Skip to content

Fix hidden sole-child listing attributes leaking on public ticket pages - #1708

Merged
stefan-burke merged 1 commit into
mainfrom
fix/hidden-sole-child-attribute-leak
Jul 10, 2026
Merged

Fix hidden sole-child listing attributes leaking on public ticket pages#1708
stefan-burke merged 1 commit into
mainfrom
fix/hidden-sole-child-attribute-leak

Conversation

@stefan-burke

@stefan-burke stefan-burke commented Jul 10, 2026

Copy link
Copy Markdown
Member

What changed

A hidden add-on that is the sole bookable child of a parent listing was leaking its selected attribute names and option text onto the public ticket page.

renderSoleChildOption already suppressed the child name and price label when the child was hidden (the visible ? … : "" gate), but the newly added attributesHtml block was appended unconditionally after the suppressed label. So a hidden child kept its data markers and pay-more price input (which the booking fold and the compatibility scripts still need) but also published its attribute labels to buyers — breaking the "a hidden child shows nothing identifying" contract.

This gates attributesHtml on the same visible flag, so hidden sole children show nothing identifying while still keeping the functional markers the scripts depend on.

Why

This slipped through #1683 (merged as 09e63164): the thread that introduced attribute rendering on sole-child add-on options did not account for the hidden-child branch. A follow-up review comment flagged it after merge.

What this means for users

A hidden add-on with selected listing attributes no longer exposes those attributes on the parent ticket page. Visitors see exactly what the operator intended to hide. No booking, pricing, or capacity behaviour changes.

Checks

  • deno task precommit (typecheck, lint, jscpd, full test suite)
  • Regression tests in test/lib/server-parents-gate/render-selector.test.ts:
    • "a sole bookable child shows its selected attributes" (positive — fixes must not suppress attributes for visible children)
    • "a sole hidden child does not leak its attributes" (the bug — fails before the fix, passes after)

Summary by CodeRabbit

  • Bug Fixes
    • Fixed public reservation pages so hidden sole-child listings no longer display their selected attributes or options.
    • Visible auto-selected sole-child listings continue to show the appropriate attribute details.

renderSoleChildOption appended attributesHtml unconditionally after the
suppressed label, so a hidden sole add-on leaked its attribute names and
option text to the public ticket page. Gate it on the same `visible` flag
that already suppresses the name and price — hidden children keep their
data markers and pay-more price input (the fold/compat scripts need them)
but show nothing identifying, matching the existing hidden-child contract.

Regression tests in render-selector.test.ts: a visible sole child shows
its attributes (positive) and a hidden sole child does not leak them.
@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1e4d4e10-9acc-4c99-9a10-2f9cafa175cf

📥 Commits

Reviewing files that changed from the base of the PR and between a631da6 and c9147da.

📒 Files selected for processing (2)
  • src/ui/templates/public/reservations.tsx
  • test/lib/server-parents-gate/render-selector.test.ts

📝 Walkthrough

Walkthrough

Sole-child booking options now render selected attributes only when the child listing is visible. Tests cover attribute display for visible children and attribute suppression for hidden children while preserving functional markers and pricing inputs.

Changes

Sole child visibility

Layer / File(s) Summary
Conditional attribute rendering and coverage
src/ui/templates/public/reservations.tsx, test/lib/server-parents-gate/render-selector.test.ts
renderSoleChildOption omits attributes for hidden children, while tests verify visible attribute rendering and hidden-child suppression with retained DOM markers and pay-more pricing input.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: preventing hidden sole-child listing attributes from appearing on public ticket pages.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/hidden-sole-child-attribute-leak

Comment @coderabbitai help to get the list of available commands.

@stefan-burke
stefan-burke enabled auto-merge July 10, 2026 13:50
@stefan-burke
stefan-burke added this pull request to the merge queue Jul 10, 2026
Merged via the queue into main with commit edbcb79 Jul 10, 2026
3 checks passed
@stefan-burke
stefan-burke deleted the fix/hidden-sole-child-attribute-leak branch July 10, 2026 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant