Release: develop -> main - #1176
Merged
Merged
Conversation
…h node (#1166) openDetail() reset detailError but not loadMoreError, and loadMoreError is only cleared inside loadNeighbors() — which handleActivate() runs solely for an expandable, not-yet-loaded node. So after a failed expand (e.g. HTTP 500), selecting a non-expandable or already-loaded node opened its panel without clearing the stale expand error, which then rendered under a node that never failed. Clear loadMoreError in openDetail() alongside detailError so the panel-scoped error stays scoped to the currently selected node.
github-actions
Bot
requested review from
TaprootFreak and
davidleomay
as code owners
July 12, 2026 09:06
…1177) * feat(realunit): REALU balance column in compliance list and detail Renders the api-resolved balance (share count) as a right-aligned column in the customer list and as a row in the KYC/Status panel; unknown balance (indexer unavailable) shows as a dash. * docs(realunit): note the deliberate check-evidence exception in the dto header
…st (#1179) * feat(realunit): default-hide empty and internal test accounts in compliance customer list * simplify to a single empty-accounts toggle; fail open on unresolved balance * require untouched kycStatus in empty filter; test screen and edge cases - isEmptyAccount now also requires kycStatus 'NA', so a level-0 account with a compliance-relevant status (e.g. Check/Rejected/Terminated) can never be hidden as empty - pin filter edge cases: numeric wire-format kycLevel, empty and non-numeric level strings, empty-string name/mail, fractional and negative balances - add component tests for the screen wiring: default filter, toggle, search bypass, and both empty-state messages - render the hide-empty toggle only when there is something to hide - e2e fixtures: mirror the balance field, add an empty account, assert default-hide and search-bypass behaviour * regenerate realunit compliance search baseline The summary bar and the extended fixture set (balance values, one empty account) change the rendered search state; baseline regenerated on macOS against the local api stack. * fail open on missing kycLevel; test filter re-engagement after cleared search A missing (undefined/null) kycLevel now counts as unresolved and keeps the account visible, matching the balance fail-open semantics; only a resolved level of 0 counts as no progress. New component test pins that clearing an active search re-engages the default filter and re-renders the toggle. * treat blank kycLevel as unresolved; pin null-level fail-open; clarify toggle persistence A blank/whitespace-only level string is a degenerate wire value, not a resolved level, and now fails open to visible like missing levels. The JSON-null case is pinned by its own test. The screen comment now states that the toggle state deliberately persists across searches. * use single quotes for a test title (prettier) --------- Co-authored-by: TaprootFreak <142087526+TaprootFreak@users.noreply.github.com>
Author
🤖 PR Review Bot❌ Security: 1 critical vulnerabilitiesThis is an automated review. Please address the issues above. |
…anual checks (#1180) * feat(scorechain): add compliance screening view with deep-link from manual checks Add a compliance-only page (compliance/scorechain/user/:id) that lists all of a customer's Scorechain screenings with risk score, severity, signature validity and the per-analysis exposure breakdown, and make the internal ScorechainHighRisk manual-check signal a clickable deep-link into it (highlighting the screening of the flagged transaction). - useScorechain hook (getUserScreenings, retriggerBuyCrypto) via the generic authenticated call — no SDK release needed - frontend scorechain DTO mirroring the api response (severity bands + sentinels, context, trigger, object/analysis type); unknown values render neutral, never crash - clickable ScorechainHighRisk in the AML manual-check panel and the shared TransactionDetailRows (optional, all existing callers unchanged) - per-screening re-screen action behind a cost-warning confirm - de/fr/it translations; unit tests for the detection predicate and highlight parsing * fix(scorechain): use a dedicated risk badge for isHighRisk (red when true) * fix(scorechain): focus the fresh screening after a re-screen * fix(scorechain): correct medium-risk color class and translate error strings * refactor(scorechain): move helpers into a util so the dto is types-only
…1185) * fix(deps): override tar and websocket-driver to clear critical advisories npm audit flags 2 critical vulnerabilities, both transitive: - tar (<=7.5.18, pulled by swarm-js) — path traversal / arbitrary file write - websocket-driver (<=0.7.4) — resource-limit bypass / message corruption Pin both to patched versions via the existing overrides block. websocket-driver 0.7.5 is a clean patch bump; tar is forced across the major (swarm-js pulls tar@4, a web3/Swarm transitive that is not exercised in the browser build). The lockfile regeneration follows in a separate commit. * chore(deps): regenerate lockfile for tar/websocket-driver overrides npm audit: critical 2 -> 0 (tar 4.x -> 7.5.21, websocket-driver 0.7.4 -> 0.7.5). Verified on Node 20: build succeeds and all 422 tests pass.
* ci: dual-deploy to Cloudflare Pages alongside Azure Add a wrangler 'pages deploy' step to prd.yml/dev.yml that deploys the build to the Cloudflare Pages projects (dfx-app-prd on main, dfx-app-dev on develop) in addition to the existing Azure Blob upload. The Azure deploy stays during the transition so the live app is never frozen; a follow-up removes it after the DNS cutover to Pages is verified. Add public/_headers and public/_redirects so the Pages deployment replicates the CDN cache/CORS semantics (immutable hashed assets, no-cache entry points, cross-origin widget) and serves the SPA deep-link fallback (/* -> /index.html). * ci: cache widget assets for 1h on Pages to match the previous CDN The embedded widget was served with max-age=3600 by the CDN; add the same Cache-Control to /widget/* in public/_headers so the Pages deployment keeps that behavior instead of Pages' default.
#1186) * fix: reload once on ChunkLoadError to recover stale chunks after a deploy A new deploy replaces the content-hashed chunks. A tab left open across a deploy can request a chunk that no longer exists; the static host serves index.html (200) for it, which surfaces as a ChunkLoadError. Add a global handler in index.tsx that reloads the page once (guarded against a reload loop via sessionStorage) so the tab picks up the new chunks. Listens on both 'error' and 'unhandledrejection'. * fix: make the ChunkLoadError guard loop-safe on session/login URLs Review (Codex) found a high-severity loop: the guard key lived in sessionStorage, but index.tsx calls sessionStorage.clear() on session/login URLs (address+signature or session param), which wiped the guard on every reload — a persistent chunk error on such an entry point looped unbounded. Move the guard to localStorage (survives the clear()), wrap storage access in try/catch (embedded/iframe contexts can block it, and skip the reload then to avoid an unguarded loop), and widen the window to 30s so a persistent failure reloads at most once per window.
TaprootFreak
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automatic Release PR
This PR was automatically created after changes were pushed to develop.
Commits: 1 new commit(s)
Checklist