Skip to content

[PM-31364] discard edits dialog to policies page#20096

Open
JaredScar wants to merge 10 commits intomainfrom
ac/pm-31364-discard-edits-dialog-to-policies-page
Open

[PM-31364] discard edits dialog to policies page#20096
JaredScar wants to merge 10 commits intomainfrom
ac/pm-31364-discard-edits-dialog-to-policies-page

Conversation

@JaredScar
Copy link
Copy Markdown
Contributor

@JaredScar JaredScar commented Apr 10, 2026

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-31364

📔 Objective

Adds a discard edits modal when navigating away with changes in the opened policy drawer.

📸 Screenshots

image

JaredScar and others added 8 commits April 9, 2026 13:51
* Added `openDrawer` method to `PolicyDialogComponent` and `MultiStepPolicyEditDialogComponent` to support opening dialogs in a drawer format.
* Updated `edit` method in `PoliciesComponent` to conditionally use the drawer based on the `PolicyDrawers` feature flag.
* Introduced `PolicyDrawers` feature flag in `feature-flag.enum.ts` to control the new drawer functionality.
* Updated `policy-edit-dialog.component.html` and `multi-step-policy-edit-dialog.component.html` to conditionally apply full height class based on drawer state.
* Modified `PolicyEditDialogComponent` to include a host binding for full height when in drawer mode.
…drawer mode by adding a host binding for the full height class based on the dialog reference state.
…m-25627-convery-policy-dialogs-to-drawers
…er cleanup on destroy. Added drawerRef to handle drawer state and close it when the component is destroyed.
…le, allowing for potential updates to the dialog reference during component lifecycle.
…onent

- Introduced PoliciesDeactivateGuard to prevent navigation away from the PoliciesComponent if there are unsaved changes in the drawer.
- Enhanced PoliciesComponent with a canDeactivate method to check for unsaved changes.
- Updated policy-edit-dialog components to implement discard edits confirmation dialogs.
- Added localization messages for discard edits confirmation prompts.
- Modified organization-settings-routing to include the new guard for the policies route.
@JaredScar JaredScar requested review from a team as code owners April 10, 2026 16:41
@JaredScar JaredScar added the ai-review Request a Claude code review label Apr 10, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

Bitwarden Claude Code Review

Overall Assessment: REQUEST CHANGES

This PR adds a "discard edits" confirmation dialog when navigating away from an open policy drawer with unsaved changes. It introduces a closePredicate mechanism on DrawerDialogRef with re-entrancy protection, a PoliciesDeactivateGuard for route navigation, and a beforeunload listener for browser close/refresh. All changes are gated behind the PolicyDrawers feature flag.

The shared dialog service changes (tryClose, closePredicate) are well-designed with proper handling for already-closed state and re-entrancy. The PoliciesComponent correctly pre-checks with tryClose() before opening a new drawer, avoiding the fire-and-forget limitation of DialogService.openDrawer. The SimpleConfigurableDialogComponent additions (hideIcon, danger acceptButtonType) are clean and follow existing patterns.

Code Review Details
  • ⚠️ : Missing closePredicate clear on confirm() cancellation path causes unexpected double-dialog in drawer mode
    • policy-edit-dialog.component.ts:201-202

Comment on lines 211 to +212
});
// Clear the predicate so the drawer closes immediately after a successful save.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ IMPORTANT: Missing closePredicate clear on the confirm() cancellation path

Details and fix

The predicate is correctly cleared here before close("saved"), but the same pattern is missing a few lines above (around the original line 162) where confirm() returns false:

if ((await policyComponent.confirm?.()) == false) {
    this.dialogRef.close();   // <-- triggers closePredicate in drawer mode
    return;
}

When OrganizationDataOwnershipComponent.confirm() returns false, the drawer's close() delegates to tryClose(), which invokes closePredicate. Since the form is dirty at that point, the user sees a second "Discard edits?" dialog after already cancelling the confirmation warning.

Add this.dialogRef.closePredicate = undefined; before this.dialogRef.close() in the confirm() cancellation path to match this pattern.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

Logo
Checkmarx One – Scan Summary & Detailsea3d11bd-f2ee-4133-ab2b-462d2800af45


New Issues (17) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 HIGH CVE-2025-13631 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform Privilege Escala...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 HIGH CVE-2025-13633 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Use After Free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
3 HIGH CVE-2025-13638 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Use After Free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a craft...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 HIGH CVE-2025-13639 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a craf...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 HIGH CVE-2025-13720 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploi...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 HIGH CVE-2025-13721 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
7 HIGH CVE-2026-0628 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malic...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
8 HIGH CVE-2026-1861 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Heap Buffer Overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a craf...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
9 HIGH CVE-2026-34770 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39....
Attack Vector: LOCAL
Attack Complexity: HIGH
Vulnerable Package
10 HIGH CVE-2026-34771 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
11 HIGH CVE-2026-34774 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.x prior to 40....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
12 HIGH CVE-2026-34780 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 prior to 39.8....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
13 MEDIUM CVE-2025-13632 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious ex...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
14 MEDIUM CVE-2025-13635 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTM...
Attack Vector: LOCAL
Attack Complexity: LOW
Vulnerable Package
15 MEDIUM CVE-2025-13636 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in spec...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
16 MEDIUM CVE-2025-13637 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in speci...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
17 LOW CVE-2025-13640 Npm-electron-39.2.6
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical ac...
Attack Vector: PHYSICAL
Attack Complexity: LOW
Vulnerable Package

- Changed cancel button text from "Keep editing" to "Back to editing" for clarity.
- Updated dialog type to "danger" to better reflect the action's implications.
- Added option to hide the dialog icon for a cleaner interface.
- Localized new button text and updated existing localization for discard edits confirmation.
@sonarqubecloud
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant