#7201 show active custom org links in the left nav

[augustocbx]

What github issue is this PR for, if any?

Resolves #7201

What changed, and why?

Active custom org links show up in the left nav again.

Custom org links had exactly one display surface: app/views/layouts/_sidebar.html.erb. The Tailwind redesign (#7051, ad9c149) deleted that partial together with Sidebar::LinkComponent and replaced them with the inline nav in app/views/layouts/casa_app.html.erb, which is built from a hard-coded nav_groups array — so the render was dropped with no replacement and admin-created links stopped appearing anywhere outside the settings table they are created in.

nav_groups now ends with a Links group built from current_organization.custom_org_links.active, placed after Reporting and above the pinned Settings, rendered through the same layouts/_nav_link partial as every other nav item. The group needs no special hiding logic: the existing rule that drops a group with no visible items (visible_groups rejects empty groups) is what keeps an org with no active links from getting an orphan LINKS label. Links are visible to every role in the organization, which is what the original feature (#6298) shipped.

Custom links are always absolute http(s) URLs (UrlValidator requires a scheme and a host), so they always leave the app. _nav_link gained an optional external local that adds target="_blank" + rel="noopener", a trailing bi-box-arrow-up-right affordance, and an sr-only "(opens in a new tab)" — the icon is aria-hidden, so without the text nothing announces the new tab. The label is user-supplied (30 chars max), so it is truncated instead of being allowed to widen the 256px rail.

design.md (App shell → sidebar) documents the new group and the external-link variant, per the repo's design-system workflow.

The unscoped lookup flagged at the bottom of the issue.

Confirmed reproducible: CustomOrgLinksController#set_custom_org_link did CustomOrgLink.find(params[:id]) with no org scoping, and CustomOrgLinkPolicy defines only a Scope, so edit?/update?/destroy? fell through to ApplicationPolicy's is_admin? with no same_org? check. An admin of org A could edit and destroy org B's links — the new PUT request spec failed on main with the other org's link actually renamed. The lookup is now scoped to current_organization.custom_org_links, matching how the sibling settings controllers already do it (banners_controller.rb:67, mileage_rates_controller.rb:51, contact_type_groups_controller.rb:43), so a cross-org id is a 404.

Happy to split that second commit into its own PR if you would rather track it separately.

How is this tested? (please write rspec and jest tests!) 💖💪

New spec/system/layouts/custom_org_links_nav_spec.rb, for volunteer, supervisor and casa admin: the org's active link is in the main nav, it carries target="_blank" + rel="noopener", and inactive links and other orgs' links are not rendered — plus an org with no active links renders no Links group at all. All four examples per role fail on main.

spec/models/custom_org_link_spec.rb covers the new .active scope. spec/requests/custom_org_links_spec.rb adds an "admin of another organization" context to edit/update/destroy (404, record unchanged, count unchanged); those three examples fail without the controller change. The existing edit examples were using sign_in_as_admin plus an unrelated-org link — they now use the org-consistent casa_admin / volunteer lets the rest of the file already uses.

bundle exec rspec spec/system/layouts/custom_org_links_nav_spec.rb spec/models/custom_org_link_spec.rb spec/requests/custom_org_links_spec.rb
  43 examples, 0 failures

bundle exec rspec spec/system
  769 examples, 0 failures

bundle exec rspec spec/views spec/requests spec/models spec/policies
  2217 examples, 0 failures, 5 pending

bundle exec rspec spec/system/accessibility
  45 examples, 0 failures

bundle exec standardrb app/models/custom_org_link.rb app/controllers/custom_org_links_controller.rb spec/requests/custom_org_links_spec.rb spec/models/custom_org_link_spec.rb spec/system/layouts/custom_org_links_nav_spec.rb
  no offenses

bundle exec erb_lint app/views/layouts/casa_app.html.erb app/views/layouts/_nav_link.html.erb
  No errors were found in ERB files

No JavaScript changed, so there is nothing new for jest here.

Screenshots please :)

Local server, seeded data, two active custom links ("Volunteer handbook", "Mileage policy") on Prince George CASA.

Signed in as casa_admin1@example.com at http://localhost:3000/casa_cases — LINKS sits after REPORTING and above the pinned Settings:

Signed in as volunteer1@example.com at http://localhost:3000/case_contacts — the same links, and no Settings item (still policy-gated):