Files
accounted/components/import/RegisterColumnMappingStep.tsx
T
Mattsson f8db38f989 fix(analytics): mask session replays by default, chrome-only unmask (#1639)
* fix(analytics): mask session replays by default, chrome-only unmask

Invert PostHog session-replay masking from visible-by-default with pattern
masking to deny-by-default: every input value is masked wholesale (rrweb
maskAllInputs, no maskInputFn) and every text node is masked unless it sits
under data-ph-unmask chrome or a table column header (th). Chrome tags live
on the shared UI primitives (PageHeader, Label, Button except combobox
triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help
popovers, empty states, settings labels), and tagged chrome is still
pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask
beats data-ph-unmask, so call sites that interpolate user data into chrome
stay masked; a very-thorough audit swept every unmasked primitive and each
found site got a call-site mask. Confirm-dialog wrappers and toasts stay
masked centrally: their copy describes user objects by design. Untagged new
UI over-masks instead of leaking. Privacy policy, RoPA and decision log
updated in the same change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): tag detail-section chrome merged from main

The register-detail primitives landed on main after the replay-masking
audit ran: kickers and DefRow labels are static i18n chrome, values stay
masked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): close skeptic and review findings on replay masking

Explicit data-ph tags now resolve before the th chrome fallback, so a th
nested inside a data-ph-mask container masks correctly (regression test
added). Seven missed text-leak sites get call-site masks: delete-invoice
and credit-page invoice numbers, IB-correction voucher reference, TIC
orgnr (served unnormalized, so the separator-based scrub cannot be relied
on), articles search-term empty state, dimension segment labels, and
activate-account buttons. The attribute channel is closed with rrweb's
blockClass: inputs whose placeholder carries an effective user value
(salary overrides, correction description, danger-zone confirms, credit
confirm) get ph-no-capture, removing the element from recordings while
the prefill UX stays intact; the pivot-th title attribute is dropped.
Privacy-policy effective date bumped to 2026-08-17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 11:32:45 +02:00

127 lines
4.3 KiB
TypeScript

'use client'
import { useState } from 'react'
import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@/components/ui/card'
import { Button } from '@/components/ui/button'
import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
import { Label } from '@/components/ui/label'
/** A field that can be mapped to a column in the uploaded file. */
export interface RegisterColumnSpec<K extends string> {
key: K
label: string
required: boolean
}
interface RegisterColumnMappingStepProps<K extends string> {
headers: string[]
previewRows: string[][]
specs: RegisterColumnSpec<K>[]
initial: Record<K, number | null>
onConfirm: (mapping: Record<K, number | null>) => void
onBack: () => void
}
export default function RegisterColumnMappingStep<K extends string>({
headers,
previewRows,
specs,
initial,
onConfirm,
onBack,
}: RegisterColumnMappingStepProps<K>) {
const [mapping, setMapping] = useState<Record<K, number | null>>(initial)
const columnOptions = headers.map((h, i) => ({
value: String(i),
label: `${i + 1}: ${h || '(tom)'}`,
}))
const canContinue = specs
.filter((s) => s.required)
.every((s) => mapping[s.key] !== null && mapping[s.key]! >= 0)
return (
<Card>
<CardHeader>
<CardTitle>Kolumnmappning</CardTitle>
<CardDescription>
Vi kunde inte automatiskt identifiera alla kolumner. Ange vilka kolumner i din fil
som motsvarar respektive fält. Lämna tomt för fält som inte finns.
</CardDescription>
</CardHeader>
<CardContent className="space-y-6">
<div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
{specs.map((spec) => (
<div key={spec.key} className="space-y-2">
<Label>
{spec.label}
{spec.required && ' *'}
</Label>
<Select
value={mapping[spec.key] !== null ? String(mapping[spec.key]) : 'none'}
onValueChange={(v) =>
setMapping((prev) => ({
...prev,
[spec.key]: v === 'none' ? null : Number(v),
}))
}
>
<SelectTrigger>
<SelectValue placeholder="Välj kolumn" />
</SelectTrigger>
<SelectContent>
{!spec.required && <SelectItem value="none">(ingen)</SelectItem>}
{columnOptions.map((opt) => (
<SelectItem key={opt.value} value={opt.value}>
{opt.label}
</SelectItem>
))}
</SelectContent>
</Select>
</div>
))}
</div>
{previewRows.length > 0 && (
<div className="space-y-2">
<Label className="text-muted-foreground">Förhandsgranskning (5 första raderna)</Label>
<div className="overflow-x-auto rounded-lg border">
<table className="w-full text-sm">
<thead className="[&_th]:font-medium [&_th]:text-[11px] [&_th]:uppercase [&_th]:tracking-wider [&_th]:text-muted-foreground">
<tr className="border-b">
{headers.map((h, i) => (
/* data-ph-mask: CSV headers are user data */
<th key={i} data-ph-mask="" className="px-3 py-2 text-left whitespace-nowrap">
{h || `Kolumn ${i + 1}`}
</th>
))}
</tr>
</thead>
<tbody>
{previewRows.slice(0, 5).map((row, ri) => (
<tr key={ri} className="border-b last:border-0">
{row.map((cell, ci) => (
<td key={ci} className="px-3 py-1.5 whitespace-nowrap">
{cell}
</td>
))}
</tr>
))}
</tbody>
</table>
</div>
</div>
)}
<div className="flex justify-between">
<Button variant="ghost" onClick={onBack}>Tillbaka</Button>
<Button onClick={() => onConfirm(mapping)} disabled={!canContinue}>
Fortsätt
</Button>
</div>
</CardContent>
</Card>
)
}