Two regressions surfaced by a fresh production install:
- formAJAX's "loading" indicator passed a raw <div class="spinner-border">
string to app.messages.action, which HTML-escapes its message by design
(@simpleworkjs/frontend) -- so every form submit briefly showed the
literal markup as text instead of a spinner. Replaced with plain text
("Saving…"), which needs no escaping workaround.
- POST /api/user/ (create) and PUT /api/user/password didn't include a
`message` field, so the success toast/banner rendered with an empty
body -- a green notification with nothing in it right after adding a
user. Added messages matching the convention already used by every
other route in this file (activate/deactivate, group membership, etc).
Verified live: created a user through the actual modal, confirmed the
POST response now carries a message, and confirmed app.messages.toast
renders plain text cleanly with no escaping artifacts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
wmantly
3a46680c8b