No page can create a usage or a connection, and several backends and components are reached by nothing

[rubenvdlinde]

What goes wrong

A set of backends and front-end components in stackiq have no page, button or import that reaches them. Two of them block real work: there is no page to create a usage, and a contract cannot be saved without one. The rest are code that is built and maintained but that no user of this app can trigger. This issue lists them in one place so each can be wired up, handed to its real consumer, or removed.

Evidence, re-read at c9760e0

Schemas with no page:

• src/manifest.json has pages for bioMeasure, catalogContract, catalogService, compliancy, contactPerson, element, module, moduleVersion, organization, software-review, suite and vulnerability. None for usage or connection, although both schemas exist in lib/Settings/softwarecatalogus_register.json. src/modals/Modals.vue:38,40 accept usage and connection as generic modal types, but nothing opens them.
• catalogContract.required is service, usage, startDate, contractNumber, contractType, status, so no stackiq page can create the usage a new contract needs.

Components never mounted or imported:

• src/views/settings/Settings.vue (689 lines) is imported by nothing.
• StackiqSettings.vue is registered as the custom component StackiqSettingsPage (src/customComponents.js:33,59) and as SoftwareCatalogSettingsPage (src/registry.js:25), but no manifest page names either. The same file is mounted as the Nextcloud admin settings page (src/settings.js, #stackiq-settings), which is how the moderation queue (ModerationQueue.vue) and EOL sync (EolSyncSettings.vue) are reached through src/utils/adminApi.js. Only the in-app registration is dead.
• src/store/modules/view.js (the only caller of /api/views, :89 and :128) is imported by nothing; useViewStore has no importer.
• src/utils/openDataProjection.js (STRIPPED_FIELDS, :36) is imported by nothing.
• src/modals/object/ViewObject.vue is mounted only for modals viewOrganisatie and viewContactpersoon (Modals.vue:7,19), and nothing in src/ sets either. Its publish buttons (:4854) and the mass-publish dialog it opens (:4865) are therefore unreachable. The mass-lock dialog (src/dialogs/Dialogs.vue:12) has no opener anywhere.

API routes with no caller in src/ (route prefixes from appinfo/routes.php, searched across src/): aanbod (:202-204), aangeboden-gebruik (:255-261), koppelingen-gebruik (:269), gebruik (:298-299), intake (:214), preferences (:29-30), dashboard (:26), setup (:22-24), publication publish and depublish (:208-209), progress (:119-120), views including views/docs (:185-187).

Who could consume them (judgement, not verified)

The external VNG Softwarecatalogus frontend is not in this repo, so this split is an informed guess from naming, auth posture and docblocks:

• Plausibly the external VNG frontend: aanbod, aangeboden-gebruik, koppelingen-gebruik and gebruik (the Dutch-named offering and usage APIs, several declared @PublicPage with anonymous rate limits), intake (an anonymous, write-only organisation registration endpoint that has no form in stackiq), and views (GEMMA views enriched with usage, close to the public ArchiMate API of VNG requirement issues.md:306, though the route is login-only).
• Plausibly the shared @conduction/nextcloud-vue library at runtime rather than src/: setup (the manifest's top-level setup block drives the library setup wizard) and preferences (routes.php:28 says it is used by library widgets such as CnSupportDialog). A live check should confirm these.
• No consumer at all found: dashboard (DashboardController::index returns an empty result), progress (the ArchiMate import never writes to it, see Cancelling an ArchiMate import crashes, and the import never reports progress #1076, and nothing polls it for SBOM or merge), views/docs and aangeboden-gebruik/docs (hand-written docs, see The generated openapi.json describes no endpoints #1085), publication publish and depublish (a supplier publishes by setting publicationDate in the form instead), plus every component listed above.

Why it matters

Users cannot record which software their organisation uses or start a contract from stackiq, and the unreached code carries its own security and maintenance cost (the publication endpoint has an IDOR guard, the intake endpoint is anonymous) without delivering anything in this app.

Surfaced by the capability matrix in stackiq#1072 (merge 38b9938), rows land-usage-record (pending), conn-list-page, conn-register-connection, land-bulk-edit, arch-gemma-views, ins-progress and the publication rows. Related: #478 (two other dead page components).

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue