Files
accounted/components/ui/confirm-dialog.tsx
T
Mattsson f8db38f989 fix(analytics): mask session replays by default, chrome-only unmask (#1639)
* fix(analytics): mask session replays by default, chrome-only unmask

Invert PostHog session-replay masking from visible-by-default with pattern
masking to deny-by-default: every input value is masked wholesale (rrweb
maskAllInputs, no maskInputFn) and every text node is masked unless it sits
under data-ph-unmask chrome or a table column header (th). Chrome tags live
on the shared UI primitives (PageHeader, Label, Button except combobox
triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help
popovers, empty states, settings labels), and tagged chrome is still
pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask
beats data-ph-unmask, so call sites that interpolate user data into chrome
stay masked; a very-thorough audit swept every unmasked primitive and each
found site got a call-site mask. Confirm-dialog wrappers and toasts stay
masked centrally: their copy describes user objects by design. Untagged new
UI over-masks instead of leaking. Privacy policy, RoPA and decision log
updated in the same change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): tag detail-section chrome merged from main

The register-detail primitives landed on main after the replay-masking
audit ran: kickers and DefRow labels are static i18n chrome, values stay
masked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): close skeptic and review findings on replay masking

Explicit data-ph tags now resolve before the th chrome fallback, so a th
nested inside a data-ph-mask container masks correctly (regression test
added). Seven missed text-leak sites get call-site masks: delete-invoice
and credit-page invoice numbers, IB-correction voucher reference, TIC
orgnr (served unnormalized, so the separator-based scrub cannot be relied
on), articles search-term empty state, dimension segment labels, and
activate-account buttons. The attribute channel is closed with rrweb's
blockClass: inputs whose placeholder carries an effective user value
(salary overrides, correction description, danger-zone confirms, credit
confirm) get ph-no-capture, removing the element from recordings while
the prefill UX stays intact; the pivot-th title attribute is dropped.
Privacy-policy effective date bumped to 2026-08-17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 11:32:45 +02:00

105 lines
3.1 KiB
TypeScript

'use client'
import { useState } from 'react'
import { useTranslations } from 'next-intl'
import { cn } from '@/lib/utils'
import {
Dialog,
DialogContent,
DialogDescription,
DialogFooter,
DialogHeader,
DialogTitle,
} from '@/components/ui/dialog'
import { Button } from '@/components/ui/button'
import { Loader2 } from 'lucide-react'
interface ConfirmDialogProps {
open: boolean
onOpenChange: (open: boolean) => void
title: string
/**
* Body text that DESCRIBES THE OUTCOME up front ("Bokförs som verifikat
* A-217 med 1 250,00 kr ...") instead of the page commenting afterwards
* (UI-migration convention 10).
*/
description?: React.ReactNode
/** Optional richer body (e.g. a kontering preview) rendered below the description. */
children?: React.ReactNode
confirmLabel: string
cancelLabel?: string
/** Await-able: the dialog shows a pending state until the promise settles. */
onConfirm: () => void | Promise<void>
/** Terracotta confirm for destructive outcomes (avvisa, makulera). */
destructive?: boolean
}
/**
* Small centered confirmation dialog (min 460px on desktop): confirm before
* acting, describing the outcome, rather than commenting after the fact.
*/
export function ConfirmDialog({
open,
onOpenChange,
title,
description,
children,
confirmLabel,
cancelLabel,
onConfirm,
destructive = false,
}: ConfirmDialogProps) {
const tCommon = useTranslations('common')
const [pending, setPending] = useState(false)
const handleConfirm = async () => {
try {
setPending(true)
await onConfirm()
onOpenChange(false)
} finally {
setPending(false)
}
}
return (
<Dialog open={open} onOpenChange={(next) => !pending && onOpenChange(next)}>
<DialogContent className="sm:min-w-[460px] sm:max-w-md">
<DialogHeader>
{/* data-ph-mask: confirm dialogs describe the object being acted
on (convention 10), so title and description are user data in
session replays, not chrome. Mask wins over the primitives'
own data-ph-unmask. */}
<DialogTitle data-ph-mask="" className="font-display text-lg tracking-tight">
{title}
</DialogTitle>
{description && (
<DialogDescription data-ph-mask="" className="text-[13px] leading-relaxed">
{description}
</DialogDescription>
)}
</DialogHeader>
{children}
<DialogFooter className="gap-2 sm:gap-2">
<Button
variant="ghost"
onClick={() => onOpenChange(false)}
disabled={pending}
>
{cancelLabel ?? tCommon('cancel')}
</Button>
<Button
variant={destructive ? 'destructive' : 'default'}
onClick={() => void handleConfirm()}
disabled={pending}
className={cn(pending && 'cursor-wait')}
>
{pending && <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />}
{confirmLabel}
</Button>
</DialogFooter>
</DialogContent>
</Dialog>
)
}