Compliance portal document pages

[codenem]

Summary by cubic

Build the Trust Center Documents page with All/Public/Private tabs, grouped sections, and inline access actions. Adds a visibility filter to the trust v1 GraphQL API and ships v2 Tabs and Toaster (mounted app‑wide), plus follow‑ups for preload/tab sync, shared export helpers, and small UI polish.

Coredata +10 -0

• Add WithTrustCenterVisibilities(...) to DocumentFilter and AuditFilter to request specific visibility slices.

GraphQL API +41 -11

• Add TrustCenterVisibility enum and TrustCenterVisibilityFilter input.
• Add optional filter to TrustCenter.documents, audits, and trustCenterFiles; default to public+private when omitted.

Service +14 -8

• Allow Documents.ListForOrganizationId and Audits.ListForOrganizationId to accept an optional filter (defaulting to trust‑center filters when nil).
• Update compliance_page_service call sites to pass nil for unchanged behavior.

Package: ui +527 -7

• Add v2 Tabs on @base-ui/react/tabs (Tabs, TabsList, TabsTab, TabsIndicator, TabsSkeleton) and v2 Toaster on @base-ui/react/toast with per‑type icons and stories.
• Polish: Toaster close gets focus ring and wraps content; TabsSkeleton fixes prop spread/aria handling.

Other +1228 -35

• Add documents route (/documents) with loader and skeleton; localize page/UI strings (en/fr).
• Build documents page: unify documents, audit reports, and uploaded files; group by type/category with section headers.
• Toolbar: All/Public/Private tabs persisted in URL; reconcile against preload variables and refetch on change; dim results while loading; extract shared documentsLayout tv variant for page and skeleton.
• Implement export‑and‑view flows via a shared useExportAndOpen hook; show “View”, “Access requested”, or inert “Get Access”.
• Mount global toaster (Toast.Provider + <Toaster />) in the app root; add common.error i18n keys.
• Header band: add flushBottomSpace to align tab bars; wire new documentRoutes and remove the old placeholder route.
• Subprocessors: set a 64px min‑height on the toolbar and make the band flush; skeleton uses SelectSkeleton/TextFieldSkeleton; reuse shared groupBy helper.

^{Written for commit 99990d6. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 46 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/compliance-portal/src/pages/documents/DocumentsPageLoader.tsx">

<violation number="1" location="apps/compliance-portal/src/pages/documents/DocumentsPageLoader.tsx:36">
P2: The first result can be displayed under the wrong tab when the URL changes while this preload is pending: `initialVariables` remains on the old tab, and `DocumentsPage` treats its first render as already synchronized and skips refetching. Passing the loaded tab through to the page or coordinating the initial refetch would keep the URL filter and displayed slice consistent.</violation>
</file>

<file name="apps/compliance-portal/src/pages/documents/_lib/openExportedFile.ts">

<violation number="1" location="apps/compliance-portal/src/pages/documents/_lib/openExportedFile.ts:28">
P1: Viewing a Trust Center file with an active MIME type can execute its uploaded HTML/SVG content because the returned MIME is used directly for a navigated Blob URL. Restrict inline navigation to an explicit safe allowlist such as PDF, or force untrusted/non-previewable types to download with `application/octet-stream`.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Viewing a Trust Center file with an active MIME type can execute its uploaded HTML/SVG content because the returned MIME is used directly for a navigated Blob URL. Restrict inline navigation to an explicit safe allowlist such as PDF, or force untrusted/non-previewable types to download with application/octet-stream.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/compliance-portal/src/pages/documents/_lib/openExportedFile.ts, line 28:

<comment>Viewing a Trust Center file with an active MIME type can execute its uploaded HTML/SVG content because the returned MIME is used directly for a navigated Blob URL. Restrict inline navigation to an explicit safe allowlist such as PDF, or force untrusted/non-previewable types to download with `application/octet-stream`.</comment>

<file context>
@@ -0,0 +1,42 @@
+  const commaIndex = dataUri.indexOf(",");
+  const base64 = commaIndex === -1 ? dataUri : dataUri.slice(commaIndex + 1);
+  const mimeMatch = dataUri.match(/^data:([^;]+);/);
+  const mimeType = mimeMatch?.[1] ?? "application/octet-stream";
+
+  const binary = atob(base64);
</file context>

[cubic-dev-ai]

P2: The first result can be displayed under the wrong tab when the URL changes while this preload is pending: initialVariables remains on the old tab, and DocumentsPage treats its first render as already synchronized and skips refetching. Passing the loaded tab through to the page or coordinating the initial refetch would keep the URL filter and displayed slice consistent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/compliance-portal/src/pages/documents/DocumentsPageLoader.tsx, line 36:

<comment>The first result can be displayed under the wrong tab when the URL changes while this preload is pending: `initialVariables` remains on the old tab, and `DocumentsPage` treats its first render as already synchronized and skips refetching. Passing the loaded tab through to the page or coordinating the initial refetch would keep the URL filter and displayed slice consistent.</comment>

<file context>
@@ -0,0 +1,47 @@
+
+  // Seed the first fetch with the URL's tab; later changes are handled by the
+  // page's refetch.
+  const initialVariables = useRef(toQueryVariables(tab));
+
+  useEffect(() => {
</file context>