{{--
The document delete confirmation — CR-15.3 §8 items H2 and H6.
@include('customer-documents.partials.delete-modal')
Included by the THREE screens that offer a document delete: this module's
listing, and the booking edit and show screens whose Documents tab carries
the same control. Always at the END of the content section and never inside
a `.card`, for the reason CR-15.2's booking-type dialog records: a Bootstrap
dialog is `position: fixed`, but its containing block is whatever ancestor
establishes one, so nesting it in a card the wireframe gives
`overflow: hidden` is a way to have it clipped on some browsers and not
others.
## One instance, re-targeted
The reason inquiries/partials/modals.blade.php gives, and CR-10's dialog
repeats: a twenty-row page would otherwise carry twenty dialogs. The url and
the filename are read off the button that was pressed —
`nrems-document-delete.js` puts the name into the sentence with
`textContent` and never builds an address of its own.
## Why it lives in THIS module's folder while a booking screen includes it
Deleting a document is the Customer Documents module's act wherever the
button happens to be drawn — the same gate (`customer_documents.delete`,
decision D3), the same route, the same server code. The cross-module include
is the coupling D3 already created; the alternative was the client's verbatim
wording written down twice.
## The client's words (CR-8/CR-15 §0 — no lang file)
The title is the client's follow-up instruction verbatim: *"Are you sure you
want to delete?"*. The body names the file, as the `confirm()` it replaces
did. Every other string the module can put on screen is in `data-strings`
below, so the Javascript holds no wording at all.
## It confirms; it does not decide
Cancel closes the dialog and sends nothing. Confirm sends the DELETE by ajax
to the EXISTING `bookings.documents.destroy` route — no new route and no new
controller method, on the client's own instruction — and every gate on that
route still applies. A non-OK answer of any kind (403, 404, 419, 500) raises
the error toaster and removes nothing from the page.
--}}
{{-- The filename is the one genuinely attacker-supplied string on any of
the three screens. It is written into the with
`textContent`, so `` in a filename is visible
characters in a sentence and not markup. --}}
This will permanently remove. This cannot be undone.
{{-- `type="button"`: this dialog is not a form. The module sends the
request itself so the page never navigates. --}}
@push('scripts')
{{-- The toaster (item H6) and the delete client (H2-H5). Both do nothing at
all without their roots, and the toaster is pushed `@once` because two
screens on one page could both ask for it. --}}
@once
@endonce
@endpush