Modernization of the Top Level Suites Bar Chart report (lib/results/topLevelSuitesBarChart.php) — GitHub issue #1905.

With every ASIDE entry already pointing at a modern screen (docs/MODERNIZATION-STATUS.md: TODO = 0), an exhaustive sweep of the remaining legacy controllers found one last family of live legacy renderers: the four pChart PNG chart endpoints. Three of them — plus the Priority Bar Chart (#1845) — already had modern twins; topLevelSuitesBarChart.php was the sibling left behind. The modern Graphical Charts screen renders the same pixels (charts_data → by_suite), but it has no per-suite DataTable, no progress column, no totals row, no CSV export and no ownership-checked BFF. This screen is now a standalone Dashio page (gui/templates/results/topLevelSuitesBarChart.html) backed by a plain-PHP REST BFF (api/toplevelsuitesbarchart/index.php), reachable from the Results by Top-Level Test Suite section of the modern Graphical Charts report.

Path: Results → Graphical Charts → Results by Top-Level Test Suite → Open Top Level Suites Bar Chart URL: gui/templates/results/topLevelSuitesBarChart.html?tplan_id=N&tproject_id=P BFF API: api/toplevelsuitesbarchart/index.php (GET|HEAD ?action=init&tplan_id=N[&tproject_id=P]) Legacy URL: lib/results/topLevelSuitesBarChart.php — now a launcher shim (302 / 405 / 400) Auth: session (401 anonymous) + same-origin CSRF guard + the testplan_metrics right on the owning test project (403 otherwise).

lib/results/topLevelSuitesBarChart.php never rendered a Smarty template. It required charts.inc.php and answered a PNG of a stacked bar chart: one bar per top-level suite of the plan, series pass / fail / blocked / not run, over all builds + all platforms. Data came from tlTestPlanMetrics: getRootTestSuites() (tsuite_id → name) and getStatusTotalsByTopLevelTestSuiteForRender() (per-suite execution-status totals). The chart drew $item_descr = array_flip($dataSet) + ksort(), so suites appear alphabetically by name — the BFF reproduces that map and order exactly. A plan with zero linked test cases answered nothing (issue #634): the BFF returns can_draw:false and the screen shows a localized empty state.

The legacy gate was a global hasRight('testplan_metrics', ...) that never proved the plan the numbers belonged to; tproject_id came raw from $_REQUEST. The new BFF:

1. resolves the plan and derives the owning project server-side;
2. checks testplan_metrics on that owning project and plan with getAccess = true;
3. treats tproject_id as a client-side assertion (project_mismatch → 404);
4. answers the full JSON contract: 400 invalid_request, 401 not_authenticated / session_expired, 403 no_right, 404 tplan_not_found / project_mismatch, 405 method_not_allowed, with nosniff + no-store.

gui/templates/results/topLevelSuitesBarChart.html follows the #1845 pattern: Dashio shell, context strip (project, plan, suite count, version count), a back-to-Charts link, stacked horizontal bars in plain CSS, and a DataTable with the exact numbers, a Totals row and a Progress (executed / total) column. Refresh, Export CSV (RFC 4180 + UTF-8 BOM), Close, and a footer locale switcher. Every label is a bundle key (tlsbc.*, footers.topLevelSuitesBarChart, charts.openTopLevelSuitesBarChart) in all ten locales — the Română locale was fully translated.

Entry points: the charts.html Open Top Level Suites Bar Chart link, the $actions->topLevelSuitesBarChart registration in lib/functions/common.php, and the legacy endpoint now being a session-guarded 302 shim (document → redirect; XHR/<img> → 405 modern_endpoint_only; missing tplan_id → 400; anonymous → login redirect preserving the destination).

A plan without linked test cases shows the localized Nothing to chart state with the context strip still rendered:

One fresh-DB end-to-end suite was appended to tmp/TLU_Test_Cases.md (## Task — Issue #1905); 15 steps, all PASS (chart render with a real 2-suite dataset, empty state, CSV export, Română locale, no_right denial as a restricted role-3 user, the full BFF contract matrix, the shim matrix and the charts.html entry link). events shows no new Error/Warning rows. Code review (subagent) over BFF + screen + shim returned all OK, no FIX items.