Modernization of Test Cases with Custom Fields (lib/results/testCasesWithCF.php) — GitHub issue #737.

The legacy Smarty screen is replaced by a standalone Dashio page (gui/templates/results/tcasesWithCF.html) backed by a plain-PHP REST BFF action inside api/reports/index.php (action=tcases_with_cf). The ASIDE Reports → Test Cases with Custom Fields entry now points to the new HTML screen when a test plan is selected.

Path: Reports → Test Cases with Custom Fields URL: gui/templates/results/tcasesWithCF.html?tproject_id=<id>&tplan_id=<id> BFF API: api/reports/index.php?action=tcases_with_cf&tproject_id=<id>&tplan_id=<id> Right: report_view enforced server-side (same as legacy).

1. What the screen does
2. REST API Reference
3. Legacy parity notes
4. i18n Keys
5. Security
6. Testing

All routes require an authenticated session; callers without report_view get 403.

Returns test case execution results with custom field values.

Query parameters:

Response:

{
  "status": "ok",
  "cfinfo": [
    { "field_id": 6, "name": "CF_Environment", "label": "Environment" }
  ],
  "gui": {
    "testsuite": "Test Suite",
    "testcase": "Test Case",
    "build": "Build",
    "status": "Status"
  },
  "executions": {
    "header": [
      "Test Suite", "Test Case", "Version", "Build",
      "Tester", "Date", "Status", "Execution Notes"
    ],
    "rows": [
      {
        "testsuite_name": "Suite A",
        "tc_external_id": 1,
        "tcase_name": "TC with CF",
        "version": 1,
        "build_name": "Build 1",
        "login": "admin",
        "execution_ts": "2026-08-25 19:58:13",
        "status": "failed",
        "notes": "Failed - regression",
        "cfields": { "Environment": "Staging" }
      }
    ]
  }
}

• CF definitions fetched via same cfield_mgr::get_linked_cfields_at_execution() path
• Execution rows built from same DB query (executions + tcversions + builds + cfield_values)
• getPathLayered() null guard added to handle missing CF definitions gracefully
• Test Suite / Test Case / Build cascading filter mirrors legacy dropdown behavior
• Status coloring uses same hex values as legacy Smarty template

All strings use TLi18n keys; no hardcoded text.

Keys present in all 11 locale bundles (en, ro, de, fr, es, it, ja, pt, ru, zh, plus the base en).

• Session-based authentication enforced at BFF entry point
• report_view right checked server-side before any DB query
• tproject_id validated against user's allowed projects
• All output escaped via htmlspecialchars() in DataTables rendering

Test suite #37 in tmp/TLU_Test_Cases.md — 15 test cases covering:

• Screen load without PHP warnings
• Empty state when no CFs defined
• Filter dropdown population and cascading
• Results table columns and data correctness
• Custom field value display
• DataTable pagination and search
• Locale switcher translation
• Aside menu link target
• API data response format
• API 401 without session
• Event Viewer cleanliness
• View-only user permissions

A parity pass against the legacy controller closed the last two behavioural gaps of this report and retired the legacy renderer.

Legacy openExecutionWindow(tcase_id, tcversion_id, builds_id, tplan_id, platform_id) always appended setting_build and setting_platform. The modern Execute icon now does the same (gui/templates/results/tcasesWithCF.html), so the Set Results popup opens on the build/platform the report row was recorded on instead of falling back to the plan default:

/gui/templates/execute/execSetResults.html?tcase_id=4&tcversion_id=5&tproject_id=1&tplan_id=2&setting_build=1&setting_platform=0

The italic legacy note ("This Report shows all test cases with any custom field set on test execution. In addition the execution notes are shown for applicable test cases.") and the Generated on <timestamp> — Elapsed: Ns line are back at the bottom of the report. The BFF api/reports/index.php?action=tcases_with_cf now returns a generated_on field on both success payloads (the linked-TC list and the no-linked-TC early return).

New i18n keys: tcwcf.infoText, tcwcf.generatedOn (all 10 bundles).

• lib/results/testCasesWithCF.php is now a session-guarded, non-mutating launcher (same pattern as lib/results/keywordBarChart.php):
  • authenticated browser GET/HEAD → 302 to gui/templates/results/tcasesWithCF.html, with tproject_id / tplan_id preserved (and the legacy session fallback);
  • write verbs and XHR / non-document callers → 405 JSON modern_endpoint_only;
  • anonymous callers → login.php?note=expired (the legacy testlinkInitPage() contract).
• gui/templates/dashio/results/testCasesWithCF.tpl removed.
• cfg/reports.cfg.php tcases_with_cf url repointed to the modern HTML (the ASIDE menu already overrode the link).

Correction to §5: this BFF enforces the testplan_metrics right (on the owning test project and plan), the same right the legacy controller used — not report_view.

Fixture tmp/fixtures_tcwcf.php; suite Issue #1207/#1208/#1209 in tmp/TLU_Test_Cases.md — 24/24 PASS (BFF payload, Execute URL, footer, all four shim branches, array-param safety, events clean).