Admin-created custom links never render anywhere in the app

[compwron]

Summary

A CASA admin can create a "custom link" (Settings → Custom links), and it saves fine — but the link never appears anywhere in the app, for admins, supervisors, or volunteers. The only place the link text/URL is ever rendered is the admin settings table you created it in.

Steps to reproduce

1. Sign in as a CASA admin.
2. Go to Settings (/casa_org/:id/edit) → Custom links → add a link (text + URL, active = yes).
3. The link shows in the settings table. Navigate anywhere else in the app, as admin, supervisor, or volunteer — the link is nowhere in the nav/sidebar or any page.

Expected

Active custom org links show in the left nav for users of that organization, as originally shipped in #6298 ("Add Custom Admin-Defined Navbar Links").

Root cause (from the code)

The feature was implemented in a1c76ff (#6298). Its only display surface was the Bootstrap sidebar partial:

<%# app/views/layouts/_sidebar.html.erb (as of a1c76ff3a) %>
<% if current_organization.custom_org_links.any?(&:active) %>
  <hr>
  <% current_organization.custom_org_links.select(&:active).each do |custom_link| %>
    <%= render(Sidebar::LinkComponent.new(title: custom_link.text, icon: "link", path: custom_link.url)) %>
  <% end %>
<% end %>

The Tailwind redesign (ad9c149, #7051) deleted app/views/layouts/_sidebar.html.erb, Sidebar::LinkComponent, and spec/views/layouts/sidebar.html.erb_spec.rb, and replaced them with the inline nav in app/views/layouts/casa_app.html.erb. That new nav is built from a hard-coded nav_groups array (Overview / Records / Activity / Reporting + pinned Settings) and never reads current_organization.custom_org_links — so the render was dropped, with no replacement.

Confirming grep: the only non-admin-CRUD references to custom_org_link left in app/ are the model, the policy, CustomOrgLinksController, CasaOrgController#set_custom_org_links, and the settings views (app/views/casa_org/_custom_org_links.html.erb, app/views/custom_org_links/_form.html.erb). Nothing in app/views/layouts/, components, helpers, or decorators renders them.

Suggested fix

Re-add the active-links block to the nav in app/views/layouts/casa_app.html.erb (e.g. as its own group after "Reporting", or above the pinned Settings item), styled with the Tailwind layouts/_nav_link partial, and add a view/system spec so this can't silently regress again. External URLs should probably get target="_blank" + rel="noopener" and an external-link affordance, since they leave the app.

Related smaller issue spotted nearby

CustomOrgLinksController#set_custom_org_link does CustomOrgLink.find(params[:id]) with no org scoping (app/controllers/custom_org_links_controller.rb:46). authorize runs after, and CustomOrgLinkPolicy defines only a Scope (no predicate overrides), so it falls back to ApplicationPolicy defaults — worth double-checking that an admin of org A can't edit/destroy an org B link. Happy to split this out if you'd rather track it separately.

[augustocbx]

Could I be assigned to this one? I have the nav render working with a system spec covering volunteer, supervisor and admin, and I also looked into the unscoped CustomOrgLink.find you spotted — it is reproducible, so I included that fix too. Happy to split it into its own PR if you prefer to track it separately.