6 Commits

Author SHA1 Message Date
fs
87652e55da refactor(system-info): reduce to Stripe-style status page
Reduce admin/system-info to a single focused status view: overall
status banner, components list from existing health checks, and an
environment meta table. Drops the Modules and Permissions tabs —
those were dev-diagnostics already available via CLI.

- Remove SystemInfoService + its test; wire the action directly to
  SystemHealthService and build meta inline
- Extend SystemHealthService with per-check label + description so
  the UI speaks in customer terms while the CLI doctor path stays
  compatible
- Rebuild the view on existing app-stats-table + app-empty-state
  primitives; add a small app-status-banner component for the
  headline signal
- Align help-center nav label and i18n keys (de/en)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-24 16:32:46 +02:00
fs
576a0c51cd feat(guards): add GR-SEC-010 — output escaping enforcement in views
Add architecture test ViewLayerOutputEscapingContractTest that flags
raw <?php echo in .phtml files. Legitimate uses (pre-built ARIA attrs
from navActive(), hardcoded role values, pre-rendered HTML fragments)
must carry an inline // raw-html-ok: reason marker.

Annotated all 11 existing raw echo sites with justification markers.
Added guard to catalog, enforcement map (automated), CLAUDE.md security
section, and never-do-this list.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 12:08:25 +02:00
fs
376cf67c31 fix(help-center): resolve API docs visibility via layout provider
The api_docs.view ability was missing from layoutAuth after removing
the sidebar.admin_nav_item slot from the api-docs module. Add a
HelpCenterLayoutProvider that checks the ability via AuthorizationService
and provides the result in layout nav context (help-center.nav). Panel
template now reads can_view_api_docs from the provider instead of
layoutAuth.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 14:41:17 +01:00
fs
0bb8702019 fix(help-center): persist details open/closed state via localStorage
Add details_storage and details_open_active to the aside.tab_panel
slot declaration, matching the admin panel pattern. Section disclosure
state is now saved and restored across page loads.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 14:34:43 +01:00
fs
304924368b fix(help-center): replace inline content with standard navigation panel
Rewrite help panel to use the same grouped navigation pattern as the
admin aside panel (details/summary with nav links). Remove inline
keyboard shortcuts table and about section. Panel now shows
permission-gated navigation groups: Documentation (docs viewer, API
docs) and System (system info). Remove custom CSS — panel inherits
existing app-sidebar-admin-nav styling.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 14:25:01 +01:00
fs
d068efa65c feat(help-center): add help panel to sidebar icon bar
New help-center module adds a question-mark icon to the sidebar with
an aside panel containing three sections: Documentation (permission-
gated links to docs viewer and API docs), Keyboard Shortcuts (inline
reference from HotkeyService with Mac/Win variants), and About
(application info). Visible to all logged-in users — individual
resource links respect existing permissions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 14:19:08 +01:00