fix(canvas/a11y): aria-hidden SVGs, MissingKeysModal dialog semantics, session cookie auth - #1992
Merged
Merged
Conversation
…, session cookie auth Three fixes cherry-picked from issue #1744: 1. aria-hidden on decorative SVG icons: - DeleteCascadeConfirmDialog.tsx: warning triangle SVG gets aria-hidden="true" - MissingKeysModal.tsx: warning triangle SVG gets aria-hidden="true" Both are purely decorative; adjacent text labels provide context. 2. MissingKeysModal dialog semantics: - role="dialog", aria-modal="true", aria-labelledby="missing-keys-title" on modal - id="missing-keys-title" added to the h3 heading - requestAnimationFrame focus trap: auto-focus title element when modal opens - Also removes stale aria-describedby={undefined} from CreateWorkspaceDialog.tsx 3. Session cookie auth for /registry/:id/peers: - Adds VerifiedCPSession() fallback in validateDiscoveryCaller() after bearer token check - Fixes SaaS canvas Peers tab 401 — canvas hits this endpoint via session cookie - Self-hosted bypass logic preserved - Exports VerifiedCPSession from session_auth.go for cross-package use Test fix (bundled, same branch): - ContextMenu keyboard test: add getState() stub to useCanvasStore mock - Required after ContextMenu.tsx gained a direct getState() call at line 169 GitHub issue: #1740 (test), #1744 (a11y) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
molecule-ai Bot
added a commit
that referenced
this pull request
Apr 24, 2026
…, session cookie auth (#1992) fix(canvas/a11y): aria-hidden SVGs, MissingKeysModal dialog semantics, session cookie auth Three fixes cherry-picked from issue #1744: 1. aria-hidden on decorative SVG icons: - DeleteCascadeConfirmDialog.tsx: warning triangle SVG gets aria-hidden="true" - MissingKeysModal.tsx: warning triangle SVG gets aria-hidden="true" Both are purely decorative; adjacent text labels provide context. 2. MissingKeysModal dialog semantics: - role="dialog", aria-modal="true", aria-labelledby="missing-keys-title" on modal - id="missing-keys-title" added to the h3 heading - requestAnimationFrame focus trap: auto-focus title element when modal opens - Also removes stale aria-describedby={undefined} from CreateWorkspaceDialog.tsx 3. Session cookie auth for /registry/:id/peers: - Promotes VerifiedCPSession() fallback before the bearer token branch - Fixes SaaS canvas Peers tab 401 — canvas hits this endpoint via session cookie - Correctly returns "invalid session" for bad cookies instead of falling through - Self-hosted bypass logic preserved Test fix (bundled, same branch): - ContextMenu keyboard test: add getState() stub to useCanvasStore mock - Required after ContextMenu.tsx gained a direct getState() call at line 169 Reviewed-by: Core-Security (security audit: APPROVED) CI: Canvas CI ✅, Platform CI ✅, E2E API ✅, CodeQL ✅ GitHub issue: #1740 (test), #1744 (a11y) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Canvas accessibility fixes — WCAG 2.1 dialog semantics, aria-hidden on decorative SVGs, session cookie auth in discovery handler.
Changes
canvas/src/components/
MissingKeysModal.tsx:role="dialog",aria-modal="true",aria-labelledby, initial focus trapToolbar.tsx:aria-hidden="true"on decorative SVG iconsContextMenu.tsx:type="button"on menu item buttons, keyboard test mock fix (getState stub)CreateWorkspaceDialog.tsx: remove stalearia-describedbypointing to removed elementcanvas/src/components/tests/
MissingKeysModal.a11y.test.tsx: 12 WCAG 2.1 dialog tests (role, aria-modal, aria-labelledby, focus trap, backdrop)ContextMenu.keyboard.test.tsx: keyboard navigation tests with getState() mockworkspace-server/internal/handlers/
discovery.go: fixVerifiedCPSessioncondition — return nil only when (valid=true, presented=true); return 401 on invalid session; dev-mode fail-open gateCommits (6 total)
3cdd60e2fix(canvas/a11y): aria-hidden SVGs, MissingKeysModal dialog semantics, session cookie auth3dee3630fix(canvas): add getState() stub to two remaining store mocks02bf1876fix(workspace-server): remove duplicate VerifiedCPSession declarationa6eb250afix(workspace-server): correct VerifiedCPSession condition in discovery.go[canvas refactor]Canvas.tsx, WorkspaceNode.tsx, canvas store/handler updates[test additions]MissingKeysModal a11y tests, ContextMenu keyboard testsTest plan
npm test -- --testPathPattern="canvas"— all pass🤖 Generated with Claude Code