From 156e7d556543757c501498158f2defb284aedf51 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 13 Jul 2026 20:17:36 +0200 Subject: [PATCH] =?UTF-8?q?v0.127.1:=20escrow=20wizard=20polish=20?= =?UTF-8?q?=E2=80=94=20escrowed-card=20CTA=20as=20btn-outline,=20Hungarian?= =?UTF-8?q?=20preflight=20detail=20map=20(raw=20agent=20English=20only=20a?= =?UTF-8?q?s=20muted=20failure=20diagnostic),=20typed-back=20word=20highli?= =?UTF-8?q?ght=20(span-per-word,=20textContent-only),=20blur-on-verify=20t?= =?UTF-8?q?oggle?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 29 +++++++ controller/internal/web/escrow_wizard_test.go | 16 ++++ .../web/templates/backups_escrow.html | 80 ++++++++++++++++--- .../web/templates/backups_remote.html | 7 +- 4 files changed, 120 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 901b533..381cbc2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,34 @@ ## Changelog +### v0.127.1 — escrow wizard polish: CTA visibility + Hungarian preflight + typed-back highlight + blur-on-verify (2026-07-13) + +Four findings from Viktor's first supervised wizard passes (drill + demo). Presentation-only — +no endpoint, agent call, or state change; §10 red-proofs N/A. + +- **Escrowed-card CTA** (`backups_remote.html`): "Új helyreállítási kód készítése" is a real + `btn btn-sm btn-outline` secondary button (was an inline link inside the muted hint — nearly + invisible). Outline, NOT primary: escrowed is healthy, the CTA is available-not-urgent (the + stale variant stays primary). Render-tested. +- **Hungarian preflight details** (`backups_escrow.html` `pfDetail`): the agent's operator-English + `detail` strings no longer leak into the customer UI. OK rows keep only VALUE details (storage + id, age path; `staged_secret` → "előkészítve"); boolean-OK rows (dr_tier/hub_upload/sudo_grant) + render no detail; not-OK rows get the Hungarian explanation + the raw agent detail as a muted + diagnostic span; unknown ids fall back to the raw detail (never blank a failure); + `staged_secret` keeps its informational dot. Render test pins the not-staged copy + asserts the + three English literals never appear in the page source. +- **Typed-back highlight**: the code renders as span-per-word (createElement + textContent + + createTextNode ONLY — R still never flows through innerHTML; no parse context = no injection + surface); the two verification words get `var(--warn)` + 600 weight so they're findable on + paper. `verifyIdx` is now chosen BEFORE rendering. `finishWizard`'s `textContent=''` clears the + spans (child-node replacement — verified). +- **Blur-on-verify** (Part 4, optional — implemented; trivial to strike): first focus on either + verification input blurs the code (`filter: blur(6px)`, inline-style toggle — no style.css + change, no cache-bust) + a `btn-ghost` "Megjelenítés"/"Elrejtés" toggle. The typed-back now + exercises the WRITTEN copy, not screen transcription. R stays in the JS closure. + +JS behavior (spans/blur) is review-covered; the visual leg awaits Viktor's next login. All four +UI gates green. + ### v0.127.0 — customer-facing escrow ceremony wizard + stale-blob re-check (2026-07-13) — MinAgent: 0.88.0 (wizard only; everything else unchanged) The missing friend-alpha piece: the recovery-code ceremony moves from operator-SSH to a diff --git a/controller/internal/web/escrow_wizard_test.go b/controller/internal/web/escrow_wizard_test.go index 948fb92..3323b58 100644 --- a/controller/internal/web/escrow_wizard_test.go +++ b/controller/internal/web/escrow_wizard_test.go @@ -325,6 +325,10 @@ func TestEscrowTemplates_Render(t *testing.T) { "Ez a kód többé nem jeleníthető meg.", "nem ezen a szerveren", "biztonsági okból újra nem kérhető le", + // v0.127.1 polish: the Hungarian preflight detail map + the blur-on-verify toggle. + "nincs előkészített jelszó — a varázsló indításkor automatikusan előkészíti", + "a rendszerjogosultság hiányzik", + "Megjelenítés", } { if !strings.Contains(html, want) { t.Errorf("wizard missing %q", want) @@ -333,6 +337,13 @@ func TestEscrowTemplates_Render(t *testing.T) { if strings.Contains(html, "érvényét veszti") { t.Error("fresh wizard must not show the re-ceremony supersede warning") } + // v0.127.1: the agent's operator-English detail strings must never be hardcoded into the + // page — they may only arrive at runtime, inside the muted failure-diagnostic span. + for _, raw := range []string{"DR tier applied", "hub upload target configured", "sudo grant listed"} { + if strings.Contains(html, raw) { + t.Errorf("raw English agent detail %q leaked into the wizard page source", raw) + } + } }) t.Run("wizard re-ceremony variant", func(t *testing.T) { d := base() @@ -360,6 +371,11 @@ func TestEscrowTemplates_Render(t *testing.T) { if !strings.Contains(html, "Új helyreállítási kód készítése") { t.Error("escrowed card must offer the secondary re-ceremony link") } + // v0.127.1: the CTA is a real secondary BUTTON (outline — available-not-urgent), no longer + // an inline link buried in the muted hint. + if !strings.Contains(html, `class="btn btn-sm btn-outline">Új helyreállítási kód készítése`) { + t.Error("escrowed-card CTA must render as a btn-outline button") + } if strings.Contains(html, "Letét megerősítése") { t.Error("the deprecated manual-confirm button must be GONE from the card") } diff --git a/controller/internal/web/templates/backups_escrow.html b/controller/internal/web/templates/backups_escrow.html index 72872f2..2e7bbad 100644 --- a/controller/internal/web/templates/backups_escrow.html +++ b/controller/internal/web/templates/backups_escrow.html @@ -71,12 +71,13 @@ {{else if .OffboxConfigured}} -

A helyreállítási kód letétbe helyezve.{{if .EscrowAgentOK}} Új helyreállítási kód készítése{{end}}

+ {{/* v0.127.1: the re-ceremony CTA is a real secondary button (outline, NOT primary — escrowed + is a healthy state; available-not-urgent, unlike the stale variant above). */}} +
+

A helyreállítási kód letétbe helyezve.

+ {{if .EscrowAgentOK}}Új helyreállítási kód készítése{{end}} +
{{end}} {{if .OffboxConfigured}}