Files
accounted/components/ui/data-list.tsx
T
Mattsson f8db38f989 fix(analytics): mask session replays by default, chrome-only unmask (#1639)
* fix(analytics): mask session replays by default, chrome-only unmask

Invert PostHog session-replay masking from visible-by-default with pattern
masking to deny-by-default: every input value is masked wholesale (rrweb
maskAllInputs, no maskInputFn) and every text node is masked unless it sits
under data-ph-unmask chrome or a table column header (th). Chrome tags live
on the shared UI primitives (PageHeader, Label, Button except combobox
triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help
popovers, empty states, settings labels), and tagged chrome is still
pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask
beats data-ph-unmask, so call sites that interpolate user data into chrome
stay masked; a very-thorough audit swept every unmasked primitive and each
found site got a call-site mask. Confirm-dialog wrappers and toasts stay
masked centrally: their copy describes user objects by design. Untagged new
UI over-masks instead of leaking. Privacy policy, RoPA and decision log
updated in the same change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): tag detail-section chrome merged from main

The register-detail primitives landed on main after the replay-masking
audit ran: kickers and DefRow labels are static i18n chrome, values stay
masked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): close skeptic and review findings on replay masking

Explicit data-ph tags now resolve before the th chrome fallback, so a th
nested inside a data-ph-mask container masks correctly (regression test
added). Seven missed text-leak sites get call-site masks: delete-invoice
and credit-page invoice numbers, IB-correction voucher reference, TIC
orgnr (served unnormalized, so the separator-based scrub cannot be relied
on), articles search-term empty state, dimension segment labels, and
activate-account buttons. The attribute channel is closed with rrweb's
blockClass: inputs whose placeholder carries an effective user value
(salary overrides, correction description, danger-zone confirms, credit
confirm) get ph-no-capture, removing the element from recordings while
the prefill UX stays intact; the pivot-th title attribute is dropped.
Privacy-policy effective date bumped to 2026-08-17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 11:32:45 +02:00

209 lines
5.4 KiB
TypeScript

import * as React from "react"
import { cn } from "@/lib/utils"
/**
* DataList: unified list surface (one bordered container, hairline rows).
*
* Replaces the per-row Card pattern across Granskning, Transactions, and
* similar list pages. Visual contract is flat-with-hairlines per CLAUDE.md:
* no shadows on the container, no state-tinted borders, secondary token for
* selected/hover.
*/
const DataList = React.forwardRef<
HTMLDivElement,
React.HTMLAttributes<HTMLDivElement>
>(({ className, ...props }, ref) => (
<div
ref={ref}
className={cn(
"rounded-lg border border-border bg-card text-card-foreground overflow-hidden [&>*]:border-b [&>*]:border-border [&>*:last-child]:border-b-0",
className
)}
{...props}
/>
))
DataList.displayName = "DataList"
const DataListHeader = React.forwardRef<
HTMLDivElement,
React.HTMLAttributes<HTMLDivElement>
>(({ className, ...props }, ref) => (
<div
ref={ref}
className={cn(
"flex flex-wrap items-center gap-3 border-b border-border bg-secondary/40 px-4 py-2",
className
)}
{...props}
/>
))
DataListHeader.displayName = "DataListHeader"
interface DataListRowProps extends React.HTMLAttributes<HTMLDivElement> {
leading?: React.ReactNode
trailing?: React.ReactNode
selected?: boolean
expanded?: boolean
expandedContent?: React.ReactNode
rowClassName?: string
}
const DataListRow = React.forwardRef<HTMLDivElement, DataListRowProps>(
(
{
className,
leading,
trailing,
selected,
expanded,
expandedContent,
rowClassName,
onClick,
children,
...props
},
ref
) => {
const isInteractive = Boolean(onClick)
return (
<div
ref={ref}
className={cn(
"transition-colors",
selected ? "bg-secondary/50" : "hover:bg-secondary/40",
className
)}
{...props}
>
<div
className={cn(
"flex items-start gap-3 px-4 py-3",
isInteractive && "cursor-pointer",
rowClassName
)}
onClick={onClick}
>
{leading != null && (
<div className="flex shrink-0 items-center pt-0.5">{leading}</div>
)}
<div className="min-w-0 flex-1">{children}</div>
{trailing != null && (
<div className="flex shrink-0 items-center gap-3">{trailing}</div>
)}
</div>
{expandedContent != null && (
<div
className={cn(
"grid transition-[grid-template-rows] duration-200 motion-reduce:transition-none",
expanded ? "grid-rows-[1fr]" : "grid-rows-[0fr]"
)}
>
<div className="overflow-hidden">
<div className="border-t border-border bg-secondary/20 px-4 py-3">
{expandedContent}
</div>
</div>
</div>
)}
</div>
)
}
)
DataListRow.displayName = "DataListRow"
const DataListPrimary = React.forwardRef<
HTMLParagraphElement,
React.HTMLAttributes<HTMLParagraphElement>
>(({ className, ...props }, ref) => (
<p
ref={ref}
className={cn("truncate text-sm font-medium leading-snug", className)}
{...props}
/>
))
DataListPrimary.displayName = "DataListPrimary"
const DataListMeta = React.forwardRef<
HTMLDivElement,
React.HTMLAttributes<HTMLDivElement>
>(({ className, ...props }, ref) => (
<div
ref={ref}
className={cn(
"mt-0.5 flex flex-wrap items-center gap-x-1.5 gap-y-0.5 text-xs text-muted-foreground",
className
)}
{...props}
/>
))
DataListMeta.displayName = "DataListMeta"
const DataListMetaSeparator = () => (
<span className="text-muted-foreground/50" aria-hidden>
·
</span>
)
DataListMetaSeparator.displayName = "DataListMetaSeparator"
interface DataListEmptyProps {
icon?: React.ReactNode
/** Chrome in session replays (data-ph-unmask): wrap any user data (e.g. a
search term) in a data-ph-mask element. */
title: React.ReactNode
description?: React.ReactNode
action?: React.ReactNode
className?: string
}
const DataListEmpty = ({
icon,
title,
description,
action,
className,
}: DataListEmptyProps) => (
// data-ph-unmask: list empty states are static i18n chrome in session replays.
<div
data-ph-unmask=""
className={cn(
"flex flex-col items-center justify-center px-6 py-16 text-center",
className
)}
>
{icon != null && (
<div className="mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-muted text-muted-foreground">
{icon}
</div>
)}
<p className="font-medium">{title}</p>
{description != null && (
<p className="mt-1 max-w-sm text-sm text-muted-foreground">{description}</p>
)}
{action != null && <div className="mt-4">{action}</div>}
</div>
)
DataListEmpty.displayName = "DataListEmpty"
const DataListLoading = ({ className }: { className?: string }) => (
<div
className={cn(
"flex items-center justify-center px-6 py-16 text-muted-foreground",
className
)}
>
<span className="inline-block h-4 w-4 animate-spin rounded-full border-2 border-current border-t-transparent motion-reduce:animate-none" />
</div>
)
DataListLoading.displayName = "DataListLoading"
export {
DataList,
DataListHeader,
DataListRow,
DataListPrimary,
DataListMeta,
DataListMetaSeparator,
DataListEmpty,
DataListLoading,
}