f8db38f989
* fix(analytics): mask session replays by default, chrome-only unmask Invert PostHog session-replay masking from visible-by-default with pattern masking to deny-by-default: every input value is masked wholesale (rrweb maskAllInputs, no maskInputFn) and every text node is masked unless it sits under data-ph-unmask chrome or a table column header (th). Chrome tags live on the shared UI primitives (PageHeader, Label, Button except combobox triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help popovers, empty states, settings labels), and tagged chrome is still pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask beats data-ph-unmask, so call sites that interpolate user data into chrome stay masked; a very-thorough audit swept every unmasked primitive and each found site got a call-site mask. Confirm-dialog wrappers and toasts stay masked centrally: their copy describes user objects by design. Untagged new UI over-masks instead of leaking. Privacy policy, RoPA and decision log updated in the same change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(analytics): tag detail-section chrome merged from main The register-detail primitives landed on main after the replay-masking audit ran: kickers and DefRow labels are static i18n chrome, values stay masked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(analytics): close skeptic and review findings on replay masking Explicit data-ph tags now resolve before the th chrome fallback, so a th nested inside a data-ph-mask container masks correctly (regression test added). Seven missed text-leak sites get call-site masks: delete-invoice and credit-page invoice numbers, IB-correction voucher reference, TIC orgnr (served unnormalized, so the separator-based scrub cannot be relied on), articles search-term empty state, dimension segment labels, and activate-account buttons. The attribute channel is closed with rrweb's blockClass: inputs whose placeholder carries an effective user value (salary overrides, correction description, danger-zone confirms, credit confirm) get ph-no-capture, removing the element from recordings while the prefill UX stays intact; the pivot-th title attribute is dropped. Privacy-policy effective date bumped to 2026-08-17. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
187 lines
5.2 KiB
TypeScript
187 lines
5.2 KiB
TypeScript
'use client'
|
|
|
|
import { useState, useCallback, useRef } from 'react'
|
|
import {
|
|
Dialog,
|
|
DialogContent,
|
|
DialogHeader,
|
|
DialogTitle,
|
|
DialogDescription,
|
|
DialogFooter,
|
|
} from '@/components/ui/dialog'
|
|
import { Button } from '@/components/ui/button'
|
|
import { AlertTriangle, Loader2 } from 'lucide-react'
|
|
import { cn } from '@/lib/utils'
|
|
|
|
interface DestructiveConfirmDialogProps {
|
|
open: boolean
|
|
onOpenChange: (open: boolean) => void
|
|
title: string
|
|
description: string
|
|
confirmLabel?: string
|
|
cancelLabel?: string
|
|
variant?: 'destructive' | 'warning'
|
|
onConfirm: () => void | Promise<void>
|
|
}
|
|
|
|
export function DestructiveConfirmDialog({
|
|
open,
|
|
onOpenChange,
|
|
title,
|
|
description,
|
|
confirmLabel = 'Bekräfta',
|
|
cancelLabel = 'Avbryt',
|
|
variant = 'destructive',
|
|
onConfirm,
|
|
}: DestructiveConfirmDialogProps) {
|
|
const [isLoading, setIsLoading] = useState(false)
|
|
|
|
const handleConfirm = async () => {
|
|
setIsLoading(true)
|
|
try {
|
|
await onConfirm()
|
|
} finally {
|
|
setIsLoading(false)
|
|
onOpenChange(false)
|
|
}
|
|
}
|
|
|
|
return (
|
|
<Dialog
|
|
open={open}
|
|
onOpenChange={(v) => {
|
|
if (isLoading) return
|
|
onOpenChange(v)
|
|
}}
|
|
>
|
|
<DialogContent className="sm:max-w-md">
|
|
<DialogHeader>
|
|
<div className="flex items-start gap-4">
|
|
<div
|
|
className={cn(
|
|
'flex-shrink-0 flex items-center justify-center h-10 w-10 rounded-full',
|
|
variant === 'destructive'
|
|
? 'bg-destructive/10 text-destructive'
|
|
: 'bg-muted text-attn'
|
|
)}
|
|
>
|
|
<AlertTriangle className="h-5 w-5" />
|
|
</div>
|
|
<div className="space-y-1">
|
|
{/* data-ph-mask: confirm dialogs describe the object being
|
|
acted on (convention 10), so title and description are user
|
|
data in session replays, not chrome. */}
|
|
<DialogTitle data-ph-mask="">{title}</DialogTitle>
|
|
{/* pre-line so callers can pass newline-separated paragraphs
|
|
(e.g. the salary unapprove confirm assembles its copy
|
|
dynamically); single-line descriptions render unchanged. */}
|
|
<DialogDescription data-ph-mask="" className="whitespace-pre-line">
|
|
{description}
|
|
</DialogDescription>
|
|
</div>
|
|
</div>
|
|
</DialogHeader>
|
|
<DialogFooter className="gap-2 sm:gap-0">
|
|
<Button
|
|
variant="outline"
|
|
onClick={() => onOpenChange(false)}
|
|
disabled={isLoading}
|
|
className="min-h-11 w-full sm:w-auto"
|
|
>
|
|
{cancelLabel}
|
|
</Button>
|
|
{/* Warning-variant confirms use the default primary button: in
|
|
chrome only --destructive survives as a colored action. */}
|
|
<Button
|
|
variant={variant === 'destructive' ? 'destructive' : 'default'}
|
|
onClick={handleConfirm}
|
|
disabled={isLoading}
|
|
className="min-h-11 w-full sm:w-auto"
|
|
>
|
|
{isLoading ? (
|
|
<Loader2 className="mr-2 h-4 w-4 animate-spin" />
|
|
) : null}
|
|
{confirmLabel}
|
|
</Button>
|
|
</DialogFooter>
|
|
</DialogContent>
|
|
</Dialog>
|
|
)
|
|
}
|
|
|
|
interface ConfirmOptions {
|
|
title: string
|
|
description: string
|
|
confirmLabel?: string
|
|
cancelLabel?: string
|
|
variant?: 'destructive' | 'warning'
|
|
}
|
|
|
|
interface UseDestructiveConfirmReturn {
|
|
dialogProps: DestructiveConfirmDialogProps
|
|
confirm: (options: ConfirmOptions) => Promise<boolean>
|
|
}
|
|
|
|
/**
|
|
* Hook that returns a `confirm()` function as a drop-in replacement for `window.confirm()`.
|
|
* Returns `Promise<boolean>`: true if user confirms, false if they cancel.
|
|
*
|
|
* Usage:
|
|
* ```
|
|
* const { dialogProps, confirm } = useDestructiveConfirm()
|
|
*
|
|
* async function handleDelete() {
|
|
* const ok = await confirm({ title: '...', description: '...' })
|
|
* if (!ok) return
|
|
* // proceed with deletion
|
|
* }
|
|
*
|
|
* return <><DestructiveConfirmDialog {...dialogProps} /></>
|
|
* ```
|
|
*/
|
|
export function useDestructiveConfirm(): UseDestructiveConfirmReturn {
|
|
const [open, setOpen] = useState(false)
|
|
const [options, setOptions] = useState<ConfirmOptions>({
|
|
title: '',
|
|
description: '',
|
|
})
|
|
const resolveRef = useRef<((value: boolean) => void) | null>(null)
|
|
|
|
const confirm = useCallback((opts: ConfirmOptions): Promise<boolean> => {
|
|
setOptions(opts)
|
|
setOpen(true)
|
|
return new Promise<boolean>((resolve) => {
|
|
resolveRef.current = resolve
|
|
})
|
|
}, [])
|
|
|
|
const handleOpenChange = useCallback((v: boolean) => {
|
|
setOpen(v)
|
|
if (!v && resolveRef.current) {
|
|
resolveRef.current(false)
|
|
resolveRef.current = null
|
|
}
|
|
}, [])
|
|
|
|
const handleConfirm = useCallback(() => {
|
|
if (resolveRef.current) {
|
|
resolveRef.current(true)
|
|
resolveRef.current = null
|
|
}
|
|
}, [])
|
|
|
|
return {
|
|
dialogProps: {
|
|
open,
|
|
onOpenChange: handleOpenChange,
|
|
title: options.title,
|
|
description: options.description,
|
|
confirmLabel: options.confirmLabel,
|
|
cancelLabel: options.cancelLabel,
|
|
variant: options.variant,
|
|
onConfirm: handleConfirm,
|
|
},
|
|
confirm,
|
|
}
|
|
}
|