Files
accounted/components/ui/confirmation-dialog.tsx
T
Mattsson f8db38f989 fix(analytics): mask session replays by default, chrome-only unmask (#1639)
* fix(analytics): mask session replays by default, chrome-only unmask

Invert PostHog session-replay masking from visible-by-default with pattern
masking to deny-by-default: every input value is masked wholesale (rrweb
maskAllInputs, no maskInputFn) and every text node is masked unless it sits
under data-ph-unmask chrome or a table column header (th). Chrome tags live
on the shared UI primitives (PageHeader, Label, Button except combobox
triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help
popovers, empty states, settings labels), and tagged chrome is still
pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask
beats data-ph-unmask, so call sites that interpolate user data into chrome
stay masked; a very-thorough audit swept every unmasked primitive and each
found site got a call-site mask. Confirm-dialog wrappers and toasts stay
masked centrally: their copy describes user objects by design. Untagged new
UI over-masks instead of leaking. Privacy policy, RoPA and decision log
updated in the same change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): tag detail-section chrome merged from main

The register-detail primitives landed on main after the replay-masking
audit ran: kickers and DefRow labels are static i18n chrome, values stay
masked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): close skeptic and review findings on replay masking

Explicit data-ph tags now resolve before the th chrome fallback, so a th
nested inside a data-ph-mask container masks correctly (regression test
added). Seven missed text-leak sites get call-site masks: delete-invoice
and credit-page invoice numbers, IB-correction voucher reference, TIC
orgnr (served unnormalized, so the separator-based scrub cannot be relied
on), articles search-term empty state, dimension segment labels, and
activate-account buttons. The attribute channel is closed with rrweb's
blockClass: inputs whose placeholder carries an effective user value
(salary overrides, correction description, danger-zone confirms, credit
confirm) get ph-no-capture, removing the element from recordings while
the prefill UX stays intact; the pivot-th title attribute is dropped.
Privacy-policy effective date bumped to 2026-08-17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 11:32:45 +02:00

106 lines
3.5 KiB
TypeScript

'use client'
import { ReactNode, useRef } from 'react'
import {
Dialog,
DialogContent,
DialogHeader,
DialogTitle,
DialogDescription,
DialogFooter,
} from '@/components/ui/dialog'
import { Button } from '@/components/ui/button'
import { AttnLine } from '@/components/ui/attn-line'
import { ClipboardCheck, Loader2 } from 'lucide-react'
interface ConfirmationDialogProps {
open: boolean
onOpenChange: (open: boolean) => void
onConfirm: () => void
isSubmitting: boolean
title: string
warningText?: string
confirmLabel?: string
extraActions?: ReactNode
children: ReactNode
// When true, initial focus lands on the confirm button so Enter fires the
// primary action. Opt-in: never arm Enter on unrelated/destructive dialogs.
autoFocusConfirm?: boolean
}
export function ConfirmationDialog({
open,
onOpenChange,
onConfirm,
isSubmitting,
title,
// No default warning: an accounting-immutability sentence used to be baked
// in here, which put it into dialogs whose authors never asked for one.
// Callers that commit a voucher directly pass their own warningText.
warningText,
confirmLabel = 'Bekräfta & skapa',
extraActions,
children,
autoFocusConfirm,
}: ConfirmationDialogProps) {
const confirmRef = useRef<HTMLButtonElement>(null)
return (
<Dialog open={open} onOpenChange={onOpenChange}>
<DialogContent
className="sm:max-w-2xl border-t-2 border-primary p-0 gap-0 max-h-[95dvh] sm:max-h-[90dvh] flex flex-col"
onOpenAutoFocus={autoFocusConfirm ? (e) => {
e.preventDefault()
confirmRef.current?.focus()
} : undefined}
>
<DialogHeader className="px-4 sm:px-6 pt-4 sm:pt-6 pb-3 sm:pb-4 shrink-0">
<div className="flex items-center gap-3">
<div className="flex h-10 w-10 items-center justify-center rounded-full bg-primary/10 shrink-0">
<ClipboardCheck className="h-5 w-5 text-primary" />
</div>
<div>
{/* data-ph-mask on the title: confirm dialogs describe the
object being acted on (convention 10), so the title is user
data in session replays. The description is a static
sentence and stays readable. */}
<DialogTitle data-ph-mask="" className="text-lg sm:text-xl">{title}</DialogTitle>
<DialogDescription>Granska uppgifterna innan du bekräftar</DialogDescription>
</div>
</div>
</DialogHeader>
<div className="overflow-y-auto flex-1 min-h-0 px-4 sm:px-6 pb-4">
{children}
</div>
<div className="border-t px-4 sm:px-6 py-3 sm:py-4 space-y-3 sm:space-y-4 shrink-0">
{/* Attention is one ochre sentence, not a banner (convention 6). */}
{warningText && <AttnLine>{warningText}</AttnLine>}
<DialogFooter>
<Button
variant="outline"
onClick={() => onOpenChange(false)}
disabled={isSubmitting}
className="min-h-11 w-full sm:w-auto"
>
Tillbaka
</Button>
{extraActions}
<Button ref={confirmRef} onClick={onConfirm} disabled={isSubmitting} className="min-h-11 w-full sm:w-auto">
{isSubmitting ? (
<>
<Loader2 className="mr-2 h-4 w-4 animate-spin" />
Skapar...
</>
) : (
confirmLabel
)}
</Button>
</DialogFooter>
</div>
</DialogContent>
</Dialog>
)
}