fix(security): resolve code-scanning alerts - #24
Merged
Conversation
chore: security hardening + npm trusted publishing
ci(seatmap-lib): add bootstrap publish workflow for first npm release
docs(seatmap-lib): rename consumer-facing references to @seatmaps.com/angular-lib
CodeQL js/unused-local-variable (#1,5,6,35,36): - drop unused imports IPassenger, IInitialLayoutData, FEATURE_ICONS - drop unused destructured rest in demo updateTextareasForFlight Dependencies (#29): - npm audit fix (lockfile-only): clears 4 transitive advisories (hono, undici, qs, tar). Remaining @angular/* advisories are only patched in v22 (major) and ship as peerDependencies, so they are the consuming app's responsibility, not this library's artifact. Scorecard Pinned-Dependencies (#40,#41): - pin `npm install -g npm` to 11.5.1 instead of @latest in both publish workflows for reproducible builds. Non-applicable Scorecard metrics (#24 Maintained, #25 Code-Review, #27 CII-Best-Practices, #28 Fuzzing) dismissed via API as won't-fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
McSpace
added a commit
that referenced
this pull request
Jun 25, 2026
* fix(seatmap-lib): keep galley bulks intact above staggered Business pods `_resolveBulkOverlaps` measured a row's bbox via `getNativeRowHeight`, which only inspects per-seat-type heights and ignores per-seat `topOffset`. On staggered Business pods (LH470 row 4: seat 4D at topOffset=-172, 4C/4H at +45) the real bottom edge of the row was under-reported, the galley bulk just below it looked merely lightly grazed, and the resolver shrunk its native height to ~22% — landing just above the 20% safety floor and rendering as an invisible 11-px strip while only the galley sticker stayed visible. Add `getNativeRowBBox` to walk non-aisle seats with their `topOffset` included and use it in `_resolveBulkOverlaps`. The LH470 case now overlaps the bulk deeply enough to trip the safety floor, so the partition keeps its original geometry — matching the React renderer. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(seatmap-lib): horizontal nose/tail direction via rightToLeft Mirror the React lib: in horizontal mode the nose and tail flip 180deg when not rightToLeft, so the cabin points the same way as the React reference. Adds horizontal/rightToLeft inputs to JetsNose/JetsTail and a transform binding; covered by unit tests (RED->GREEN). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(seatmap-lib): horizontal plane-body parity (deck-wrapper flip + nose/tail order) Mirror React PlaneBody/index.js for horizontal LTR: rotate the deck wrapper 180deg, render the tail first / nose last, and thread horizontal/rightToLeft into the nose and tail so they flip too. Gated on horizontal && !rightToLeft. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(seatmap-lib): pass horizontal/rightToLeft into plane-body Wire the resolved config flags into the plane body so the nose/tail/deck flip logic activates. Verified live: rightToLeft now controls the nose direction in horizontal mode (false=nose left, true=nose right), matching the React reference. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(seatmap-lib): keep tooltip on-screen & upright in horizontal mode (P1b) Move the horizontal rotate(90deg) onto an inner .jets-seat-map__rotor wrapper so the tooltip stays a sibling in the un-rotated container (mirrors the React structure). The tooltip is then anchored by an explicit screen-space left/top and a --horizontal CSS rule frees the right:8px constraint that was squeezing it to a sliver. Previously the tooltip rendered far off-screen (x~2476). _buildLayoutData now measures the rotor so the layoutUpdated payload is unchanged. Vertical tooltip (arrow, positioning) is unaffected. Unit + smoke e2e green; verified on-screen in the demo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(seatmap-lib): reverse deck stacking order in horizontal LTR Mirror React PlaneBody decks.reverse(): in horizontal && !rightToLeft, a stacked multi-deck cabin reverses its deck order so the decks read correctly after the rotor's 90deg rotation. Single-deck mode is unchanged (the active deck is shown regardless of orientation). getDeckIndex still returns the original content index, so data-deck-index / _buildLayoutData are unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(seatmap-lib): reserve rotated footprint for horizontal container In horizontal mode the container kept its tall vertical height (e.g. 400x3139) while the rotated rotor rendered 3139x359, leaving a huge gap below the cabin. Measure the rotor's transform-immune offset size post-render and swap it onto the container (width = rotor height, height = rotor width), mirroring React's outer 'width: scaledTotalDecksHeight'. A --horizontal modifier aligns the rotor to the start (it pivots top-left) and drops the vertical min-height. Also simplifies mapTransform (the scaleType ternary had identical branches; Angular bakes scale into deck rendering, so the offset is plain translateY(-100%)). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(seatmap-demo): e2e for horizontal nose direction + tooltip viewport Behavioural guards for the horizontal React-parity work: nose points left in LTR and right in RTL (rightToLeft drives the direction), and the built-in tooltip stays fully within the viewport in horizontal mode (P1b regression). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(seatmap-lib): keep layoutUpdated payload measuring the container The rotor refactor (e3043bb) made _buildLayoutData measure the rotor instead of the container, shifting widthInPx by the fuselage inset (~400->359) and breaking the seatMapInited React-parity payload test. Measure the container again; in horizontal it now carries the swapped dimensions, so the payload stays correct without the rotor. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(seatmap-lib): close the nose/tail-to-fuselage join gap The nose & tail outline paths start 1.5 viewBox units inside the SVG border, so they rendered slightly narrower than the fuselage and left a visible step where they meet it (most noticeable on wide cabins like QT888). Scale each up by 200/(200 - 2*effectiveInset), where effectiveInset = 1.5 - strokeWidth/2, so the outline centre lines up with the fuselage border centre. Mirrors the intent of React's Nose/Tail `distanceFromBorder` compensation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(seatmap-demo): stack controls below the map in horizontal mode In horizontal mode the rotated cabin can be far wider than the controls column, so the demo's flex-row layout squeezed the "Send Events" panel and event log into a sliver pushed off-screen to the right (the e2e helper even needs `force:true` to click through the overlap). Drive a `--horizontal` modifier from the active config's `horizontal` flag: switch `.demo-content` to a vertical stack and let the wide map scroll inside its own wrapper (`overflow-x:auto`) so the controls stay full-width and on-screen below the map. Also make the e2e playwright config honour `PW_BASE_URL` so the suite can target an already-running dev server (e.g. the dev worktree on :4201) without editing the file. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(seatmap-lib): re-measure horizontal footprint on in-place config toggle Toggling `horizontal` (or other layout-affecting flags) via a config change rather than a full flight reload skipped `_updateHorizontalDims()`, so the swapped container width/height stayed null from the initial vertical load. The `.jets-seat-map` container then collapsed to the rotor's un-rotated layout height (~3139px for a long cabin), leaving a large empty gap above the page controls. Re-run the swapped-dimension measurement after the view re-renders on a settings-only config change so the container reserves the wide, short horizontal footprint. Covered by a new e2e that toggles horizontal on an already-loaded map and asserts the reserved height stays smaller than the width. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(seatmap-lib): reserve full horizontal footprint incl. cabin labels, wings, nose The horizontal container only reserved the fuselage box (`offsetWidth`), so the absolutely-positioned side cabin labels and wings (~20px past the fuselage on each side) and the nose/tail caps were sheared off once the wrapper clipped overflow: cabin titles were cut at the bottom and the nose ran off the top-left. Measure the union of every rotor descendant's painted rect to reserve the true footprint, and nudge the rotor (a leading `translate` in the transform) so the top-left overflow is pulled back inside the box. The offset compensates for the already-applied shift so repeated measurements converge instead of oscillating. Covered by a new e2e asserting the reserved height exceeds the fuselage strip and that the nose and cabin labels stay within the container bounds. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(seatmap-lib): design spec for seat-colour React parity + class palette Remove the Angular-only colorfulSeatsByScore gate and colorfulSeatsByClass lightness tint; add a data-driven customSeatColorClasses palette. Demo apps implement the on/off toggles on top of customSeatColorRanges / customSeatColorClasses / seatAvailableColor. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(seatmap-lib): implementation plan for seat-colour React parity Task-by-task TDD plan: add customSeatColorClasses, drop the colorfulSeatsByScore gate and colorfulSeatsByClass tint, clean up demo/e2e configs, document priority. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(seatmap-lib): add customSeatColorClasses palette resolver and validation * feat(seatmap-lib): drop score gate, resolve score>class>API seat colour (React parity) * test(seatmap-lib): add legacy-path class-palette precedence coverage; dedup score unit test Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor(seatmap-lib): remove colorfulSeatsByClass tint and its threading Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor: remove colorfulSeatsBy* config fields and seatClassTints; update demo + e2e Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(seatmap-demo): e2e for config-driven seat colour priority + availability * test(seatmap-demo): harden seatColors grey-exclusion and class-on floor Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(seatmap-lib): document seat colour priority and customSeatColorClasses * test(seatmap-demo): screenshot harness emulating the 4 demo colour modes Renders each demo toggle combination via the new library config options (seatAvailableColor / customSeatColorRanges / customSeatColorClasses) with all seats available, capturing one screenshot per mode for visual review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(security): resolve code-scanning alerts (#24) * Bump version after documentation fix * Bump lib version; * fix(security): resolve code-scanning alerts CodeQL js/unused-local-variable (#1,5,6,35,36): - drop unused imports IPassenger, IInitialLayoutData, FEATURE_ICONS - drop unused destructured rest in demo updateTextareasForFlight Dependencies (#29): - npm audit fix (lockfile-only): clears 4 transitive advisories (hono, undici, qs, tar). Remaining @angular/* advisories are only patched in v22 (major) and ship as peerDependencies, so they are the consuming app's responsibility, not this library's artifact. Scorecard Pinned-Dependencies (#40,#41): - pin `npm install -g npm` to 11.5.1 instead of @latest in both publish workflows for reproducible builds. Non-applicable Scorecard metrics (#24 Maintained, #25 Code-Review, #27 CII-Best-Practices, #28 Fuzzing) dismissed via API as won't-fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Iurii Perevertailo <the.one.nexus@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Iurii Perevertailo <the.one.nexus@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the 12 open alerts on
main's code-scanning page.What changed
🟢 CodeQL — dead code (#1, #5, #6, #35, #36)
Removed unused imports (
IPassenger×2,IInitialLayoutData,FEATURE_ICONS) and an unused destructuredrestin the demo. Real findings, zero behaviour change.🟡 Dependencies (#29)
npm audit fix(lockfile-only —package.jsonuntouched) clears 4 transitive advisories (hono, undici, qs, tar). 15 → 11.The remaining 11 are the
@angular/*chain (incl. esbuild/piscina/@babel under@angular/build). They are patched only in Angular v22 (major), and the library declares@angular/*as peerDependencies — so they ship with the consuming app, not this library's artifact. A v21→v22 bump is intentionally out of scope for this PR; flag separately if desired.🔴 Scorecard
npm install -g npmto11.5.1(was@latest) in both publish workflows.Verification
npm run build:lib✅npm test— 362/362 passed ✅Based on
origin/main; targetingdevper repo workflow (admin mergesdev→main).🤖 Generated with Claude Code