[pull] main from CPAtoCybersecurity:main - #43
Merged
Conversation
Layer 1: anthropics/claude-code-security-review runs on same-repo PRs (fork PRs are skipped because secrets are stripped; maintainers use /security-review locally). Layer 2: Google Mantis positioned as the periodic offline deep review, never CI. SECURITY.md maps the layers to CSF DE.CM and ID.RA and records the operating rules: findings are advisory, humans verify, the reviewer itself is a prompt-injection surface so external-contributor approval gating stays on. Maintainer setup: add a CLAUDE_API_KEY repo secret; leave the check out of required branch protection until the first green run.
… pane The Details pane is an overflow-auto column and its Auditor trigger is right-aligned, so the dropdown's 'absolute left-0 w-72' panel overflowed the pane rather than drawing over it: 258 of its 288px were clipped, reachable only by scrolling the pane sideways. Portal the panel to <body>, position it fixed against the trigger, and clamp it to the viewport (flipping above when there's no room below). The z-[9999] class was inert -- this stylesheet defines no arbitrary-value or z-50+ utilities -- so the z-index is now set inline. Keeps the themed utility classes rather than reusing DropdownPortal, whose hardcoded #1f2937 would override this theme's --bg-primary (#0f172a).
Each evaluation card was a div with an onClick, so the browser had no link to build a context menu around: no "Open Link in New Window", no Cmd-click, no middle-click, and no keyboard focus. There was also no URL addressing a single evaluation. Each card title is now a react-router Link to /assessments?selected=<id>, with a stretched ::after overlay so the whole card is the hit area and the clone/delete/status buttons raised above it. The page honors ?selected= in a pre-paint layout effect, reusing handleSelectAssessment and clearing the param -- the same convention Findings and Controls already use. A plain left-click is intercepted and selects in place, so it adds no history entry; modified clicks and right-click fall through to the browser untouched, which is what makes the new-window affordance work. Known cost: the overlay owns the hit test, so card text is no longer drag-selectable in the list.
The artifact pick list in the Assessments evaluation pane rendered behind the Findings field and was squeezed into 160px. Root cause: .z-10 has no rule in index.css -- this stylesheet is hand-maintained with no Tailwind build, so the class applied, z-index computed to auto, and later positioned siblings painted over the panel. Same silent-no-op class as the inert z-[9999] in 40efe46. Add the .z-10 rule, which also repairs the Finding, Control, and Artifacts-page pick lists that share the defect. Portal the artifact panel to <body> with fixed positioning and an inline z-index, since the pane is overflow-auto inside an overflow-hidden grid and clips absolute panels. Measure width from the trigger (content-box makes w-full render wider than its parent), flip above when there is no room below, and clamp to the viewport. Add an inline New artifact form that creates, scope-stamps, and links in one action. Duplicate and empty names are blocked -- linkedArtifacts keys on name. 19 new tests; full suite 1331 passing.
…i-parity Feat/assessment csv UI parity
Add Claude diff security review and document the AI review layers
…in-new-window Make Assessments-list evaluations right-clickable into a new window
# Conflicts: # src/stores/findingsStore.js
…i-parity Assessment UI fixes and CSV/UI export parity
…v-parity Give the CSV-only findings columns a panel surface
…Link and Jira Key
…links Add external ticket links to Controls and Artifacts
The checkbox columns on Artifacts and Findings rendered with no `checked` and no `onChange` — clicking one did nothing. Controls had no checkbox column at all. Deleting several records meant opening each detail panel in turn, one confirm dialog per record. Adds a shared `useRowSelection` hook and a `BulkDeleteBar` strip, then wires all three pages to them: a header select-all checkbox, working per-row checkboxes, and a Delete action that removes every selected record behind a single confirmation. The hook reads the selection through the rows currently rendered rather than trusting stored ids. These pages re-scope constantly (assessment filter, search, and pagination on Controls), and without that intersection a selection made before a filter change would queue a delete against records the user can no longer see. Delete is offered whenever at least one row is selected. Gating it on a full selection would make it useless on a filtered list. BulkDeleteBar styles only with classes that exist in index.css — this project has no Tailwind build — and does the destructive button's hover with inline handlers, since `hover:bg-red-700` has no rule to fall back on.
Advisor review of the select-all work flagged four gaps. Three are addressed here; one was already covered. The header checkbox drew an empty box on a partial selection, which reads as "nothing is selected" while the bar beside it says three are. React has no `indeterminate` prop, so it is set through a ref, with `aria-checked="mixed"` alongside. Adds the test that actually secures the design: select every finding, narrow the assessment scope so one goes hidden, then bulk delete — the hidden finding must survive. Proving the prune at the hook layer does not prove the page's delete loop consumed the pruned value, and a page holding its own copy of the raw set would pass every hook test while deleting records behind the filter. Writing it surfaced that `filterByScope` fails open for unassigned records, so both fixtures are stamped to assessments — an unassigned finding is visible in every scope and can never go hidden. Also adds named-row delete tests (index-based probes pass even when a checkbox is bound to the wrong row) and indeterminate-state coverage.
feat/bulk select delete
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )