f8db38f989
* fix(analytics): mask session replays by default, chrome-only unmask Invert PostHog session-replay masking from visible-by-default with pattern masking to deny-by-default: every input value is masked wholesale (rrweb maskAllInputs, no maskInputFn) and every text node is masked unless it sits under data-ph-unmask chrome or a table column header (th). Chrome tags live on the shared UI primitives (PageHeader, Label, Button except combobox triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help popovers, empty states, settings labels), and tagged chrome is still pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask beats data-ph-unmask, so call sites that interpolate user data into chrome stay masked; a very-thorough audit swept every unmasked primitive and each found site got a call-site mask. Confirm-dialog wrappers and toasts stay masked centrally: their copy describes user objects by design. Untagged new UI over-masks instead of leaking. Privacy policy, RoPA and decision log updated in the same change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(analytics): tag detail-section chrome merged from main The register-detail primitives landed on main after the replay-masking audit ran: kickers and DefRow labels are static i18n chrome, values stay masked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(analytics): close skeptic and review findings on replay masking Explicit data-ph tags now resolve before the th chrome fallback, so a th nested inside a data-ph-mask container masks correctly (regression test added). Seven missed text-leak sites get call-site masks: delete-invoice and credit-page invoice numbers, IB-correction voucher reference, TIC orgnr (served unnormalized, so the separator-based scrub cannot be relied on), articles search-term empty state, dimension segment labels, and activate-account buttons. The attribute channel is closed with rrweb's blockClass: inputs whose placeholder carries an effective user value (salary overrides, correction description, danger-zone confirms, credit confirm) get ph-no-capture, removing the element from recordings while the prefill UX stays intact; the pivot-th title attribute is dropped. Privacy-policy effective date bumped to 2026-08-17. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
105 lines
3.1 KiB
TypeScript
105 lines
3.1 KiB
TypeScript
'use client'
|
|
|
|
import { useState } from 'react'
|
|
import { useTranslations } from 'next-intl'
|
|
import { cn } from '@/lib/utils'
|
|
import {
|
|
Dialog,
|
|
DialogContent,
|
|
DialogDescription,
|
|
DialogFooter,
|
|
DialogHeader,
|
|
DialogTitle,
|
|
} from '@/components/ui/dialog'
|
|
import { Button } from '@/components/ui/button'
|
|
import { Loader2 } from 'lucide-react'
|
|
|
|
interface ConfirmDialogProps {
|
|
open: boolean
|
|
onOpenChange: (open: boolean) => void
|
|
title: string
|
|
/**
|
|
* Body text that DESCRIBES THE OUTCOME up front ("Bokförs som verifikat
|
|
* A-217 med 1 250,00 kr ...") instead of the page commenting afterwards
|
|
* (UI-migration convention 10).
|
|
*/
|
|
description?: React.ReactNode
|
|
/** Optional richer body (e.g. a kontering preview) rendered below the description. */
|
|
children?: React.ReactNode
|
|
confirmLabel: string
|
|
cancelLabel?: string
|
|
/** Await-able: the dialog shows a pending state until the promise settles. */
|
|
onConfirm: () => void | Promise<void>
|
|
/** Terracotta confirm for destructive outcomes (avvisa, makulera). */
|
|
destructive?: boolean
|
|
}
|
|
|
|
/**
|
|
* Small centered confirmation dialog (min 460px on desktop): confirm before
|
|
* acting, describing the outcome, rather than commenting after the fact.
|
|
*/
|
|
export function ConfirmDialog({
|
|
open,
|
|
onOpenChange,
|
|
title,
|
|
description,
|
|
children,
|
|
confirmLabel,
|
|
cancelLabel,
|
|
onConfirm,
|
|
destructive = false,
|
|
}: ConfirmDialogProps) {
|
|
const tCommon = useTranslations('common')
|
|
const [pending, setPending] = useState(false)
|
|
|
|
const handleConfirm = async () => {
|
|
try {
|
|
setPending(true)
|
|
await onConfirm()
|
|
onOpenChange(false)
|
|
} finally {
|
|
setPending(false)
|
|
}
|
|
}
|
|
|
|
return (
|
|
<Dialog open={open} onOpenChange={(next) => !pending && onOpenChange(next)}>
|
|
<DialogContent className="sm:min-w-[460px] sm:max-w-md">
|
|
<DialogHeader>
|
|
{/* data-ph-mask: confirm dialogs describe the object being acted
|
|
on (convention 10), so title and description are user data in
|
|
session replays, not chrome. Mask wins over the primitives'
|
|
own data-ph-unmask. */}
|
|
<DialogTitle data-ph-mask="" className="font-display text-lg tracking-tight">
|
|
{title}
|
|
</DialogTitle>
|
|
{description && (
|
|
<DialogDescription data-ph-mask="" className="text-[13px] leading-relaxed">
|
|
{description}
|
|
</DialogDescription>
|
|
)}
|
|
</DialogHeader>
|
|
{children}
|
|
<DialogFooter className="gap-2 sm:gap-2">
|
|
<Button
|
|
variant="ghost"
|
|
onClick={() => onOpenChange(false)}
|
|
disabled={pending}
|
|
>
|
|
{cancelLabel ?? tCommon('cancel')}
|
|
</Button>
|
|
<Button
|
|
variant={destructive ? 'destructive' : 'default'}
|
|
onClick={() => void handleConfirm()}
|
|
disabled={pending}
|
|
className={cn(pending && 'cursor-wait')}
|
|
>
|
|
{pending && <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />}
|
|
{confirmLabel}
|
|
</Button>
|
|
</DialogFooter>
|
|
</DialogContent>
|
|
</Dialog>
|
|
)
|
|
}
|