0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-14 13:58:53 +08:00
discourse/app/controllers
Régis HANOL abb8e4c162
UX: Show disabled tags with explanations in composer tag search (#39072)
When users search for tags in the composer, certain tags are silently
excluded by backend filtering rules (one_per_topic groups, parent tag
requirements, category restrictions, synonyms). The user sees "No
matches found" with no explanation, making it appear as though the tag
doesn't exist.

This commit shows excluded tags as disabled rows in the autocomplete
dropdown with an inline explanation of why they can't be used. This
covers all exclusion reasons:

- One per topic: "Only one tag from the 'X' group is allowed per topic"

<img width="942" height="363" alt="2026-04-02 @ 12 31 34"
src="https://github.com/user-attachments/assets/1a181c7b-8ed2-4d6e-a22d-75ed6740db69"
/>

- Parent tag: "Requires the 'Y' tag to use tags from the 'X' group"

<img width="949" height="293" alt="2026-04-02 @ 12 32 55"
src="https://github.com/user-attachments/assets/3a6fe68d-66fd-4fe3-8d55-40342b0f8f0a"
/>

- Category restriction: "'tag' is restricted to the 'X' category"

<img width="783" height="321" alt="2026-04-02 @ 12 31 54"
src="https://github.com/user-attachments/assets/2f3601e2-d495-4906-8092-4a0bebcbbe52"
/>

- Synonyms: "This is a synonym for 'X'. Use 'X' instead."

<img width="807" height="326" alt="2026-04-02 @ 12 31 16"
src="https://github.com/user-attachments/assets/a26a89e0-5b96-49b1-9e62-e1bf41631e7a"
/>

The implementation extracts the tag search logic into a `Tags::Search`
service, queries for visible tags that match the search term but were
excluded from the allowed results, determines the exclusion reason for
each, and returns them as disabled items in the results array.

On the frontend, disabled rows are styled with reduced opacity on the
tag name and an italic reason line below. Click and keyboard selection
are blocked on disabled rows. The mini-tag-chooser now also passes
`excludeSynonyms` so synonyms appear as disabled rather than selectable.

A `guardian.can_see_tag?` check prevents leaking the existence of
staff-only tags, and hidden parent tag names are not exposed to users
who can't see them.

Ref - t/181010
2026-04-14 10:37:27 +02:00
..
admin FEATURE: Allow changing source repo/branch/key for theme after installation (#38169) 2026-04-02 16:56:19 +01:00
users DEV: Fix invite-only OAuth signup bypass via non-invite origin routes (#38646) 2026-03-17 09:19:09 -05:00
about_controller.rb
application_controller.rb FEATURE: Add bfcache-compatible cache-control headers option (#38763) 2026-03-23 17:34:45 -03:00
associated_groups_controller.rb
badges_controller.rb FIX: Non-listable and disabled badges exposed via XHR JSON requests (#37869) 2026-02-17 16:17:01 +11:00
bookmarks_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
bootstrap_controller.rb DEV: Refactor plugin JS handling (#37763) 2026-02-19 12:24:04 +00:00
calendar_subscriptions_controller.rb FEATURE: Add calendar subscription URLs to user preferences (#38598) 2026-03-17 10:28:20 -03:00
categories_controller.rb FEATURE: Support group based category posting review modes (#38707) 2026-04-07 10:41:16 +08:00
clicks_controller.rb
composer_controller.rb SECURITY: Hidden group membership can be inferred via allowed_names and user_reasons 2026-03-19 15:21:28 +00:00
composer_messages_controller.rb
dev_mode_controller.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller.rb
directory_items_controller.rb SECURITY: exclude_groups enables private group membership inference without authorization 2026-03-19 15:21:28 +00:00
do_not_disturb_controller.rb
drafts_controller.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
edit_directory_columns_controller.rb
email_controller.rb FEATURE: implement RFC 8058 for email unsubscribe (#33392) 2025-07-01 11:01:13 +10:00
embed_controller.rb DEV: Gate Reply-count endpoint for non-public embedded topics (#38498) 2026-03-11 07:39:00 -07:00
emojis_controller.rb FEATURE: Locale-specific emoji search aliases (#39089) 2026-04-06 14:08:46 -03:00
exceptions_controller.rb
export_csv_controller.rb SECURITY: Prevent moderators from exporting admin-only reports via CSV 2026-03-31 15:12:45 +01:00
extra_locales_controller.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller.rb FIX: Redirect to wizard when setting up new instance using Discourse ID (#36993) 2026-01-07 10:19:17 -05:00
form_templates_controller.rb DEV: Rename experimental_ upcoming change settings (#37589) 2026-02-10 10:34:37 +10:00
forums_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
groups_controller.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
hashtags_controller.rb
highlight_js_controller.rb
home_page_controller.rb DEV: Show login-required splash in root route (take 2) (#32629) 2025-05-14 11:25:43 -04:00
inline_onebox_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
invites_controller.rb SECURITY: Gate staged user fields on email verification 2026-03-31 15:12:45 +01:00
list_controller.rb FIX: Respect query params like exclude_tag in RSS feed endpoints (#39130) 2026-04-08 18:14:01 +10:00
metadata_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
new_invite_controller.rb FEATURE: Add invite link to the sidebar (#29448) 2024-10-30 05:31:14 +03:00
new_topic_controller.rb
notifications_controller.rb FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987) 2026-01-07 15:28:43 +08:00
offline_controller.rb
onebox_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
pageview_controller.rb
permalinks_controller.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller.rb SECURITY: hide total_rows for restricted post action types 2026-03-19 15:21:28 +00:00
post_actions_controller.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:21:28 +00:00
post_localizations_controller.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_readers_controller.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure 2026-03-31 15:12:45 +01:00
posts_controller.rb FIX: resolve localized tag names via ID when creating or editing topics (#39026) 2026-04-02 13:42:55 +08:00
presence_controller.rb FIX: improve "read only" modes (#33521) 2025-07-10 09:08:00 +02:00
published_pages_controller.rb FIX: ensures only staff can check slugs (#37846) 2026-02-16 18:23:46 +01:00
push_notification_controller.rb
qunit_controller.rb DEV: Refactor plugin JS handling (#37763) 2026-02-19 12:24:04 +00:00
reviewable_claimed_topics_controller.rb DEV: Convert ReviewableClaimedTopicsController#destroy response from 403 to 404 (#38339) 2026-03-06 15:39:51 -06:00
reviewable_notes_controller.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:22:54 +00:00
reviewables_controller.rb SECURITY: XSS in review queue via highlightWatchedWords 2026-03-19 15:21:28 +00:00
robots_txt_controller.rb DEV: Update link to comment in robots.txt as 'allow' is allowed (#33227) 2025-06-18 13:30:26 +08:00
safe_mode_controller.rb FIX: Set X-Robots-Tag header to prevent indexing of /safe-mode (#32329) 2025-04-16 16:51:32 +10:00
search_controller.rb FIX: exclude 't' shortcut from min length bypass (#37440) 2026-02-05 06:58:19 +11:00
session_controller.rb FIX: Passkey login not outputting error messages with suspended user and screened IP checks (#37827) 2026-02-16 09:28:03 -05:00
sidebar_sections_controller.rb FIX: raise 404 when sidebar section doesn't exist (#37675) 2026-02-10 15:47:49 +01:00
similar_topics_controller.rb
site_controller.rb SECURITY: Preload data only when rendering application layout 2025-02-04 13:32:30 -03:00
sitemap_controller.rb
slugs_controller.rb
static_controller.rb DEV: Move 4 upcoming changes to stable (#39066) 2026-04-07 10:05:49 +10:00
steps_controller.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
stylesheets_controller.rb DEV: Public color_scheme requests can disclose non-user-selectable theme color definitions and raw SCSS (#38497) 2026-03-11 07:56:27 -07:00
svg_sprite_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
tag_groups_controller.rb FIX: Failed updates in tag group controller would be logged (#38333) 2026-03-06 17:11:12 -03:00
tag_localizations_controller.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
tags_controller.rb UX: Show disabled tags with explanations in composer tag search (#39072) 2026-04-14 10:37:27 +02:00
test_requests_controller.rb DEV: Add a user agent to all HTTP requests that Discourse makes. (#31555) 2025-03-03 16:32:25 +11:00
theme_javascripts_controller.rb DEV: Manually fix Rails/UnusedRenderContent offenses (#34418) 2025-08-22 11:42:12 +02:00
topic_localizations_controller.rb UX: Use inline title editor instead of composer when editing translation (#36847) 2025-12-24 00:56:36 +08:00
topic_view_stats_controller.rb
topics_controller.rb FEATURE: Add bulk pin/unpin topics (#39025) 2026-04-09 14:44:23 +08:00
uploads_controller.rb DEV: Silence expected error/debug output in system specs (#39164) 2026-04-13 13:59:41 +02:00
user_actions_controller.rb SECURITY: Enforce Guardian checks in UserActionsController#show 2026-03-19 15:21:28 +00:00
user_api_key_clients_controller.rb FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855) 2026-02-17 12:39:09 +11:00
user_api_keys_controller.rb SECURITY: Validate auth_redirect in UserApiKeysController#new to prevent open redirect phishing 2026-03-19 15:21:28 +00:00
user_avatars_controller.rb PERF: extract shared DiskCacheEviction utility for disk caches (#37842) 2026-02-16 12:24:38 +01:00
user_badges_controller.rb FIX: enforces logged in, in badges actions (#37666) 2026-02-10 12:00:56 +01:00
user_status_controller.rb
users_controller.rb FEATURE: Add friendly names to calendar subscription feeds (#39154) 2026-04-08 13:34:04 -03:00
users_email_controller.rb FIX: enforces login for create in user emails controller (#37770) 2026-02-12 17:10:43 +01:00
webhooks_controller.rb SECURITY: harden webooks endpoints 2026-02-26 12:22:54 +00:00
wizard_controller.rb