P4 audit remediation: frontend correctness / UX - #27
Merged
tyler-rich merged 2 commits intoJul 6, 2026
Merged
Conversation
…ore label, RBAC gating Addresses the P4 tier of docs/reviews/full-audit-2026-07-05.md §10 (frontend correctness / UX): - FE-1: the API client emits an auth-invalidated event on any 401 and AuthContext drops to the login screen, instead of leaving a stale authenticated shell whose every action fails. - FE-3: a shared lib/dates.ts (parseUtc/formatWhen) renders backend naive-UTC timestamps; Account/Backups/Scheduled-scans stop showing UTC as local, and the ScanDetail/Scans private helpers are de-duplicated onto it. - FE-4: BackupsPanel's restore file uses useState (not useRef) so the selected file name re-renders on the destructive restore flow. - FE-5: ScheduledScansPanel constrains the scanner Select by target type (SCANNERS_FOR matrix + auto-correct) and gates Add/Run/Delete behind an operator/admin check; the /settings route is now guarded (viewers → /). Verified with tsc, ESLint, Prettier, and a clean vite build (no frontend test runner yet — FE-10 deferred to P5). Deviation logged in docs/PLAN.md.
…gitignore) The shared date helper added for FE-3 lives under frontend/src/lib/, which the generic Python-oriented `lib/` rule in .gitignore silently excluded — so the file was never committed and CI's fresh checkout failed the frontend build (and the image build) with "Cannot find module '../../lib/dates'". Add a .gitignore exception for the frontend source lib directory and commit the file.
tyler-rich
merged commit Jul 6, 2026
98a6284
into
claude/audit-fixes-2026-07-05-9bqe6n-p3
4 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the P4 tier of
docs/reviews/full-audit-2026-07-05.md§10 (frontend correctness / UX).Fixes
scrye:auth-invalidatedwindow event on any 401;AuthContextlistens and flipsuserto null, so a dead/revoked session drops the SPA back to<LoginPage>instead of leaving a stale authenticated shell where every widget errors.lib/dates.ts(parseUtc/formatWhen) is the one place that renders a backend naive-UTC timestamp. Account sessions, the Backups list + schedule last-run, and Scheduled-scans last-run (which previously rendered without aZ, so times were hours off) now use it; the two pages that already appendedZvia a privateformatWhen(ScanDetail, Scans) are de-duplicated onto the shared helper.BackupsPanel's restore file moves fromuseReftouseState, so the selected filename actually re-renders on the destructive restore flow instead of showing "No file selected".ScheduledScansPanelconstrains the scanner Select by target type (aSCANNERS_FORmatrix + auto-correct on target-type change, mirroring New Scan and the backend combo validation) and gates Add/Run/Delete behind an operator/admin check (useAuth)./settingsis now a guarded route — a viewer opening the URL is redirected to/, not just missing the nav link.Notes
tsc -b, ESLint, Prettier, and a cleanvite build.docs/PLAN.md§ Deviations (2026-07-05 P4 entry).