fix: treat aria-hidden={{true}} as an explicit escape hatch in click-events check

Premise: jsx-a11y accepts `aria-hidden={true}` (JSX boolean literal) as a
static opt-out of the click-events-have-key-events check. The HBS analog
is `aria-hidden={{true}}` — a GlimmerMustacheStatement whose path is a
GlimmerBooleanLiteral with value `true`. The previous
`isHiddenFromScreenReader` helper happened to treat this correctly, but
only because it also treated ANY mustache value as truthy (e.g.
`aria-hidden={{this.maybeHidden}}` would silence the rule as if the
element were guaranteed hidden). That is too permissive: a dynamic value
can't be proven hidden at lint time, so the rule should still fire.

Conclusion: rewrite the aria-hidden check to distinguish the two shapes
explicitly.

- `isHiddenFromScreenReader` now only returns true for:
  - GlimmerTextNode value with chars `""` (bare attribute) or `"true"`
    (case-insensitive, trimmed).
  - GlimmerMustacheStatement whose `path` is a GlimmerBooleanLiteral
    with value `true` — i.e. the literal `{{true}}`.
- Other mustache shapes (path references, helper calls) are now treated
  as dynamic/unknown, so the rule fires. Authors who want a static
  escape hatch should write `aria-hidden` or `aria-hidden="true"` or
  `aria-hidden={{true}}`.
- Tests added for the mustache-literal valid case and for the new
  dynamic-mustache invalid cases (`{{false}}`, `{{this.x}}`).
- Audit fixture: adds `aria-hidden={{true}}` as explicit parity with
  jsx-a11y's `aria-hidden={true}`.

Tracks PR #28 item G1 (escape-hatch awareness). Companion to the
master-side `template-no-invalid-interactive` fix.

Author: johanrd

lib/rules/template-click-events-have-key-events.js

@@ -37,12 +37,32 @@ function getTextAttrValue(attr) {
   return undefined;
 }
 
+// True iff the attribute's mustache value is the literal boolean `true` —
+// e.g. `aria-hidden={{true}}`. Any other expression (path reference, helper
+// call, etc.) is left to runtime and not treated as a static escape hatch.
+function isMustacheLiteralTrue(attr) {
+  if (attr?.value?.type !== 'GlimmerMustacheStatement') {
+    return false;
+  }
+  const path = attr.value.path;
+  return path?.type === 'GlimmerBooleanLiteral' && path.value === true;
+}
+
 function isHiddenFromScreenReader(node) {
   const ariaHidden = findAttr(node, 'aria-hidden');
   if (ariaHidden) {
-    const v = getTextAttrValue(ariaHidden);
-    // Presence without "false" is truthy (boolean attribute convention).
-    if (v === undefined || v === '' || v === 'true') {
+    // Static text values: bare `aria-hidden` (empty chars, boolean-attribute
+    // convention) or the literal "true".
+    if (ariaHidden.value?.type === 'GlimmerTextNode') {
+      const chars = ariaHidden.value.chars;
+      if (chars === '' || chars.trim().toLowerCase() === 'true') {
+        return true;
+      }
+    }
+    // Mustache-literal `{{true}}` — unambiguous static escape hatch. Any
+    // other mustache shape (path reference, helper invocation) is dynamic
+    // and intentionally NOT treated as hidden.
+    if (isMustacheLiteralTrue(ariaHidden)) {
       return true;
     }
   }

tests/audit/click-events-have-key-events/peer-parity.js

@@ -52,6 +52,9 @@ ruleTester.run('audit:click-events-have-key-events (gts)', rule, {
     // angular: valid (static `aria-hidden`, `aria-hidden="true"`).
     '<template><div aria-hidden {{on "click" this.onClick}}></div></template>',
     '<template><div aria-hidden="true" {{on "click" this.onClick}}></div></template>',
+    // `aria-hidden={{true}}` — HBS analog of jsx-a11y's `aria-hidden={true}`.
+    // Our rule treats the mustache-literal boolean as a static opt-out.
+    '<template><div aria-hidden={{true}} {{on "click" this.onClick}}></div></template>',
 
     // aria-hidden=false paired with a keyboard listener → still valid because
     // the keyboard listener is present.
@@ -290,6 +293,7 @@ hbsRuleTester.run('audit:click-events-have-key-events (hbs)', rule, {
     // aria-hidden.
     '<div aria-hidden {{on "click" this.a}}></div>',
     '<div aria-hidden="true" {{on "click" this.a}}></div>',
+    '<div aria-hidden={{true}} {{on "click" this.a}}></div>',
 
     // Inherently-interactive.
     '<button {{on "click" this.a}}></button>',

tests/lib/rules/template-click-events-have-key-events.js

@@ -25,6 +25,8 @@ ruleTester.run('template-click-events-have-key-events', rule, {
     // Hidden from AT.
     '<template><div aria-hidden="true" {{on "click" this.noop}}></div></template>',
     '<template><div aria-hidden {{on "click" this.noop}}></div></template>',
+    // Mustache-literal boolean `true` — explicit static opt-out.
+    '<template><div aria-hidden={{true}} {{on "click" this.noop}}></div></template>',
     '<template><div hidden {{on "click" this.noop}}></div></template>',
 
     // Presentation role — content has no semantics for AT.
@@ -66,6 +68,20 @@ ruleTester.run('template-click-events-have-key-events', rule, {
       output: null,
       errors: [{ messageId: 'needsKeyEvent' }],
     },
+    // Mustache-literal `{{false}}` is explicitly not-hidden.
+    {
+      code: '<template><div aria-hidden={{false}} {{on "click" this.onClick}}></div></template>',
+      output: null,
+      errors: [{ messageId: 'needsKeyEvent' }],
+    },
+    // Dynamic mustache (non-literal) — rule can't prove the element is
+    // hidden, so it still fires. Authors who intend aria-hidden as a static
+    // escape hatch should use a literal.
+    {
+      code: '<template><div aria-hidden={{this.maybeHidden}} {{on "click" this.onClick}}></div></template>',
+      output: null,
+      errors: [{ messageId: 'needsKeyEvent' }],
+    },
     // Presentation on a focusable widget isn't a valid exemption — but the rule
     // intentionally only checks role=presentation/none, not the focusable state.
     // The separate `no-role-presentation-on-focusable` rule handles that case.