[3.0.x] Paragraph Group

Thank you for applying!

Please read Review process for security advisory coverage: What to expect for more details and Security advisory coverage application checklist to understand what reviewers look for. Tips for ensuring a smooth review gives some hints for a smoother review.

The important notes are the following.

• If you have not done it yet, enable GitLab CI for the project, and fix what reported from the phpcs job. This help to fix most of what reviewers would report.
• For the time this application is open, only your commits are allowed. No other people, including other maintainers/co-maintainers can make commits.
• The purpose of this application is giving you a new drupal.org role that allows you to opt projects into security advisory coverage, either projects you already created, or projects you will create. The project status won't be changed by this application.
• Nobody else will get the permission to opt projects into security advisory policy. If there are other maintainers/co-maintainers who will to get that permission, they need to apply with a different module.
• We only accept an application per user. If you change your mind about the project to use for this application, or it is necessary to use a different project for the application, please update the issue summary with the link to the correct project and the issue title with the project name and the branch to review.

To the reviewers

Please read How to review security advisory coverage applications, Application workflow, What to cover in an application review, and Tools to use for reviews.

The important notes are the following.

• It is preferable to wait for a Code Review Administrator before commenting on newly created applications. Code Review Administrators will do some preliminary checks that are necessary before any change on the project files is suggested.
• Reviewers should show the output of a CLI tool only once per application. The configuration used for these tools needs to be the same configuration used by GitLab CI, stored in the GitLab Templates repository.
• It may be best to have the applicant fix things before further review.

For new reviewers, I would also suggest to first read In which way the issue queue for coverage applications is different from other project queues.

1. FILE: paragraph_group.libraries.yml

  main:
    version: VERSION

  settings:
    version: VERSION

VERSION is only used by Drupal core modules. Contributed modules should use a literal string that does not change with the Drupal core version a site is using.

2. FILE: paragraph_group.module

/**
 * @file
 * Contains paragraph_group.module.
 */

The usual description for a .module file is “Hook implementations for the [module name] module”, where [module name] is the module name given in the .info.yml file.

/**
 * Implements hook_form_FORM_ID_alter().
 *
 * @param array $form
 *   The form array, passed by reference.
 * @param \Drupal\Core\Form\FormStateInterface $form_state
 *   The form state object.
 * @param string $form_id
 *   The form ID.
 */
function paragraph_group_form_paragroup_config_form_alter(

/**
 * Implements hook_form_FORM_ID_alter().
 *
 * @param array $form
 *   The form array, passed by reference.
 * @param \Drupal\Core\Form\FormStateInterface $form_state
 *   The form state object.
 * @param string $form_id
 *   The form ID.
 */
function paragraph_group_form_system_themes_admin_form_alter(

The description for this hook should also say for which form that hook is implemented, either by indicating that with the name of the class that implements the form (namespace included) or the form ID (which is usually indicated by getFormId()).

3. FILE: src/Form/ParagroupConfigForm.php

  /**
   * Constructor.
   *
   * @param \Drupal\paragraph_group\Paragroup\ParagroupBatch $batch_obj
   *   The batch processing service.
   * @param \Drupal\paragraph_group\Paragroup\ParagroupFormData $form_data
   *   The form data service.
   */
  public function __construct(

FILE: src/Paragroup/ParagroupBatch.php

  /**
   * Constructor.
   *
   * @param \Drupal\Core\StringTranslation\TranslationInterface $string_translation
   *   The string translation service.
   * @param \Drupal\paragraph_group\Paragroup\ParagroupFormData $form_data
   *   The form data service.
   */
  public function __construct(

FILE: src/Paragroup/ParagroupFormData.php

  /**
   * Constructor.
   *
   * @param \Drupal\Core\StringTranslation\TranslationInterface $string_translation
   *   The string translation service.
   */
  public function __construct(TranslationInterface $string_translation) {

The documentation comment for constructors is not mandatory anymore, If it is given, the description must be “Constructs a new [class name] object”, where [class name] includes the class namespace.

• The following points are just a start and don't necessarily encompass all of the changes that may be necessary
• A specific point may just be an example and may apply in other places
• A review is about code that does not follow the coding standards, contains possible security issue, or does not correctly use the Drupal API
• The single review points are not ordered, not even by importance

src/Form/ParagroupConfigForm.php

ConfigFormBase::__construct() needs to be called. Since its parameters changed in Drupal 10.2, the project cannot be compatible with all the Drupal 10 releases and Drupal 11; it needs to require at least Drupal 10.2.

With Drupal 10 and Drupal 11, there is no longer need to use #default_value for each form element, when the parent class is ConfigFormBase: It is sufficient to use #config_target, as in the following code.

    $form['image_toolkit'] = [
      '#type' => 'radios',
      '#title' => $this->t('Select an image processing toolkit'),
      '#config_target' => 'system.image:toolkit',
      '#options' => [],
    ];

Using that code, it is no longer needed to save the configuration values in the form submission handler: The parent class will take care of that.

Truly, given the code used by that class, ConfigFormBase is not the appropriate parent class. Form classes do not need to have a parent class; they just need to implement FormInterface.

  /**
   * Create function for constructor.
   *
   * @param \Symfony\Component\DependencyInjection\ContainerInterface $container
   *   The dependency injection container.
   *
   * @return static
   *   A new instance of this class.
   */

The short description is wrong, but it is also not necessary, since for methods defined in a parent class, a trait, or an interface, the documentation comment is just @{inheritdoc}.

    $msg = t('Configuration changes saved successfully.');
    \Drupal::messenger()->addStatus($msg);

Dependencies needs to be injected via create().

Classes that implements ContainerInjectionInterface use $this->t(), not t() (which requires them to use StringTranslationTrait.

src/Paragroup/ParagroupBatch.php

        if ($result) {

          $result = $result . ' out of ' . $result;
          $info = self::getSectionInfoFromFuncName($func_name);

          $msg_params = [
            '@result' => $result,
            '@section_type' => $info[0],
            '@action' => $info[1],
          ];

          $msg = t('@result @section_type @action.', $msg_params);

'out of' is not translated in t('@result @section_type @action.', $msg_params);. What the translators can do with @result @section_type @action. is changing the order of the placeholders to the correct order for their languange, and replacing the character at the end of the sentence with the right character in their language. (For example, Japanese uses 。.)

src/Paragroup/ParagroupFormData.php

  /**
   * The string translation service.
   *
   * @var \Drupal\Core\StringTranslation\TranslationInterface
   */
  protected $stringTranslation;

That is a property already defined by StringTranslationTrait.

 public function __construct(TranslationInterface $string_translation) {

    $this->stringTranslation = $string_translation;

  }

It is correct to initialize that property, but there is StringTranslationTrait::setStringTranslation()

    $manage_fields = $this->t('<a href="@url" target="_blank">Manage Fields</a>', ['@url' => $url]);
    $has_field = $this->hasAdminTitleField($machine_name);

The correct placeholder for URLs is :variable as shown in the documentation for FormattableMarkup::placeholderFormat() and must always be wrapped in quotes. That is the placeholder used also by Drupal core code for URLs that take to drupal.org.

$output = '';
$output .= '<h3>' . t('About') . '</h3>';
$output .= '<p>' . t('The Actions module provides tasks that can be executed by the site such as unpublishing content, sending email messages, or blocking a user. Other modules can trigger these actions when specific system events happen; for example, when new content is posted or when a user logs in. Modules can also provide additional actions. For more information, see the <a href=":documentation">online documentation for the Actions module</a>.', [
  ':documentation' => 'https://www.drupal.org/documentation/modules/action',
]) . '</p>';

paragraph_group.module

For a new module that aims to be compatible with Drupal 10 and Drupal 11, I would rather implement hooks as class methods as described in Support for object oriented hook implementations using autowired services.

Hi! I didn't manage to do a full review, but below you have a brief one. This should give an idea:

- There is no dev release. While not mandatory, it's a highly encouraged practice in the Drupal community.

- I can still see some PHPCS warnings when using the "DrupalPractice" standard:

FILE: /var/www/html/web/modules/custom/paragraph_group/paragraph_group.install
------------------------------------------------------------------------------
FOUND 0 ERRORS AND 2 WARNINGS AFFECTING 2 LINES
------------------------------------------------------------------------------
  9 | WARNING | There must be no blank line following an inline comment
 99 | WARNING | Unused variable $version.
------------------------------------------------------------------------------


FILE: /var/www/html/web/modules/custom/paragraph_group/src/Form/ParagroupConfigForm.php
---------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 4 WARNINGS AFFECTING 4 LINES
---------------------------------------------------------------------------------------
  89 | WARNING | Unused variable $key.
 573 | WARNING | Unused variable $section.
 717 | WARNING | Unused variable $section.
 723 | WARNING | Unused variable $key.
---------------------------------------------------------------------------------------


FILE: /var/www/html/web/modules/custom/paragraph_group/src/Paragroup/ParagroupFieldGroupManager.php
---------------------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 3 WARNINGS AFFECTING 2 LINES
---------------------------------------------------------------------------------------------------
 211 | WARNING | Unused variable $entity_type.
 295 | WARNING | Unused variable $entity_type.
 295 | WARNING | Unused variable $bundle.
---------------------------------------------------------------------------------------------------


FILE: /var/www/html/web/modules/custom/paragraph_group/src/Paragroup/ParagroupFormData.php
------------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
------------------------------------------------------------------------------------------
 217 | WARNING | Unused variable $field_name.
------------------------------------------------------------------------------------------

- Kindly review the README file format, including first line, links, sections, headings etc. More in README.md template

- Object oriented hooks are not supported in Drupal 10 unless they're called from the module file. Your module supports both Drupal 10 and 11, therefore you need to add backwards compatibility as described in the article linked in comment #7. In its current form, the module hooks are not invoked at all in Drupal 10.

- Also, you don't have many hooks, but there are 2 service parameters that can tell Drupal 11 to stop procedural hook scan and these are purely optional: Improve performance by preventing unnecessary scanning of procedural hooks and hooks_converted parameter and StopProceduralHookScan attributes have been renamed.. Example if you wish to add them:

parameters:
  # For Drupal 11.1 and lower.
  MODULENAME.hooks_converted: true
  # For Drupal 11.2 and higher.
  MODULENAME.skip_procedural_hook_scan: true

- The error message passed to the addError method is not translatable in src/Hook/ParagroupHooks.php line 128.

- The create method should return new static() instead of new self() in src/Form/ParagroupConfigForm.php

- src/Hook/ParagroupHooks.php: The $helper and $field_group_manager arguments are missing their type causing the autowire service to fail. Also, the @var \Drupal\paragraph_group\Paragroup\ParagroupHelper class doesn't seem to exist anymore (line 31).

- The validateForm is a method that returns void. In the src/Form/ParagroupConfigForm.php returning a void function result is incorrect.

- There is no entity type that has the paragraph_type ID: $this->entityTypeManager->getStorage('paragraph_type')->loadMultiple(); in src/Paragroup/ParagroupFormData.php

Actually, in its current state, the module throws fatal errors in both Drupal 10 and 11, it is unusable. Please ensure that the module is running smoothly with Drupal Core ^10.2 || 11 as described in the info file, and carefully test every aspect of it and/or provide tests to ensure quality and stability.

I am changing priority as per Issue priorities.

src/Form/ParagroupConfigForm.php

Since the class is doing more than showing a setting form and saving the submitted values, its parent class should not be ConfigFormBase.

    $fwf_title =
      'Full Width Forms (highly recommended)';

    $fwf_desc =
      'Claro and Gin themes currently show edit forms within a central ' .
      'text section on all devices. To ensure optimal compatibility with ' .
      'Paragraphs and Field Groups, it is highly recommended to disable ' .
      'this, by checking this option in order to utilize the empty screen ' .
      'space.';

    $full_width_forms = [
      'option' => ['data' => $fwf_title, 'class' => 'name-field'],
      'desc' => ['data' => $fwf_desc],
    ];

    $sc_title =
      'Move page configuration sidebar to bottom of edit pages ' .
      '(for Claro theme only; requires Full Width Forms)';

    $sc_desc =
      'On edit pages, the Claro theme has a configuration ' .
      'sidebar on the right of screen. If your website utilizes ' .
      'large sets of highly nested paragraphs, then you might ' .
      'also like to move this sidebar to the bottom of the screen, ' .
      'in addition to the above option, by clicking this option ' .
      'in order to fully maximise the horizontal screen space available ' .
      'for your nested paragraphs.';

Strings visible in the user interface need to be translatable.

src/Paragroup/ParagroupFieldGroupManager.php

/**
 * Creates, deletes and manages Field Groups for content type forms.
 *
 * @package Drupal\paragraph_group\Paragroup
 *
 * Creates, deletes and manages Field Groups
 */

The long description is added when it says something the short description did not say; it also follow the short description, which means it comes before any documentation tag.

  /**
   * The entity type manager.
   *
   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
   */
  protected $entityTypeManager;

  /**
   * The field type plugin manager.
   *
   * @var \Drupal\Core\Field\FieldTypePluginManagerInterface
   */
  protected $fieldTypeManager;

  /**
   * The field manager service.
   *
   * @var \Drupal\paragraph_group\Paragroup\ParagroupFieldManager
   */
  protected $fieldManager;

  public function __construct(
    EntityTypeManagerInterface $entity_type_manager,
    FieldTypePluginManagerInterface $field_type_manager,
    ParagroupFieldManager $field_manager,
  ) {

    $this->entityTypeManager = $entity_type_manager;
    $this->fieldTypeManager = $field_type_manager;
    $this->fieldManager = $field_manager;

  }

New modules, which are compatible with Drupal 10 and higher versions are expected to include type declarations in property definitions, and use property promotion.

I am changing priority as per Issue priorities.

Thank you for your contribution and for your patience with the review process!

I am going to update your account so you can opt into security advisory coverage any project you create, including the projects you already created.

These are some recommended readings to help you with maintainership:

• Dries' post on Responsible maintainers
• Maintainership
• Git version control system
• Issue procedures and etiquette
• Maintaining and responding to issues for a project
• Release naming conventions.

You can find more contributors chatting on Slack or IRC in #drupal-contribute. So, come hang out and stay involved!
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank also all the reviewers for helping with these applications.