We currently have a React app deployed at
`https://tps.autark.xyz/tps-auth` which does basically what this
Authenticator does. Here's how it works:

1. Projects opens an popup which loads the GitHub OAuth login page
2. We have [a GitHub OAuth App][1], where we provide an Authorization
   Callback URL. This is configured to that `tps.autark.xyz` page.
3. This Authorizor receives a `code` from GitHub, which it posts back to
   Projects using `opener.postMessage`
4. Projects uses this `code` to hit `https://tps.autark.xyz/authenticate`,
   which holds onto the private key for our GitHub OAuth App and can
   thus load an API `token` for the user, so Projects can start making
   requests as this user.

This commit seeks to optimize three aspects of the current approach:

1. Code visibility/maintainability: rather than having a deployed app
   with seemingly no corresponding GitHub repository, this adds this key
   piece of our infrastructure directly to our main `open-enterprise`
   repo. It also simplifies this Authenticator, using a simple html page
   rather than a complex React app.
2. Design: rather than a sans-serif "loading" message, this gives a
   simple visual while the user is logged in, with a subtle technical
   status
3. Security: loading this app at a URL we own provides no additional
   security. Why? Because any app, not just Projects, could open a
   GitHub OAuth page and provide our CLIENT_ID. GitHub would then
   redirect back to our Authenticator, regardless of where it lives, and
   Authenticator would blindly pass the `code` it received back to
   `opener`. From there, a malicious app can easily POST that code to
   our `https://tps.autark.xyz/authenticate` endpoint and receive a
   token for the user. And then that malicious app could read a user's
   private repos and post comments as them, and it would look like these
   GitHub actions were mediated by us.

Unfortunately, the solution in this commit fails to address this
security concern. It tries to read `opener.location.pathname` so that it
can check the identity of the calling app, before passing `code` back to
it, but calling `opener.location.pathname` is forbidden, because this
Authenticator lives at a different domain than Projects. Or rather,
Projects is served from the same IPFS gateway, BUT since it is rendered
within an iframe, the browser treats it as living at a different URL
than the page in the popup.

IPFS hash of this version: QmSYYEAFJiPyPd6JGtreu8tQZwEjARDxGZpSnTEvex8K4C

  [1]: https://github.com/organizations/AutarkLabs/settings/applications/953918

Since Authenticator is not allowed to read `opener.location.pathname`
directly, here's how this version works:

1. Projects opens a popup with the GitHub auth page
2. Our GitHub OAuth App is configured to redirect to the deployed
   Authenticator app (the index.html file here)
3. The Authenticator pings the `opener` (the Projects app)
4. Projects listens for this ping, and pings right back
5. Authenticator listens for pings from `opener`, and reads `origin`
   from these ping events.

This DOES NOT WORK for Aragon apps. It would work for apps that are not
loaded within an iframe, or for iframes that have [the
`allow-same-origin` property set in their `sandbox` attribute][1] (changing
this security setting is [not in the cards][2] for Aragon apps). But for
regular iframes such as any Aragon app, when they send `postMessage` to
the popup, the popup tries to read `message.origin`, and all it gets is
`"null"`.

IPFS hash for this version: QmaQFvQoGnWpsfLAumBJdSxV2zs9E6W5DPNB1fjg1QPxCu

  [1]: https://stackoverflow.com/questions/37838875/postmessage-from-a-sandboxed-iframe-to-the-main-window-origin-is-always-null
  [2]: https://github.com/aragon/aragon/blob/master/src/security/configuration.js#L22

This does not work, because the GitHub login page forbids being loaded
within an iframe using a [`frame-ancestors 'none'` Content Security Policy][1]

IPFS hash of this version: QmbC4CupvRo3JnducA8vdg9VmTMNCuUWs4eQiTACgLtxru

  [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors

This sends the `code` provided by GitHub to `window.opener`, no
questions asked.

IPFS hash of this version: QmNSdB6BpqbaYA6Vh38MBrUFJbrnjhsBRb8gq5o44ypoWu

Note that I've also added `useCallback` here to prevent needless
re-definition of `handleMessage` and associated removal & re-addition of
the event listener.

Moved to https://github.com/AutarkLabs/authenticator

The addition of the aragonUI Link caused all elements within the card to
inherit the `white-space: nowrap` rule, breaking the line wrapping

* using `PropTypes.node` fixes irrelevant error when passing an array of
  elements (which is valid)
* the `checked` property is *not* required

We need to work pretty hard to override some rules from the aragonUI
Link component, which were mostly intended for Button

Allocations/Budget Card: wrap title to two lines

Markdown formatting fixes

Create Authenticator app; update Projects

implement commit linting for conventional-commit rules

fix: single scrollbar on New Project panel

While previously configuring lerna to run in parallel, it was introduced
a regression that make test script fails because sharing devchain data,
it was fixed by limiting concurrency to single thread

This change allows for easier E2E testing of the project app. While it
is a less robust verification, the impact of a potential exploit
(intercepting a read-only github token request) is negligible

- update s to ms
- pass timeout value into an object so it is parsed correctly

- update tests to work with most recent app updates
- create test-user token with a testrepo for use with projects

This fixes all problems reported by a11y react-axe caused by our own
code. Included:
 * aria-labels and labels added to input components,
 * used DateInput from shared/ui location instead of Project's own
   (which got finally removed),
 * cosmetic changes required for labels to be correctly passed to final
   input (HTML input elements) via chain of react components,
 * added landmarks.

fix: dot voting default decimals value changed from 0 to 18

Rewards: Removed token name wrap

chore: create basic E2E tests for all apps

DV a11y fixes

Improved a11y in Projects

This allows for the breaking change `!` token in the commit headers

chore(linting): bump commitlint to v8.3

Moved the double check icon from Rewards to a shared location; updated the import from Rewards and tested it; replaced the check icon with the double check icon in Allocations; added status colors; discovered a bug whereby only Allocations with enacted status show up in Allocations History, created ticket #1852 to track it.

* Following @chadoh's suggestion, I transformed the double check icon
into a component, so that it can be imported in much the same way
other icons are imported from AragonUI.

* I also updated the way we represent the status of each allocation in
Allocations History. Now, instead of numbers, a more explanatory
string constant is used.

feat: informative dot votes

Soon, we will get rid of Issues from the Tabs bar, and when you tap on a
project from Overview, you will see a ProjectDetail view. This
ProjectDetail view will be very similar to the current Issues component,
but will show a back button & filter bar instead of the tabs, and may
have different header text.

Rather than adding more edge-case logic to App.js, I simplified it,
moving this logic to the Content components. Here's what changed:

* rm Header and Tabs from App.js, add to Content components
* extract Tabs logic to own component, easy to use anywhere
* relocate which-Content-to-show logic to Routes component
* clean up props passed to Content components – Issues saw the biggest
  cleanup. Some of the props declared in its propTypes were vestigial,
  and many that were passed from App.js could be looked up in the
  component itself.

While testing this, I discovered a bug, triggered by these steps:

1. add a project
2. visit `/issues`
3. refresh the page
4. cached data loads initially
5. aragonAPI replays info from the blockchain, since current data is not
   more than 100 blocks old and nothing is cached in its `store`
6. data gets reset, so `repos` becomes empty
7. we construct a nonsense GraphQL query for an empty set of repos

The fix for this required one line, so I included it here.

Allocations: use double check icon and add status colors

Native Projects: General tab

We want to use this in Projects, too

Stop using usePathSegments, favoring usePathHelpers instead

The truffle hd wallet provider in the Standard Bounties subrepo is only
needed for use on the ropsten testnet. Since we aren't deploying
anything to Ropsten currently, I'm removing it since it's currently
crashing truffle during test deploys

Projects: refactor routing with usePathHelpers

Rather than having an Issues tab at the top that, when visited, shows
all issues for all projects, you can now only see issues for one project
at a time.

This has a few benefits:

* A simpler filtering experience: three filters instead of four.
* Less wasted vertical space: the filter bar now contains a back button,
  and there's no need to show tabs. Your list of issues displays closer
  to the top of the page.
* Code maintainability: expect faster changes to projects, now that we
  were able to simplify the complex logic resulting from multi-project
  filtering

Since we currently render many (100+) Issue cards in this list, we want
to make sure each one renders as quickly as possible. One way we can do
this is to reduce the number of hooks this component calls.

This makes it so the `usePathHelpers` hook is processed once, rather
than 100+ times.

fix: add metadata to new vote

fix(dot-voting): smooth transition for side panel

test(bounties): remove unnecessary wallet dependency

Disabled react-axe

Projects: remake issues tab as project detail

feat: dark mode

In addition to viewing all issues for a project, this allows you to view
all bounties that exist for all projects in an organization

Co-authored-by: Chad Ostrowski <[email protected]>

fix: projects card bounties description and deadline

feat: bounties tab

If you get to the IssueDetail page from the Bounties tab, clicking
"Back" will now send you back to it, rather than to ProjectDetail

If you visit an IssueDetail page directly, or refresh your browser on an
IssueDetail page, clicking "Back" will still send you to ProjectDetail

This has been added in a way that will be easy to use in other places
around Autark apps

feat(projects): add proper "Back" to IssueDetail

Bounties created before Nov 26 will not have their `issueId` stored in
IPFS and can therefore not be shown on the new Bounties tab

For DAOs that have such bounties, our old logic caused _no_ bounties to
be shown on the Bounties tab. This will allow newer bounties for such
DAOs to be shown, while gracefully ignoring older bounties

fix(projects): ignore bounties made before Nov 26

fix(projects): use main component with emptywrapper

* import `ApolloProvider` from `@apollo/react-hooks` so we don't need to
  re-define `client` in ProjectDetail
* use `fetchMore` returned from `useQuery` call instead of manually
  fetching more
* show "loading" animation below current results – much smoother loading
  of more items!
* fetch 25 issues at a time, instead of 100 – makes whole experience
  much faster

This last one currently makes filtering even more dorky, until we
start modifying the query instead of doing filtering locally

Note that GitHub does not allow sorting by "Name". GitHub's sort
options:

* CREATED_AT
* UPDATED_AT
* COMMENTS (sorts by comment count)

I changed the drop-down to only show the first two

This will allow us to support free-form queries when the user types in
the search field. Paging issues within a `repository` lookup does not.

Note that this method of searching does not allow sorting by creation
date: https://help.github.com/en/github/searching-for-information-on-github/sorting-search-results

After playing around with the available sorting options, I thought
"updated" seemed the only useful one, in the context of the Projects
app. I couldn't figure out what "author-date" was actually sorting on,
but it doesn't seem to be the creation date of the issue.

fix(tests): fix tests failing because running in parallel

Switch these to use hooks so that they work with the ApolloProvider from
'@apollo/react-hooks'

This also fixes an issue where these bountyIssues were not restricted to
only those for the selected project

bountyIssues only live locally. As more logic moves to the GitHub query,
we want to make sure we keep around logic that allows us to provide a
good experience when filtering for issues by bounty status.

This adds back local sorting, but it only gets used when filtering for
bounty status. It also cleans up filtering logic to make it work for the
new desired paradigm.

prevents invalid allocations periods from being accepted by the recovery
script

fix(recovery script): error on invalid allocations period length

fix:  Very small dot-voting participation rounded

fix: change radspec for newVote

UI for native projects in NewProject panel