Welcome to Wicket Oat

General Integration

Wicket Oat provides a simple facade to install all necessary resources and security settings in your WebApplication.init() method:

@Override
protected void init() {
    super.init();
    
    // Install Wicket Oat globally
    WicketOats.install(this);
}

What it does

Calling WicketOats.install(app) performs several actions:

• Global Resources: Registers local oat.min.css and oat.min.js using getHeaderContributorListeners().
• Security Policy: Adds img-src data: to Wicket's strict Content Security Policy (CSP), for the icons Oat's CSS embeds as data: URLs. Nothing else is relaxed.

Security & CSP

Wicket Oat works under Wicket's default strict, nonce-based CSP: the library renders no inline scripts or style attributes, and Oat's JavaScript (dropdowns, toasts, tabs) only sets styles through the CSSOM, which CSP doesn't restrict. You don't need 'unsafe-inline' or 'unsafe-eval'.

Sources for your own content are yours to add, e.g. an image host:

getCspSettings().blocking()
    .add(CSPDirective.IMG_SRC, "https://images.example.com");

If your own markup relies on inline style attributes, allow them for styles only. Browsers ignore 'unsafe-inline' while a nonce is present, so replace the directive rather than adding to it:

getCspSettings().blocking()
    .remove(CSPDirective.STYLE_SRC)
    .add(CSPDirective.STYLE_SRC, CSPDirectiveSrcValue.SELF, CSPDirectiveSrcValue.UNSAFE_INLINE);

Theming System

Wicket Oat features a dynamic theming system based on the data-theme attribute. It supports both built-in and custom themes.

Programmatic Switching

The current user's theme is kept in a cookie (cached in the session), so any session class works. Switch it from any Wicket component:

// Java
OatTheme.setCurrent(OatTheme.MIDNIGHT);

Custom Theme Definition

Themes are defined in CSS using variable overrides, then registered so users can choose them:

/* themes.css */
[data-theme="my-custom-theme"] {
    color-scheme: dark;
    --background: #123456;
    --primary: #ffcc00;
}

// Java - in WebApplication.init()
WicketOats.install(this).addTheme(new OatTheme("my-custom-theme", "My Theme"));

Advanced Usage: Programmatic Toasts

Use the ClientSideClickBehavior to trigger Oat UI's native JavaScript functions while remaining CSP compliant. ot.toast takes (message, title, options), so pass null for the title if you only want to set variant options:

// Java
button.add(new ClientSideClickBehavior("ot.toast('Operation successful!', null, {variant: 'success'})"));

Component Architecture

Wicket Oat follows two main patterns for implementing UI components:

• Behaviors: Lightweight classes like ButtonBehavior, BadgeBehavior, or SpinnerBehavior that can be added to any Wicket component to apply Oat styling.
• Components: Specialized classes like OatAlert, OatDataTable, OatWizard or OatMoneyField that encapsulate both behavior and markup logic.

Business demos

Whole screens built from the components, as a business application would use them:

Implemented Components

General and navigation

Overlays and feedback

Data display

Forms

AI AI-Powered Development

Wicket Oat ships a standard Agent Skill at wicket-oat/ — a plain SKILL.md plus a references/ folder — to help you build UI faster with an AI coding agent. It gives the agent deep knowledge of the Oat API, component library, and theming system.

Try asking the agent: "Add an Oat primary button that shows a success toast" or "Oat-ify this form".

Interactive Demo

Message from Java: Wicket is running!

Server time: 2026-10-14T23:52:12.350204482Z