRejected');
-                    if (data.link_direction === 'counterpart') {
-                        params.set('incoming', '1');
-                    } else {
-                        params.delete('incoming');
-                    }
                }
            } else {
                assert.ok(
@@ -463,40 +458,6 @@ if (serve) {
    );
 } else {
    try {
-        const { useTicketLinkActions } = await server.ssrLoadModule(
-            '/resources/js/composables/useTicketLinkActions.ts',
-        );
-        const linkTypes = ref([
-            { id: 1, label: 'Blocks', counterpart_label: 'Blocked by' },
-            { id: 2, label: 'Relates to', counterpart_label: 'Relates to' },
-        ]);
-        const linkForm = reactive({
-            ticket_link_type_id: 1,
-            link_direction: 'source',
-            linked_ticket_id: 41,
-        });
-        const { actions, selectedAction, selectedActionLabel } =
-            useTicketLinkActions(linkTypes, linkForm);
-        assert.deepEqual(
-            actions.value.map((action) => action.label),
-            ['Blocks', 'Blocked by', 'Relates to'],
-        );
-        assert.equal(selectedActionLabel.value, 'Blocks');
-        selectedAction.value = '1:counterpart';
-        assert.equal(selectedActionLabel.value, 'Blocked by');
-        assert.deepEqual(
-            { ...linkForm },
-            {
-                ticket_link_type_id: 1,
-                link_direction: 'counterpart',
-                linked_ticket_id: 41,
-            },
-        );
-        selectedAction.value = '2:source';
-        assert.equal(linkForm.ticket_link_type_id, 2);
-        assert.equal(linkForm.link_direction, 'source');
-        selectedAction.value = 'unknown';
-        assert.equal(selectedActionLabel.value, 'Relates to');
        const { createLocalization } = await server.ssrLoadModule(
            '/resources/js/lib/localization.ts',
        );
@@ -525,24 +486,6 @@ if (serve) {
            return result.body.split('id="main-content"')[1];
        };
        const html = await render();
-        assert.ok(!html.includes('id="link_direction"'));
-        assert.ok(html.includes('Blocked by'));
-        const linkFields = [
-            ...html.matchAll(/<fieldset\b[^>]*>[\s\S]*?<\/fieldset>/g),
-        ].find(([fieldset]) =>
-            fieldset.includes('id="ticket_link_type_id"'),
-        )?.[0];
-        assert.ok(linkFields);
-        assert.equal((linkFields.match(/<select\b/g) ?? []).length, 2);
-        assert.match(
-            linkFields,
-            /<option value="1:source"[^>]*>Blocks<\/option>/,
-        );
-        assert.match(
-            linkFields,
-            /<option value="1:counterpart"[^>]*>Blocked by<\/option>/,
-        );
-        assert.doesNotMatch(linkFields, /Blocks \/ Blocked by/);
        for (const text of [
            ticket.title,
            'Keep every existing ticket action available.',
@@ -620,9 +563,9 @@ if (serve) {
            /<a(?=[^>]*href="https:\/\/git\.example\.test\/Engineering\/platform\/pulls\/12")(?=[^>]*target="_blank")(?=[^>]*rel="noopener noreferrer")[^>]*>/,
        );
        assert.match(html, /Save link/);
-        assert.doesNotMatch(html, /Outgoing/);
+        assert.match(html, /Outgoing/);
        const incoming = await render('?incoming');
-        assert.doesNotMatch(incoming, /Incoming/);
+        assert.match(incoming, /Incoming/);
        assert.match(incoming, /Blocked by/);
        assert.match(await render('?noTypes'), /No link types are configured/);
        assert.match(
@@ -41,6 +41,8 @@ try {
                'Platform delivery',
                'Child tickets',
                'Nested child with a long title that must wrap on mobile',
+                'Incoming',
+                'Blocked by',
            ]) {
                assert.equal(
                    await section()
@@ -50,13 +52,6 @@ try {
                    text,
                );
            }
-            assert.equal(
-                await section()
-                    .locator('[data-ticket-link]')
-                    .getByText('Blocked by', { exact: true })
-                    .isVisible(),
-                true,
-            );
            const collapse = section().getByRole('button', {
                name: 'Collapse children of ENG-41',
            });
@@ -73,7 +68,7 @@ try {
            );
            await page.keyboard.press('Space');
            assert.equal(await collapse.getAttribute('aria-expanded'), 'true');
-            await control('Action').focus();
+            await control('Link type').focus();
            await page.keyboard.press('Tab');
            assert.equal(
                await control('Linked ticket').evaluate(
@@ -123,13 +118,9 @@ try {
    await save().click();
    assert.deepEqual((await request).postDataJSON(), {
        ticket_link_type_id: 1,
-        link_direction: 'source',
        linked_ticket_id: 41,
    });
-    await section()
-        .locator('[data-ticket-link]')
-        .getByText('Blocks', { exact: true })
-        .waitFor();
+    await section().getByText('Outgoing', { exact: true }).waitFor();
    await page.waitForFunction(
        () => document.querySelector('#linked_ticket_id')?.value === '',
    );
@@ -150,27 +141,6 @@ try {
        document.activeElement?.textContent.includes('Linked tickets'),
    );

-    await visit('?noLinks');
-    await control('Action').selectOption('1:counterpart');
-    await control('Linked ticket').selectOption('41');
-    await section()
-        .locator('p[aria-live="polite"]')
-        .getByText('Blocked by', { exact: true })
-        .waitFor();
-    request = page.waitForRequest(
-        (r) => r.method() === 'POST' && r.url().endsWith('/links'),
-    );
-    await save().click();
-    assert.deepEqual((await request).postDataJSON(), {
-        ticket_link_type_id: 1,
-        link_direction: 'counterpart',
-        linked_ticket_id: 41,
-    });
-    await section()
-        .locator('[data-ticket-link]')
-        .getByText('Blocked by', { exact: true })
-        .waitFor();
-
    await visit('?rejectLink');
    await control('Linked ticket').selectOption('41');
    await save().click();
@@ -178,7 +148,7 @@ try {
        .getByText('Choose another ticket.', { exact: true })
        .waitFor();
    assert.equal(await control('Linked ticket').inputValue(), '41');
-    for (const label of ['Action', 'Linked ticket']) {
+    for (const label of ['Link type', 'Linked ticket']) {
        assert.equal(await control(label).getAttribute('aria-invalid'), 'true');
    }
    await page.route('**/tickets/42/links', (route) => route.abort('failed'));
@@ -0,0 +1,39 @@
+<?php
+
+namespace Tests\Unit;
+
+use League\Flysystem\CorruptedPathDetected;
+use League\Flysystem\WhitespacePathNormalizer;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+class FilesystemPathSecurityTest extends TestCase
+{
+    #[DataProvider('corruptedPaths')]
+    public function test_corrupted_paths_are_rejected(string $path): void
+    {
+        $this->expectException(CorruptedPathDetected::class);
+
+        (new WhitespacePathNormalizer)->normalizePath($path);
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function corruptedPaths(): array
+    {
+        return [
+            'control character' => ["avatars/user\x00.svg"],
+            'malformed UTF-8' => ["avatars/user\xFF.svg"],
+            'control character hidden by malformed UTF-8' => ["avatars/user\xFF\x00.svg"],
+        ];
+    }
+
+    public function test_valid_unicode_paths_remain_supported(): void
+    {
+        $this->assertSame(
+            'avatars/benützer.svg',
+            (new WhitespacePathNormalizer)->normalizePath('./avatars//benützer.svg'),
+        );
+    }
+}