VITE LOGIN INBOX: Migrating Login and Inbox paths to Vite by henryjonathanquispe · Pull Request #8916 · ProcessMaker/processmaker

henryjonathanquispe · 2026-07-20T18:55:03Z

Related Tickets & Packages

#Instructions to install

> npm run i
> npm run dev
> npm run vite:build

To update the routes:
php artisan config:clear

#MInimal changes
PACKAGE-DATA-SOURCES
https://github.com/ProcessMaker/package-data-sources/pull/492

PACKAGE-VARIABLE-FINDER
https://github.com/ProcessMaker/package-variable-finder/pull/70

Code Review Checklist

I have pulled this code locally and tested it on my instance, along with any associated packages.
This code adheres to ProcessMaker Coding Guidelines.
This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
This solution fixes the bug reported in the original ticket.
This solution does not alter the expected output of a component in a way that would break existing Processes.
This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
This ticket conforms to the PRD associated with this part of ProcessMaker.

ci:deploy
ci:package-data-sources:VITE_INBOX
ci:package-variable-finder:VITE_INBOX

…ITE_INBOX

gitguardian · 2026-07-23T19:50:58Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
34069781	Triggered	Generic Password	`bc1d2d6`	resources/views/vite/auth/login.blade.php	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

nolanpro · 2026-07-24T17:57:16Z

@henryjonathanquispe a few suggestions

See if we can avoid adding .vue to all import statements by adding it to the extensions in the config:

 // vite.config.js
 resolve: {
   extensions: ['.mjs', '.js', '.ts', '.jsx', '.tsx', '.json', '.vue'],
   // ...existing aliases
 }

Once we transition a route, we should full-on commit to it and delete the old one. So I would get rid of the VITE_VIEW and config/app.php setting, and instead, hard-code the new blade template in the controller and remove .js("resources/js/tasks/index.js", "public/js/tasks/index.js") form webpack.mix.js.
Going along with the above, as part of this PR, convert all login templates to use vite. For example, change.blade.php, newLogin.blade.php (is this 'newLogin' template even necessary any more?), and any template that uses auth-language-scripts and auth-language-scripts-minimal partials. That way we can get this PR super clean and self contained!
Update package.json: "production": "mix --production && mix --mix-config=webpack-login.mix.js --production && vite build"

henryjonathanquispe · 2026-07-27T14:27:05Z

@nolanpro the PR has been updated!

VITE_INBOX: update AGENTS.md VITE_INBOX: remove webpack-login, change to vite VITE_INBOX: update task controller, remove unnecesary files changed VITE_INBOX: remove unnecesary files changed by extension, reduce the PR VITE_INBOX: remove tasks js files from webpack VITE_INBOX: remove tasks js files from webpack VITE_INBOX: update testCase VITE_INBOX: update rutes password/* because the last changes in login

…ITE_INBOX

vladyrichter · 2026-07-29T17:54:25Z

QA server K8S was successfully deployed https://ci-40c01f3a09.engk8s.processmaker.net

VITE_INBOX: update npm run dev VITE_INBOX: update npm run dev VITE_INBOX: update npm run dev VITE_INBOX: update broadcast pusher in ci build

vladyrichter · 2026-07-29T18:54:18Z

QA server K8S was successfully deployed https://ci-40c01f3a09.engk8s.processmaker.net

…o FOUR-32412

…ITE_INBOX

vladyrichter · 2026-07-29T21:09:22Z

QA server K8S was successfully deployed https://ci-40c01f3a09.engk8s.processmaker.net

…ITE_INBOX

…o FOUR-32412

nolanpro · 2026-08-27T15:17:13Z

QA server K8S was successfully deployed https://ci-40c01f3a09.engk8s.processmaker.net

…ITE_INBOX

…o FOUR-32412

nolanpro · 2026-09-07T21:22:50Z

QA server K8S was successfully deployed https://ci-40c01f3a09.engk8s.processmaker.net

…tation

Four 32412

cursor · 2026-09-16T22:08:38Z

PR Summary

Medium Risk
Dual asset pipelines (Mix + Vite) and relocated Vite HMR can break login/inbox if builds or hot-file setup are wrong; most PHP changes are additive view variables.

Overview
Adds Vite alongside Laravel Mix for Login and Inbox front-end assets, replacing the separate webpack-login.mix.js step in dev/production with vite build (and new vite:dev / build:all scripts). Dev dependencies include Vite 7, laravel-vite-plugin, and @vitejs/plugin-vue2; public/build is gitignored for Vite output.

Laravel integration: ProcessMakerServiceProvider sets Vite::useHotFile(storage_path('vite.hot')) so Vite HMR does not use public/hot, which Mix still uses—avoiding mix() URLs incorrectly pointing at the Vite dev server.

View data: ScreenBuilderController and RequestController::screenPreview now pass an uppercased screen type (FORM default) into their Blade views, likely for Vite-driven screen/login/inbox bundles.

Mix remains for the bulk of assets; production runs both mix --production and vite build.

^{Reviewed by Cursor Bugbot for commit 91b5ca2. Bugbot is set up for automated code reviews on this repo. Configure here.}

decisions-sonarqube · 2026-09-16T22:10:20Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

cursor

Cursor Bugbot has reviewed your changes using high effort and found 4 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 91b5ca2. Configure here.}

cursor · 2026-09-16T22:11:59Z

+    icons: {},
+  },
+};
+


Login wipes ProcessMaker packages

High Severity

login.js assigns a new window.ProcessMaker with packages: [] after the Blade inline has already set ProcessMaker.packages. Vite emits type="module" scripts, which run after parsing, so the module overwrites the package list used by login addons and global scripts.

Additional Locations (2)

resources/views/auth/newLogin.blade.php#L182-L185

resources/views/auth/layouts/auth.blade.php#L73-L84

^{Reviewed by Cursor Bugbot for commit 91b5ca2. Configure here.}

cursor · 2026-09-16T22:11:59Z

+      @vite(['resources/js/processes/screen-builder/typeForm.js'])
+    @elseif ($type === 'DISPLAY')
+      @vite(['resources/js/processes/screen-builder/typeDisplay.js'])
+    @endif


Screen type scripts load twice

Medium Severity

Screen builder and request preview now @vite typeForm.js or typeDisplay.js while ScreenBuilderStarting still adds the Mix copies via $manager->getScripts(). The same type bundle runs twice and can register controls and listeners twice.

Additional Locations (2)

resources/views/requests/preview.blade.php#L38-L43

ProcessMaker/Providers/ProcessMakerServiceProvider.php#L273-L289

^{Reviewed by Cursor Bugbot for commit 91b5ca2. Configure here.}

cursor · 2026-09-16T22:11:59Z

+    @vite(['resources/js/vite/tasks/loaderTasks.js'])
    @foreach($manager->getScripts() as $script)
-        <script src="{{$script}}"></script>
+        <script defer src="{{$script}}"></script>


Inbox Mix scripts lack webpack runtime

Medium Severity

Inbox still injects Mix typeForm.js and typeDisplay.js from $manager->getScripts(). layoutnextvite does not load mix('js/manifest.js') or other webpack runtime, so those chunks throw and package ScreenBuilder hooks on inbox can fail.

Additional Locations (1)

ProcessMaker/Providers/ProcessMakerServiceProvider.php#L279-L286

^{Reviewed by Cursor Bugbot for commit 91b5ca2. Configure here.}

cursor · 2026-09-16T22:11:59Z

-        return view('requests.preview', compact('request', 'screen', 'manager', 'data'));
+        $type = strtoupper($screen->type ?? 'FORM');
+
+        return view('requests.preview', compact('request', 'screen', 'manager', 'data', 'type'));


Preview type disagrees with event

Medium Severity

screenPreview still starts ScreenBuilder with $request->summary_screen->type, but the new $type used by @vite comes from $screen->type. When those differ, Mix package scripts register one screen type and Vite loads the other type chunk.

Additional Locations (1)

resources/views/requests/preview.blade.php#L38-L43

^{Reviewed by Cursor Bugbot for commit 91b5ca2. Configure here.}

henryjonathanquispe added 2 commits July 17, 2026 08:53

VITE_CHANGE: use vite on the normal Login

bc1d2d6

VITE INBOX: POC to test the ease of migrating other views to vite

b493831

henryjonathanquispe changed the base branch from VITE_JONAS to develop July 23, 2026 19:44

henryjonathanquispe changed the title ~~VITE INBOX: POC to test the ease of migrating other views to vite~~ VITE LOGIN INBOX: Migrating Login and Inbox to Vite Jul 23, 2026

Merge branch 'develop' of github.com:ProcessMaker/processmaker into V…

c4365ce

…ITE_INBOX

henryjonathanquispe force-pushed the VITE_INBOX branch 3 times, most recently from 58441fd to 327120d Compare July 24, 2026 20:11

henryjonathanquispe force-pushed the VITE_INBOX branch 2 times, most recently from b33d3b1 to 4af7386 Compare July 27, 2026 21:01

henryjonathanquispe force-pushed the VITE_INBOX branch from 4af7386 to e2aed60 Compare July 28, 2026 15:09

henryjonathanquispe added 2 commits July 28, 2026 13:46

Merge branch 'develop' of github.com:ProcessMaker/processmaker into V…

3765618

…ITE_INBOX

FOUR-32412: VITE /process-browser and /cases migrations

6752c54

henryjonathanquispe changed the base branch from develop to VITE_JONAS July 29, 2026 14:27

henryjonathanquispe changed the base branch from VITE_JONAS to develop July 29, 2026 14:27

FOUR-32412: VITE /cases/{id} migration

e76ff29

henryjonathanquispe force-pushed the VITE_INBOX branch 3 times, most recently from 998c120 to 29fc119 Compare July 29, 2026 17:15

VITE_INBOX: update npm run dev

cac46ac

VITE_INBOX: update npm run dev VITE_INBOX: update npm run dev VITE_INBOX: update npm run dev VITE_INBOX: update broadcast pusher in ci build

henryjonathanquispe force-pushed the VITE_INBOX branch from 29fc119 to cac46ac Compare July 29, 2026 18:16

henryjonathanquispe added 2 commits July 29, 2026 16:01

Merge branch 'VITE_INBOX' of github.com:ProcessMaker/processmaker int…

2bc3388

…o FOUR-32412

Merge branch 'develop' of github.com:ProcessMaker/processmaker into V…

f7aaa38

…ITE_INBOX

henryjonathanquispe added 3 commits August 26, 2026 14:30

FOUR-32412: Vite /designer/scripts/preview?node={scriptRef:18}

cf69a2c

Merge branch 'develop' of github.com:ProcessMaker/processmaker into V…

95fb8a8

…ITE_INBOX

Merge branch 'VITE_INBOX' of github.com:ProcessMaker/processmaker int…

942a7d9

…o FOUR-32412

henryjonathanquispe added 4 commits August 27, 2026 14:27

FOUR-32412: Vite /designer/screens/preview?node={screenRef:26}

d63a35a

Merge branch 'develop' of github.com:ProcessMaker/processmaker into V…

1b9bc4b

…ITE_INBOX

Merge branch 'VITE_INBOX' of github.com:ProcessMaker/processmaker int…

087c5a3

…o FOUR-32412

Update edit.blade.php

f71790a

henryjonathanquispe and others added 14 commits September 9, 2026 14:25

FOUR-32412: add initialLoad to other packages, ex. package-ai documen…

8f18ccd

…tation

Update loaderMinimal.js loaderMonaco.js

02208dc

Remove loaderNotifications.js

11657ca

Remove loaderTemplates.js

d9767b9

Remove loaderAuthClients.js

341a168

Remove loaderCssOverride.js

903929b

Remove loaderProfile.js

14e572f

Remove loaderGroups.js

639f102

Remove loaderSignals.js

afbaa24

Remove loaderUsers.js

e86b7ec

Remove loaderGroups.js

3736ccf

Remove loaderEnvironment.js

494b268

Remove loaderScriptsPreview.js

927dcea

Merge pull request #8946 from ProcessMaker/FOUR-32412

91b5ca2

Four 32412

nolanpro self-requested a review September 16, 2026 22:08

nolanpro approved these changes Sep 16, 2026

View reviewed changes

nolanpro merged commit 7ea656b into develop Sep 16, 2026
7 of 8 checks passed

nolanpro deleted the VITE_INBOX branch September 16, 2026 22:09

cursor Bot reviewed Sep 16, 2026

View reviewed changes

Conversation

henryjonathanquispe commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Tickets & Packages

Code Review Checklist

Uh oh!

gitguardian Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

nolanpro commented Jul 24, 2026

Uh oh!

henryjonathanquispe commented Jul 27, 2026

Uh oh!

vladyrichter commented Jul 29, 2026

Uh oh!

vladyrichter commented Jul 29, 2026

Uh oh!

vladyrichter commented Jul 29, 2026

Uh oh!

nolanpro commented Aug 27, 2026

Uh oh!

nolanpro commented Sep 7, 2026

Uh oh!

cursor Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

decisions-sonarqube Bot commented Sep 16, 2026

Quality Gate passed

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Sep 16, 2026

Choose a reason for hiding this comment

Login wipes ProcessMaker packages

Uh oh!

cursor Bot Sep 16, 2026

Choose a reason for hiding this comment

Screen type scripts load twice

Uh oh!

cursor Bot Sep 16, 2026

Choose a reason for hiding this comment

Inbox Mix scripts lack webpack runtime

Uh oh!

cursor Bot Sep 16, 2026

Choose a reason for hiding this comment

Preview type disagrees with event

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

henryjonathanquispe commented Jul 20, 2026 •

edited

Loading

gitguardian Bot commented Jul 23, 2026 •

edited

Loading

cursor Bot commented Sep 16, 2026 •

edited

Loading