[cristim]

Summary

Seven frontend form, secret-handling and accessibility fixes in the users, API keys, auth and recommendations views.

Closes #274
Closes #717
Closes #732
Closes #733
Closes #735
Closes #736
Closes #746

Issue	Fix
#274	The synthetic current-user row has Edit, Delete, selection and group toggles disabled, is skipped by select-all, and carries the session MFA state
#717	API key revoke and delete failures show as a toast when the create modal is closed
#732	API key creation is disabled while in flight; the API key and MFA recovery code views cannot be closed (Escape, Cancel, Save, Enter, closeModal) until the user acknowledges the secret
#733	Enter in the forgot-password form sends the reset instead of submitting the login handler
#735	Account and user Save buttons are disabled while their requests are in flight
#736	Group membership toggles ask for confirmation; an admin removing their own Administrators membership is warned (keyed on user id); declining reverts without an API call
#746	Users and recommendations table checkboxes get distinguishing aria-labels, including the payment option

Verification evidence (independent reviews, local build and tests at the head SHA) is posted as PR comments.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 16 billable files and costs up to $4.00.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 35 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 88 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: bea92e0f-d45a-4145-a8e9-3fc5d46a5feb

📥 Commits

Reviewing files that changed from the base of the PR and between d9b2aa7 and e8ba070.

📒 Files selected for processing: 16

• frontend/src/__tests__/apikeys.test.ts
• frontend/src/__tests__/auth-mfa-enroll.test.ts
• frontend/src/__tests__/auth.test.ts
• frontend/src/__tests__/recommendations.test.ts
• frontend/src/__tests__/settings-accounts.test.ts
• frontend/src/__tests__/users.test.ts
• frontend/src/apikeys.ts
• frontend/src/auth.ts
• frontend/src/modal.ts
• frontend/src/recommendations.ts
• frontend/src/settings.ts
• frontend/src/users/userActions.ts
• frontend/src/users/userList.ts
• frontend/src/users/userModals.ts
• frontend/tests-e2e/execute-now-warning.spec.ts
• frontend/tests-e2e/recommendations.spec.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Merge gate at e8ba0709dfeb4d92f707e0730598fd0fe419f323

Independent review 1 (cold brief, non-author): APPROVE 57f2752b678444be63f1e511b95acf755f9712c4 (pass 1 APPROVE at 3eeb9067, pass 2 on the delta)

Pass 1 verified #732 secret views cannot be dismissed before acknowledgement by any path (Escape via closeModal, Cancel and Save disabled, implicit Enter blocked, no backdrop handler on either modal, flag cleared only by the acknowledgement buttons, both enroll and regenerate flows), the synchronous createInFlight mint guard, #733 listener swap, #735 try/finally re-enable, #274, #717 and #746. Mutations killed: closeModal ack guard, createInFlight early return and reset, forgot-password listener, self-demotion detection, both Save re-enables. Survivor: login removeEventListener removal.

Pass 2: 4dd0aeb2 label built from non-empty parts with engine and formatPayment (through escapeHtml); 60bb028f post-dialog re-validation and select-all disable; 57f2752b closes the surviving mutant. Mutations killed: engine branch dropped; latestError re-check disabled; select-all disabled removed; removeEventListener deleted. Targeted jest 721/721.

Pass 3 at e8ba0709dfeb4d92f707e0730598fd0fe419f323: APPROVE. The unknown payment is omitted from the label (one source line; escapeHtml still applied). recommendations.test.ts and xss-recommendations-payment.test.ts pass (419/419). Mutation: restoring formatPayment(rec.payment) fails the XSS test.

Independent review 2 (cold brief, non-author): APPROVE 57f2752b678444be63f1e511b95acf755f9712c4 (pass 1 REQUEST_CHANGES at 3eeb9067)

Pass 1 findings and resolution, each re-checked by the reviewer with a mutation probe that fails a test:

1. Row checkbox name omitted engine (RDS rows differing only by engine collided): fixed in 4dd0aeb2.
2. Unmapped payment dropped from the name, trailing space: fixed in 4dd0aeb2 (formatPayment, empty parts filtered).
3. Post-dialog groupsToSave not re-validated (ci: run the Go and Docker heavy jobs on ubuntu-24.04-arm #1405 view-only plus write combination): fixed in 60bb028f.
4. Select-all users enabled with only the synthetic row: fixed in 60bb028f.
   5-6. Pre-existing stale allUsers on rapid in-flight toggles; fix(frontend): account, user and registration forms can be double-submitted #735 registration form note: not introduced here.

Pass 2 low finding: the reviewer reported that removing the login removeEventListener left the auth tests green. Orchestrator check against an export of this exact SHA: auth.ts has two such calls. Removing the forgot-password one (auth.ts:836, the #733 swap) fails "Enter in the reset form never runs the login handler (issue #733)" (1 failed, 55 passed). Removing the MFA-step one (auth.ts:773, not part of #733) leaves 56 passing, which is the probe the reviewer most likely ran. The #733 guard holds; finding closed as not reproducible for the #733 line.

Reviewer confirmed: its probe had removed :773; re-run deleting only :836 fails the #733 test. Finding withdrawn.

Pass 3 at e8ba0709dfeb4d92f707e0730598fd0fe419f323: APPROVE. The full local jest run at 57f2752b caught xss-recommendations-payment.test.ts failing: the formatPayment fallback put a raw unknown payment into the aria-label. e8ba0709 goes back to known display labels only, keeping the engine part and the clean join. recommendations.test.ts and xss-recommendations-payment.test.ts pass (419 tests). Nit: two rows that differ only by an unmapped payment share a name (accepted trade-off).

Local verification (macOS, exact head):

• npm ci, npm run build, npm run lint (0 errors) and npx jest (108 suites, 3423 passed, 1 skipped) all pass.
• The full jest run at 57f2752b is what caught the xss-recommendations-payment.test.ts regression fixed in e8ba0709.
• The worktree also holds five staged files from someone else's parked work. None are in this PR's commits; they are recorded in the fleet's needs-user file.

CI: all checks are green at this SHA, including Frontend E2E with the updated checkbox locators.

Threads: none open. CodeRabbit is waived as a merge gate.

[cristim]

Combined check before merge: a9e54751 + #1132 (c565be0f) + this PR (e8ba0709) merges cleanly. On that tree (adf2aa7d), npx tsc --noEmit, npm run build and npx jest pass (108 suites, 3452 passed, 1 skipped). Main has since gained #1134 (backend only) and the #1132 squash, which has the same frontend content. GitHub reports this PR MERGEABLE/CLEAN against current main.