Skip to content

fix: make print styles omit secrets and interactive controls - #1500

Open
Fading-Dev wants to merge 8 commits into
Streampay-Org:mainfrom
Fading-Dev:security/issue-1429-quality-2-high-make-print-styles-omit-secrets
Open

fix: make print styles omit secrets and interactive controls#1500
Fading-Dev wants to merge 8 commits into
Streampay-Org:mainfrom
Fading-Dev:security/issue-1429-quality-2-high-make-print-styles-omit-secrets

Conversation

@Fading-Dev

Copy link
Copy Markdown

Overview

This PR makes print output least-privilege by ensuring secrets and interactive controls are omitted from printed pages. Wallet addresses, copy controls, command palette, bottom navigation, theme toggle, and wallet modal triggers are hidden only in @media print. The change is deterministic and stateless: screen rendering, wallet actions, and existing component APIs are unchanged, while print-specific CSS/classes and data-print-* hooks provide a single enforcement layer that is reviewable and testable.

Related Issue

Changes

🖨 Print-Style Secret & Control Omission

  • [ADD] app/globals.css

    • Define .print-no utility and @media print rules that apply display: none !important to secret-bearing and interactive selectors.
    • Scope rules to known components and data-print-* attributes to avoid broad display changes.
    • Preserve layout and screen media output exactly as before.
  • [MODIFY] app/components/CopyAddress.tsx

    • Wrap copied address and copy button in .print-no / data-print-hidden, so full and truncated addresses never appear in printed output.
    • Keep clipboard behavior unchanged on screen; failed copy attempts produce no print-visible fallback.
  • [MODIFY] app/components/WalletBadge.tsx

    • Hide truncated wallet address and any wallet identity text in print.
    • Keep non-sensitive status indicators visible only when they do not reveal account data; otherwise hide them too.
  • [MODIFY] app/components/WalletModal.tsx

    • Hide wallet modal trigger and modal content in print.
    • No print path can open/close state or alter wallet connection.
  • [MODIFY] app/components/CommandPalette.tsx

    • Hide command palette trigger, overlay, and input in print.
    • Prevent command palette state or keyboard shortcuts from being exposed via print styles.
  • [MODIFY] app/components/BottomNav.tsx

    • Hide bottom navigation controls in print.
  • [MODIFY] app/components/ThemeToggle.tsx

    • Hide theme toggle control in print.
  • [MODIFY] app/layout.tsx

    • Apply data-print-hidden / print-safe wrappers around non-content root regions so no interactive shell is printed.
    • Add a print-only body class used by focused tests.
  • [ADD] app/__tests__/printStyles.test.ts

    • Tests verify every secret/copyable element is hidden in print media.
    • Tests verify screen media output remains unchanged.
    • Tests cover empty, duplicate, and long address boundary cases, plus open/closed interactive control states.

Verification Results

npm test -- app/__tests__/printStyles.test.ts
✅ 14/14 passed

Print-emulation checks:
✅ Wallet addresses and copy controls hidden in print media
✅ Command palette, bottom nav, theme toggle, and wallet modal hidden in print media
✅ Screen media output unchanged for existing callers
✅ No console errors or state mutations during print
✅ Boundary cases: empty address, duplicate rendered address, long truncated address
Acceptance Criteria Status
Intended behavior is deterministic for valid, invalid, duplicate, and boundary-case inputs ✅ Print styles are static and covered by tests for empty, duplicate, long, and repeated rendered secrets
Authorization, validation, and state-transition invariants remain enforced ✅ No runtime auth changes; print suppression happens at the CSS boundary; wallet actions remain guarded by existing validation
Retries, partial failure, and concurrent execution cannot produce an unsafe or inconsistent result ✅ Print is stateless; no retries/partial writes; concurrent renders produce identical print-safe output
Focused tests cover success, rejection, boundary, and regression scenarios ✅ Added tests for secret omission, interactive control omission, boundary cases, and regression selectors
Existing callers remain compatible, or the PR includes a tested migration path ✅ No component prop/API changes; screen media output is unchanged; only print media is affected
Relevant logs, metrics, or user-visible errors make failures diagnosable without exposing sensitive data ✅ Test failures identify selectors only, never secret values; no new runtime logging of wallet data

Closes #1429

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Quality-2][High] Make print styles omit secrets and interactive controls

1 participant