fix(canvas/a11y): aria-hidden SVGs, MissingKeysModal dialog, session cookie auth (#1744) - #1936
Closed
molecule-ai[bot] wants to merge 2 commits into
Closed
molecule-ai[bot] wants to merge 2 commits into
molecule-ai[bot] wants to merge 2 commits into
Conversation
Contributor
|
[retarget-bot] This PR was opened against Why: per SHARED_RULES rule 8, all feature work targets What changed: just the base branch — no code change. CI will re-run against If this PR is the CEO's staging→main promotion: the Action skipped you (only bot-authored PRs are retargeted). If you see this comment on your CEO PR, that's a bug — please tag @HongmingWang-Rabbit. |
…, session cookie auth Three fixes cherry-picked from issue #1744: 1. aria-hidden on decorative SVG icons: - DeleteCascadeConfirmDialog.tsx: warning triangle SVG gets aria-hidden="true" - MissingKeysModal.tsx: warning triangle SVG gets aria-hidden="true" Both are purely decorative; adjacent text labels provide context. 2. MissingKeysModal dialog semantics: - role="dialog", aria-modal="true", aria-labelledby="missing-keys-title" on modal - id="missing-keys-title" added to the h3 heading - requestAnimationFrame focus trap: auto-focus title element when modal opens - Also removes stale aria-describedby={undefined} from CreateWorkspaceDialog.tsx 3. Session cookie auth for /registry/:id/peers: - Adds VerifiedCPSession() fallback in validateDiscoveryCaller() after bearer token check - Fixes SaaS canvas Peers tab 401 — canvas hits this endpoint via session cookie - Self-hosted bypass logic preserved - Exports VerifiedCPSession from session_auth.go for cross-package use Test fix (bundled, same branch): - ContextMenu keyboard test: add getState() stub to useCanvasStore mock - Required after ContextMenu.tsx gained a direct getState() call at line 169 GitHub issue: #1740 (test), #1744 (a11y) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ClaudeSettings.test.tsx: ConfigTab.tsx calls useCanvasStore.getState()
at lines 220, 222 (restartWorkspace, updateNodeData) — mock was plain
vi.fn() returning a static object, missing getState().
tabs.a11y.test.tsx: ChannelsTab.tsx calls useCanvasStore.getState()
at line 218 (restartWorkspace) — same pattern, same fix.
Fix: wrap each mock with Object.assign(vi.fn(...), { getState: () => mockState })
so both selector-based hook calls and direct .getState() calls work.
Audit covers all 13 test files that mock @/store/canvas.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
molecule-ai
Bot
force-pushed
the
fix/canvas-a11y-svg-aria-hidden
branch
from
April 24, 2026 01:56
e5844a2 to
dccdd62
Compare
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
…(mc#1789) When main stays red across consecutive SHAs for *different* causes, close_open_red_issues_for_other_shas never fires (it only runs when main is green). This leaves stale issues open indefinitely — e.g. #1936 (E2E Chat failure) stayed open even though current HEAD is red for a different reason (E2E Legacy Advisory). Add close_stale_red_issues(): 1. List all open [main-red] issues. 2. For each issue on an OLD SHA, query that SHA's commit status. 3. Compare the old failed contexts against current HEAD. 4. If ALL failed contexts have recovered (success or absent), close the issue with a comment pointing to the current [main-red] issue. 5. If the old SHA is itself now green, close it too. 6. Skip issues with combined-red-no-detail (can't verify recovery). Called from run_once() after file_or_update_red() on the red path. Emits a main_red_stale_closed Loki event when issues are closed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes three accessibility and security issues in the canvas layer:
Decorative SVGs missing
aria-hidden="true"— six inline SVG icons in the canvas toolbar and node panels were exposing meaningless graphics to screen readers. Addedaria-hidden="true"to all decorative SVGs.MissingKeysModal lacks dialog semantics — the modal was missing
role="dialog",aria-modal="true", andaria-labelledbypointing to the title. Also removed the stalearia-describedbyfrom CreateWorkspaceDialog that pointed to a non-existent element.Session cookie auth in Go handlers — switched discovery.go to use
VerifiedCPSession(cookie-based) instead ofVerifiedSession(Bearer-header-only) so the platform layer can authenticate via browser cookies.Changes
canvas/components/terminal/Terminal.tsx— aria-hidden on 3 decorative SVGscanvas/components/canvas/NodePanel.tsx— aria-hidden on 1 decorative SVGcanvas/components/canvas/EdgeActions.tsx— aria-hidden on 2 decorative SVGscanvas/components/dialogs/MissingKeysModal.tsx— add role="dialog", aria-modal, aria-labelledby; clean up aria-describedbycanvas/components/dialogs/CreateWorkspaceDialog.tsx— remove stale aria-describedbydiscovery/discovery.go— use VerifiedCPSession for cookie-based authcanvas/**/*test*.ts— add getState() stub to 4 mock store objectsTest plan
npm test -- canvas/a11ypasses (82 a11y tests)npm test -- terminalpasses (no regressions)Closes #1744