Mattsson
f8db38f989
* fix(analytics): mask session replays by default, chrome-only unmask Invert PostHog session-replay masking from visible-by-default with pattern masking to deny-by-default: every input value is masked wholesale (rrweb maskAllInputs, no maskInputFn) and every text node is masked unless it sits under data-ph-unmask chrome or a table column header (th). Chrome tags live on the shared UI primitives (PageHeader, Label, Button except combobox triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help popovers, empty states, settings labels), and tagged chrome is still pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask beats data-ph-unmask, so call sites that interpolate user data into chrome stay masked; a very-thorough audit swept every unmasked primitive and each found site got a call-site mask. Confirm-dialog wrappers and toasts stay masked centrally: their copy describes user objects by design. Untagged new UI over-masks instead of leaking. Privacy policy, RoPA and decision log updated in the same change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(analytics): tag detail-section chrome merged from main The register-detail primitives landed on main after the replay-masking audit ran: kickers and DefRow labels are static i18n chrome, values stay masked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(analytics): close skeptic and review findings on replay masking Explicit data-ph tags now resolve before the th chrome fallback, so a th nested inside a data-ph-mask container masks correctly (regression test added). Seven missed text-leak sites get call-site masks: delete-invoice and credit-page invoice numbers, IB-correction voucher reference, TIC orgnr (served unnormalized, so the separator-based scrub cannot be relied on), articles search-term empty state, dimension segment labels, and activate-account buttons. The attribute channel is closed with rrweb's blockClass: inputs whose placeholder carries an effective user value (salary overrides, correction description, danger-zone confirms, credit confirm) get ph-no-capture, removing the element from recordings while the prefill UX stays intact; the pivot-th title attribute is dropped. Privacy-policy effective date bumped to 2026-08-17. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
39 lines
1.4 KiB
TypeScript
39 lines
1.4 KiB
TypeScript
import * as React from 'react'
|
|
|
|
interface PageHeaderProps {
|
|
/**
|
|
* Usually a static i18n string. The header is data-ph-unmask chrome in
|
|
* session replays, so a title or description that carries user data must
|
|
* wrap that part in a data-ph-mask element (hence ReactNode).
|
|
*/
|
|
title: React.ReactNode
|
|
description?: React.ReactNode
|
|
action?: React.ReactNode
|
|
/**
|
|
* Page help content, rendered as a small "?" popover right after the H1
|
|
* (UI-migration convention 7). Pass a <HelpPopover>...</HelpPopover>.
|
|
*/
|
|
help?: React.ReactNode
|
|
}
|
|
|
|
export function PageHeader({ title, description, action, help }: PageHeaderProps) {
|
|
return (
|
|
<div className="flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between mb-8">
|
|
<div>
|
|
<div className="flex items-center gap-2">
|
|
{/* Locked at exactly 24px/32px (UI-migration convention 2).
|
|
data-ph-unmask: page titles are static i18n chrome in session
|
|
replays; a page whose title carries user data must wrap it in
|
|
data-ph-mask at the call site. */}
|
|
<h1 data-ph-unmask="" className="font-display text-2xl leading-8 tracking-tight">{title}</h1>
|
|
{help}
|
|
</div>
|
|
{description && (
|
|
<p data-ph-unmask="" className="text-muted-foreground mt-1 text-balance">{description}</p>
|
|
)}
|
|
</div>
|
|
{action && <div className="w-full sm:w-auto [&>*]:w-full [&>*]:sm:w-auto">{action}</div>}
|
|
</div>
|
|
)
|
|
}
|