Merge branch 'main' into mobile-app/scoped-stylesheets

* main:
  Use decimals for ordered lists
  Update cached fragments
  Revert "Merge pull request #1865 from basecamp/public-avatar-caching"
  Show only public cards on public boards
  Swap order of avatar links
  Limit length of full name during signup
  Make layout bulletproof
  Serve own avatar from its own endpoint

app/assets/stylesheets/web/rich-text-content.css

@@ -29,10 +29,17 @@
     }
 
     ol, ul {
-      list-style: disc;
       padding-inline-start: 3ch;
     }
 
+    ol {
+      list-style: decimal;
+    }
+
+    ul {
+      list-style: disc;
+    }
+
     li:has(li) {
       list-style: none;
 

app/controllers/public/base_controller.rb

@@ -11,7 +11,7 @@ class Public::BaseController < ApplicationController
     end
 
     def set_card
-      @card = @board.cards.find_by!(number: params[:id]) if params[:board_id] && params[:id]
+      @card = @board.cards.published.find_by!(number: params[:id]) if params[:board_id] && params[:id]
     end
 
     def set_public_cache_expiration

app/models/signup.rb

@@ -8,6 +8,7 @@ class Signup
 
   validates :email_address, format: { with: URI::MailTo::EMAIL_REGEXP }, on: :identity_creation
   validates :full_name, :identity, presence: true, on: :completion
+  validates :full_name, length: { maximum: 240 }
 
   def initialize(...)
     super

app/views/cards/comments/_comment.html.erb

@@ -1,4 +1,5 @@
 <% cache comment do %>
+  <%# Helper Dependency Updated: avatar_image_tag 2025-12-15 %>
   <%= turbo_frame_tag comment, :container do %>
     <%# Cache bump 2025-12-14: action text attachment rendering changed for lightbox -%>
     <div id="<%= dom_id(comment) %>" data-creator-id="<%= comment.creator_id %>"  class="comment flex align-start full-width <%= "comment--system" if comment.creator.system? %>">

app/views/events/_event.html.erb

@@ -1,4 +1,5 @@
 <% cache event do %>
+  <%# Helper Dependency Updated: avatar_image_tag 2025-12-15 %>
   <% if lookup_context.exists?("events/event/eventable/_#{event.action}") %>
     <%= render "events/event/eventable/#{event.action}", event: event %>
   <% else %>

app/views/notifications/_notification.html.erb

@@ -1,4 +1,5 @@
 <% cache notification do %>
+  <%# Helper Dependency Updated: avatar_image_tag 2025-12-15 %>
   <%= notification_tag notification do %>
     <%= render "notifications/notification/header", notification: notification do %>
       <%= notification_toggle_read_button(notification, url: card_reading_path(notification.card)) %>

app/views/signups/completions/new.html.erb

@@ -4,7 +4,7 @@
   <h1 class="txt-x-large font-weight-black margin-block-end"><%= @page_title %></h1>
 
   <%= form_with model: @signup, url: signup_completion_path, scope: "signup", class: "flex flex-column gap", data: { controller: "form" } do |form| %>
-    <%= form.text_field :full_name, class: "input txt-large", autocomplete: "name", placeholder: "Enter your full name…", autofocus: true, required: true %>
+    <%= form.text_field :full_name, class: "input txt-large", autocomplete: "name", placeholder: "Enter your full name…", autofocus: true, required: true, maxlength: 240 %>
 
     <p>You're one step away. Just enter your name to get your own Fizzy account.</p>
 

test/controllers/public/cards_controller_test.rb

@@ -18,4 +18,10 @@ class Public::CardsControllerTest < ActionDispatch::IntegrationTest
     get public_board_card_path(@board.publication.key, @card)
     assert_response :not_found
   end
+
+  test "not found if the card is drafted" do
+    @card.update!(status: :drafted)
+    get public_board_card_path(@board.publication.key, @card)
+    assert_response :not_found
+  end
 end

test/models/signup_test.rb

@@ -72,4 +72,17 @@ class SignupTest < ActiveSupport::TestCase
       assert_nil signup.user
     end
   end
+
+  test "#complete with name that is too long" do
+    Current.without_account do
+      signup = Signup.new(full_name: "A" * 241, identity: identities(:kevin))
+      signup.expects(:create_tenant).never
+
+      assert_not signup.complete
+
+      assert signup.errors[:full_name].any?
+      assert_nil signup.account
+      assert_nil signup.user
+    end
+  end
 end