fai/chain-studio
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(workspace): sealed-area names are confidential by default
Some checks failed
Security / Security check (push) Failing after 2s
Details

Browse source 
The switcher listed sealed areas by name ('lbs', 'stromnetz') on
any glance or screenshot — but the names themselves often carry
client/mandate identity (usertest security finding). The sealed
section now renders one aggregated row ('2 sealed areas') with a
deliberate 'Show names' reveal per menu opening; selection still
pops the regular s:<slug> value. Settings -> Security gains 'list
sealed areas with their names right away' (WorkspacePrefs,
SidebarPrefs pattern, default off).

The aggregate row wraps to two lines — popup menus cap their
width and action texts must never be truncated (the first cut
showed '1 abgeschotte…' in the proof shot). Guard: switcher tests
cover aggregated-until-reveal and the Settings toggle; the old
direct-listing test now asserts the reveal contract. DE+EN.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
This commit is contained in:
flemming-it 2026-07-19 03:34:05 +02:00
parent ed680c507a
commit 588f437395
11 changed files with 370 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

32
lib/data/workspace_prefs.dart Normal file
View file

@ -0,0 +1,32 @@
// Workspace display preferences (SidebarPrefs pattern: eager
// ValueNotifier + SharedPreferences persistence, loaded once at
// startup).
import 'package:flutter/foundation.dart';
import 'package:shared_preferences/shared_preferences.dart';
class WorkspacePrefs {
WorkspacePrefs._();
static const _kSealedNamesKey = 'workspace.sealed_names_visible';
/// Whether the workspace switcher lists sealed areas with their
/// names right away. Default FALSE: area names often carry
/// client/mandate identity, so the switcher shows an aggregated
/// row ("2 sealed areas") until the operator deliberately
/// expands it (usertest security finding). The Settings toggle
/// restores the direct listing for single-operator machines.
static final ValueNotifier<bool> sealedNamesVisible =
ValueNotifier(false);
static Future<void> load() async {
final prefs = await SharedPreferences.getInstance();
sealedNamesVisible.value = prefs.getBool(_kSealedNamesKey) ?? false;
}
static Future<void> setSealedNamesVisible(bool value) async {
sealedNamesVisible.value = value;
final prefs = await SharedPreferences.getInstance();
await prefs.setBool(_kSealedNamesKey, value);
}
}