Gate Select All on unlocked projects and harden select-all JS

- Only render the Select All checkbox when the project is unlocked, matching
  Add a Story and the bulk-delete control (addresses the review question about
  the unlocked check). Add a spec that it is hidden on a locked project.
- Make updateSelectAllStatus null-safe so toggling a row checkbox on a locked
  project (where Select All is absent) no longer throws.
- Clean up the extracted updateBulkDeleteStatus indentation and file newline.
- De-flake the madmin projects spec via CGI.escapeHTML (same fix as PR #333).

Author: JuanVqz

app/assets/javascripts/project.js

@@ -4,12 +4,10 @@ document.addEventListener("turbolinks:load", function () {
     updateSelectAllStatus();
   });
 
-
   $(".import-export-header").click(function () {
     $(this).children(".rotate").toggleClass("left");
   });
 
-
   $("#select_all").click((event) => {
     let checked = event.target.checked;
 
@@ -117,37 +115,44 @@ function toggleCloneSubProjects(value) {
 
 function updateBulkDeleteStatus() {
   const selected = $("input[name='stories[]']:checked");
-    const is_unlocked = $("#stories").data("unlocked");
-    if (!is_unlocked) {
-      return;
-    }
+  const is_unlocked = $("#stories").data("unlocked");
+  if (!is_unlocked) {
+    return;
+  }
 
-    if (selected.length > 0) {
-      const ending = selected.length == 1 ? "y" : "ies";
-      $("#bulk_delete")
-        .text(`Bulk Delete (${selected.length} Stor${ending})`)
-        .attr("aria-disabled", "false")
-        .prop("disabled", false);
-    } else {
-      $("#bulk_delete")
-        .text("Bulk Delete")
-        .attr("aria-disabled", "true")
-        .prop("disabled", true);
-    }
+  if (selected.length > 0) {
+    const ending = selected.length == 1 ? "y" : "ies";
+    $("#bulk_delete")
+      .text(`Bulk Delete (${selected.length} Stor${ending})`)
+      .attr("aria-disabled", "false")
+      .prop("disabled", false);
+  } else {
+    $("#bulk_delete")
+      .text("Bulk Delete")
+      .attr("aria-disabled", "true")
+      .prop("disabled", true);
+  }
 }
 
 function updateSelectAllStatus() {
+  const selectAll = $("#select_all")[0];
+  // Select All is only rendered for unlocked projects, so there is nothing to
+  // sync when it is absent.
+  if (!selectAll) {
+    return;
+  }
+
   const selected = $("input[name='stories[]']:checked");
   const checkboxes = $("input[name='stories[]']");
 
   if (selected.length == 0) {
-    $("#select_all")[0].checked = false;
-    $("#select_all")[0].indeterminate = false;
+    selectAll.checked = false;
+    selectAll.indeterminate = false;
   } else if (selected.length == checkboxes.length) {
-    $("#select_all")[0].checked = true;
-    $("#select_all")[0].indeterminate = false;
+    selectAll.checked = true;
+    selectAll.indeterminate = false;
   } else {
-    $("#select_all")[0].checked = false;
-    $("#select_all")[0].indeterminate = true;
+    selectAll.checked = false;
+    selectAll.indeterminate = true;
   }
-}
+}

app/views/projects/show.html.erb

@@ -18,10 +18,12 @@
             <th class="project-table__cell">Best<br />Estimate</th>
             <th class="project-table__cell">Worst<br />Estimate</th>
             <th class="project-table__cell story_actions">
-              <div>
-                <input type="checkbox" name="select_all" id="select_all">
-                <label for="select_all">Select All</label>
-              </div>
+              <% if is_unlocked?(@project) %>
+                <div>
+                  <input type="checkbox" name="select_all" id="select_all">
+                  <label for="select_all">Select All</label>
+                </div>
+              <% end %>
               <%= link_unless_archived(@project, "Add a Story", new_project_story_path(@project), classes: "green") if is_unlocked?(@project) %>
               <button id="bulk_delete" class="button magenta" aria-disabled="true" disabled>Bulk Delete</button>
             </th>

spec/features/stories_manage_spec.rb

@@ -123,6 +123,15 @@
     expect(page).to have_unchecked_field(name: "stories[]")
   end
 
+  it "does not show Select All on a locked project" do
+    locked_project = FactoryBot.create(:project, :locked)
+    FactoryBot.create(:story, project: locked_project)
+
+    visit project_path(id: locked_project.id)
+
+    expect(page).to have_no_field("Select All")
+  end
+
   it "allows me to delete a story" do
     visit project_path(id: project.id)