Repository navigation
Audit follow-ups: criteria stepper, risk scale reload, direct delete links, assessment phases - #182
Merged
Merged
Conversation
RiskCriteria runs the default lifecycle, but its detail view lacked LifecycleStepperMixin and its template the shared stepper include, so a criteria set could not be submitted, validated or archived from the interface. Both are added, with a test on the transition URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FaEkJnhS3VNDeb6jrdn6MC
The risk form reloaded the likelihood / impact choices of the chosen assessment from an inline script bound to DOMContentLoaded: it never ran in the drawer (the way risks are created) nor after a boosted navigation, and on the page it rewrote options TomSelect no longer displayed. The behaviour is now declared on the form (data-scale-source on the assessment, data-scale-target on the four scales) and wired once in base.html by a delegated change listener that refreshes plain and TomSelect-enhanced selects alike. The form's fallback to "a validated criteria set" goes through reportable() instead of a state literal. Security: the scale endpoint looked the assessment up without the user's scopes, so it disclosed the scale labels of any assessment; it now answers with the defaults for an assessment the user cannot see. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FaEkJnhS3VNDeb6jrdn6MC
…dwork phases The result toggle view decided "planning" from a tuple of statuses and the results table decided "fieldwork" by comparing assessment.status == 'in_progress' in the template, two copies of one rule. ComplianceAssessment now exposes is_planning_phase and is_fieldwork_phase, built on ASSESSMENT_PLANNING_STATUSES / ASSESSMENT_FIELDWORK_STATUSES next to the existing toggleable set, and both the view and the template read them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FaEkJnhS3VNDeb6jrdn6MC
Thirteen delete views (ten in incidents, the nonconformity register, supplier contacts and sub-processors) only had a drawer template, so opening their /delete/ URL directly (a bookmark, a shared link) returned the bare modal fragment outside the page. Their templates now extend delete_shell, which the new ConfirmDeleteShellMixin sets to the modal shell for a drawer request and to includes/confirm_delete_page.html otherwise; both shells read the same blocks, so the wording, consequences and protection notices are identical. The page shell posts without hx-boost, so its form performs a plain POST and redirect (a boosted POST would get the drawer's 204). is_drawer_request() is extracted from HtmxFormMixin and shared. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FaEkJnhS3VNDeb6jrdn6MC
Neither page had a NAV_TREE entry, so their headers fell back to a plain eyebrow, and the hub's read "Strategy" although it is reached from Administration > General. Both now build the menu breadcrumb. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FaEkJnhS3VNDeb6jrdn6MC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up fixes for the defects noticed during the UX/UI audit (#181) but kept out of it: a missing lifecycle stepper, a risk form behaviour that never worked where risks are actually created (plus the scope leak behind it), drawer delete links that rendered a bare fragment, a status literal in the assessment results, and two missing breadcrumbs.
Related issue
Follow-up to #181.
Type of change
Changes
48bdb99Risk criteria stepper: the criteria detail view lackedLifecycleStepperMixin, so a criteria set could not be submitted, validated or archived from the interface.ec8d4eaRisk scales reload: choosing another assessment on a new risk reloads its likelihood / impact scales in the drawer, on the page and after a boosted navigation. The behaviour is declared on the form (data-scale-source/data-scale-target) and wired once inbase.html(TomSelect-aware); the inlineDOMContentLoadedscript, which never ran in the drawer, is gone. Security: the scale endpoint now applies the user's scopes before reading an assessment's criteria. The "validated criteria" fallback usesreportable().b3c1a16Assessment phases:ComplianceAssessment.is_planning_phase/is_fieldwork_phasereplace a status tuple in the toggle view andassessment.status == 'in_progress'in the results template.bbf42acDrawer delete links: thirteen drawer-only delete views render a full confirmation page on a direct visit (ConfirmDeleteShellMixin+{% extends delete_shell %}), with the same wording; the page form posts withouthx-boostso it redirects. Documented indocs/sdk/ui-components.md.887da21Breadcrumbs: NAV_TREE entries for the Trust Center hub and the semantic index.Screenshots
The direct visit to an incident delete URL now renders the confirmation page (checked at 390 px dark: page shell, consequences kept, Cancel left, Delete right). The scale reload was exercised in a browser, in the drawer and after a boosted navigation, with a stubbed endpoint returning distinct scales: the TomSelect options are replaced.
Checklist
pytestpassesruff checkpassesmcp/tools.py(accurate docstrings and parameter descriptions)api/(serializers, viewsets, routes under/api/v1/)_()/{% trans %}with French translations inlocale/fr/LC_MESSAGES/django.po(no duplicatemsgid;compilemessagespasses)README.mdupdated (features, MCP tools, tech stack, install) when behaviour changedCHANGELOG.mdupdated under## [Unreleased]docs/brand/brand-guidelines.md); no em dash charactersdocs/specs/updated in the same PRNot applicable: no new capability (no MCP tool, endpoint, README or spec change; no new string), and no documented screen changed appearance. Full suite: 3,271 passed;
generate_docs --checkandbuild_wiki.py --checkclean.Left for a decision: the EBIOS RM spec sets no ordering between workshops, so W4 / W5 can be started while W3 is in progress; not changed here.
🤖 Generated with Claude Code
https://claude.ai/code/session_01FaEkJnhS3VNDeb6jrdn6MC