Add V2 Support menu with Latest Features and Send Feedback pages

[Paul Lizer (paullizer)]

Summary

• Admins could already configure the Support menu in Admin Settings. V2 users, however, only had a rail link that dropped them into the classic Latest Features page, and no way to send feedback at all. V2 now has its own Support menu: a collapsible rail group, under the menu name the admin chose, with Latest Features and Send Feedback.
• Latest Features (/v2/support/latest-features) lists only the announcements admins shared.
  • It has a search box. The current release starts open and older releases start collapsed.
  • Each announcement opens in place to show details, steps, screenshots and shortcuts.
  • Shortcuts open the matching V2 page when one exists. Otherwise they open the classic page, or the docs in a new tab.
• Send Feedback (/v2/support/send-feedback) is one form with a Bug Report / Feature Request choice.
  • Name and email are prefilled, and missing fields are flagged before anything is posted.
  • It uses the existing /api/support/send_feedback_email and opens the same email draft as the classic page.
• Admin configuration is unchanged: the same settings drive both interfaces. Two user choices are shared with the classic UI: whether the group is open, and hiding Latest Features until the next release.

Notes for reviewers

• New endpoint GET /api/v2/support/latest-features on the backend_v2 blueprint.
  • Decorators: swagger_route, login_required, user_required and enabled_required("enable_support_menu").
  • It re-checks for the Admin or User role, as the classic route does, and returns 404 when the Latest Features destination is off.
  • build_user_latest_features_payload reuses the admin payload's serializer, so both apply the same URL rules.
  • _latest_feature_endpoint_url moved to module scope and is shared by the admin and user routes.
• Bootstrap gains navigation.send_feedback. available requires an app role, the menu, the destination, and a recipient containing @. The recipient address is not sent; the browser only learns it from the submission reply, as on the classic page.
• Shortcut translation lives in lib/latestFeatureShortcuts.ts.
  • Router targets come only from a constant allowlist, so catalogue data can never become an absolute router target. This keeps the V2: Left sidebar navigation links open the classic UI instead of V2 pages #1698 fix intact.
  • Classic and external links go through safeLatestFeatureHref.
  • A test checks that every shortcut in the real catalogue can be followed from V2.
• LatestFeaturesLink.tsx is replaced by SupportMenu.tsx.
  • A code review caught a bug here. If loading preferences failed, toggling the group would post a sidebarMenuState holding only support. The server merges top-level keys only, so that would wipe the user's other menu states.
  • In that case the toggle now stays local.
  • NavExtras.tsx has the same gap from before this PR; it is not changed here.

Screenshots

Synthetic data from the Playwright fixture.

Linked issue

N/A (no tracking issue for this change)

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

The version is now 0.261.296. The base moved to 0.261.295 while this was in progress, so the branch merges the base and renumbers this feature's version references from 0.261.294 to 0.261.296. config.py was the only merge conflict.

Testing / validation

All commands below were re-run after merging the base and renumbering, on head ba419cb04.

• npm --prefix .\application\v2_ui run build (tsc -b && vite build): passed
• python -m pytest -q -p no:warnings functional_tests\test_v2_support_menu.py functional_tests\test_v2_bootstrap_branding_and_navigation.py functional_tests\test_v2_user_settings_tutorials_latest_features.py functional_tests\test_v2_admin_latest_features_api.py functional_tests\test_v2_admin_help_logic.py functional_tests\test_v2_admin_help_parity.py functional_tests\test_v2_admin_help_settings_normalization.py functional_tests\test_support_menu_user_feature.py functional_tests\test_support_menu_blueprint_endpoints.py functional_tests\test_support_app_title_personalization.py functional_tests\test_latest_features_action_links.py functional_tests\test_latest_feature_action_targets.py functional_tests\test_latest_features_release_group_integrity.py functional_tests\test_latest_features_nav_hide_preference.py: 73 passed. This includes the 27 TypeScript checks in test_v2_support_menu_logic.ts.
• python -m pytest -q -p no:warnings functional_tests\test_v2_sidebar_primary_nav_stays_in_v2.py functional_tests\test_v2_sidebar_account_menu.py functional_tests\test_v2_sidebar_conversation_scroll.py functional_tests\test_v2_settings_tabs.py functional_tests\test_v2_user_settings_layout.py functional_tests\test_v2_api_payload_shapes.py functional_tests\test_v2_ui_local_assets.py functional_tests\test_xss_guardrails_checker.py functional_tests\test_docs_app_surface_coverage.py functional_tests\test_docs_site_quality.py: 68 passed
• python -m pytest -q functional_tests\route_tests\test_route_blueprint_policy_inventory.py functional_tests\route_tests\test_route_unauthenticated_policy_contract.py functional_tests\route_tests\test_route_policy_test_coverage.py: 22 passed
• python -m pytest -q -p no:warnings ui_tests\test_v2_support_menu.py ui_tests\test_v2_admin_help_settings.py: 19 passed. These use local Chromium against the built SPA, with the API stubbed. They cover:
  • shared rail state, including a failed preferences load;
  • hiding Latest Features;
  • search, details and in-app shortcuts;
  • the unavailable, failed and retry states;
  • feedback validation and the prepared draft;
  • phone layout.
• XSS sink check, passed for 16 files:

  $changed = git diff --name-only --diff-filter=AM origin/paullizer-react-v2-ui HEAD -- application/ | Where-Object { $_ -match '\.(py|ts|tsx|js|html)$' }
  python scripts\check_xss_sinks.py --full-file @changed

• python scripts\check_broken_access_control.py --full-file application/single_app/route_backend_v2.py application/single_app/functions_support_latest_features.py: passed
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check origin/paullizer-react-v2-ui HEAD: clean
• Manual checks:
  • Reviewed desktop, phone, dark-theme and collapsed-rail renders. The Impeccable design detector reported no findings.
  • Mutation check: disabling the failed-load guard makes test_menu_state_is_not_saved_when_preferences_failed_to_load fail.
• Known failures from before this PR, not caused by it:
  • ui_tests\test_v2_sidebar_conversation_scroll.py::test_the_phone_drawer_holds_search_under_new_chat is flaky on the original base commit. It failed 2 of 4 runs on a clean worktree of 49a52bb5c.
  • functional_tests\test_logging_tag_standardization.py fails on the base because of non-standard tags in unrelated files. The new [SUPPORT_LATEST_FEATURES] tag is documented in docs/reference/logging-tags.md.
  • functional_tests\test_docs_link_integrity.py reports broken links in unrelated docs.

Documentation

• Release notes updated, or not needed: no entry for 0.261.296 in this PR.
• Feature documentation updated, or not needed:
  • docs/explanation/features/V2_SUPPORT_MENU.md (new) and V2_USER_SETTINGS_REDESIGN.md
  • User guides: docs/guides/browse-latest-features.md (new) and send-feedback.md
  • docs/admin/help.md
• Fix documentation updated, or not needed: not needed, since this is a new feature.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user(). No settings values are sent: the new endpoint returns release copy and links, and the bootstrap entry carries only available, url and menu_name.
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included. Build output, screenshots and harness bundles are git-ignored.