feat(elevation): page-wide armed chrome when admin mode is on
The header toggle alone is easy to miss — admin elevation bypasses
WORM zones and ACL silently, so an admin who forgot they were
elevated could write into received/ or issued/ thinking they were
operating under their normal grants.
Two reinforcing affordances when the zddc-elevate cookie is set:
- body.is-elevated paints a 3px red outline around the entire page,
visible from any scroll position and inside any tool surface.
- A sticky red banner sits across the top with a pulsing dot, an
explicit warning ("write access bypasses WORM and ACL safeguards"),
and a one-click "Drop admin" button that clears the cookie + reloads
so the user can disarm without hunting for the corner toggle.
Both render on every page load via shared/elevation.js — applies to
every tool that includes the elevation slot, plus any tool that loads
the shared bundle even without a toggle host (the iframed classifier
inside browse's grid mode, etc.). Wired before the access fetch so
the banner appears immediately instead of waiting on /.profile/access.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
03d008ff0a
commit
1d758780fe
3 changed files with 223 additions and 1 deletions
|
|
@ -45,3 +45,69 @@
|
|||
color: var(--danger);
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
/* Page-wide chrome when admin mode is active. The toggle alone is
|
||||
easy to miss; these add an inescapable visual cue:
|
||||
1. Thin red border around the entire page (body) — peripheral-
|
||||
vision reminder regardless of which tool / scroll position.
|
||||
2. Sticky banner across the top with a one-click "Drop admin"
|
||||
button so the user can disarm without hunting for the toggle.
|
||||
Both rendered ONLY when the zddc-elevate cookie is set; the
|
||||
shared/elevation.js init() syncs the body class on every page
|
||||
load and tears it down when elevation is cleared. */
|
||||
body.is-elevated {
|
||||
outline: 3px solid var(--danger, #dc3545);
|
||||
outline-offset: -3px;
|
||||
}
|
||||
|
||||
.elevation-banner {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 0.75rem;
|
||||
padding: 0.4rem 0.9rem;
|
||||
background: rgba(220, 53, 69, 0.95);
|
||||
color: #fff;
|
||||
font-size: 0.85rem;
|
||||
font-weight: 500;
|
||||
letter-spacing: 0.01em;
|
||||
position: sticky;
|
||||
top: 0;
|
||||
z-index: 9100; /* above modal-overlay (9000) so it's never hidden */
|
||||
box-shadow: 0 1px 4px rgba(0, 0, 0, 0.18);
|
||||
}
|
||||
|
||||
.elevation-banner__dot {
|
||||
width: 0.5rem;
|
||||
height: 0.5rem;
|
||||
background: #fff;
|
||||
border-radius: 50%;
|
||||
box-shadow: 0 0 0 0 rgba(255, 255, 255, 0.7);
|
||||
animation: elev-pulse 1.6s infinite;
|
||||
flex-shrink: 0;
|
||||
}
|
||||
|
||||
@keyframes elev-pulse {
|
||||
0% { box-shadow: 0 0 0 0 rgba(255, 255, 255, 0.7); }
|
||||
70% { box-shadow: 0 0 0 8px rgba(255, 255, 255, 0); }
|
||||
100% { box-shadow: 0 0 0 0 rgba(255, 255, 255, 0); }
|
||||
}
|
||||
|
||||
.elevation-banner__msg {
|
||||
flex: 1 1 auto;
|
||||
}
|
||||
|
||||
.elevation-banner__off {
|
||||
background: rgba(255, 255, 255, 0.18);
|
||||
border: 1px solid rgba(255, 255, 255, 0.7);
|
||||
color: #fff;
|
||||
padding: 0.18rem 0.65rem;
|
||||
border-radius: var(--radius, 4px);
|
||||
font-size: 0.78rem;
|
||||
font-weight: 600;
|
||||
letter-spacing: 0.02em;
|
||||
cursor: pointer;
|
||||
flex-shrink: 0;
|
||||
}
|
||||
.elevation-banner__off:hover {
|
||||
background: rgba(255, 255, 255, 0.3);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -77,7 +77,52 @@
|
|||
});
|
||||
}
|
||||
|
||||
// Page-wide affordances when elevation is active. The toggle alone
|
||||
// is easy to miss — admin mode silently bypasses WORM and ACL
|
||||
// restrictions, which produces surprising "I shouldn't have been
|
||||
// able to do that" moments. A body class + a sticky banner with a
|
||||
// one-click disable make the armed state unmistakable.
|
||||
function applyArmedChrome(elevated) {
|
||||
var b = document.body;
|
||||
if (!b) return;
|
||||
if (elevated) b.classList.add('is-elevated');
|
||||
else b.classList.remove('is-elevated');
|
||||
|
||||
var banner = document.getElementById('elevation-banner');
|
||||
if (elevated) {
|
||||
if (!banner) {
|
||||
banner = document.createElement('div');
|
||||
banner.id = 'elevation-banner';
|
||||
banner.className = 'elevation-banner';
|
||||
banner.setAttribute('role', 'alert');
|
||||
banner.innerHTML =
|
||||
'<span class="elevation-banner__dot" aria-hidden="true"></span>'
|
||||
+ '<span class="elevation-banner__msg">'
|
||||
+ 'Admin mode is on — write access bypasses WORM and ACL safeguards.'
|
||||
+ '</span>'
|
||||
+ '<button type="button" class="elevation-banner__off" id="elevation-banner-off">'
|
||||
+ 'Drop admin'
|
||||
+ '</button>';
|
||||
document.body.insertBefore(banner, document.body.firstChild);
|
||||
var off = banner.querySelector('#elevation-banner-off');
|
||||
if (off) off.addEventListener('click', function () {
|
||||
setElevated(false);
|
||||
window.location.reload();
|
||||
});
|
||||
}
|
||||
} else if (banner) {
|
||||
banner.parentNode.removeChild(banner);
|
||||
}
|
||||
}
|
||||
|
||||
async function init() {
|
||||
// Body chrome applies on every page load whether or not the
|
||||
// header has a toggle slot — the banner needs to surface in
|
||||
// tools / pages that don't host the toggle (e.g. iframed
|
||||
// classifier inside browse's grid mode), so the user can't
|
||||
// accidentally write through an elevated context elsewhere.
|
||||
applyArmedChrome(isElevated());
|
||||
|
||||
var host = document.getElementById('elevation-toggle');
|
||||
if (!host) return; // tool doesn't include the slot yet — no-op
|
||||
var access = await fetchAccess();
|
||||
|
|
|
|||
|
|
@ -884,6 +884,72 @@ body.help-open .app-header {
|
|||
font-weight: 600;
|
||||
}
|
||||
|
||||
/* Page-wide chrome when admin mode is active. The toggle alone is
|
||||
easy to miss; these add an inescapable visual cue:
|
||||
1. Thin red border around the entire page (body) — peripheral-
|
||||
vision reminder regardless of which tool / scroll position.
|
||||
2. Sticky banner across the top with a one-click "Drop admin"
|
||||
button so the user can disarm without hunting for the toggle.
|
||||
Both rendered ONLY when the zddc-elevate cookie is set; the
|
||||
shared/elevation.js init() syncs the body class on every page
|
||||
load and tears it down when elevation is cleared. */
|
||||
body.is-elevated {
|
||||
outline: 3px solid var(--danger, #dc3545);
|
||||
outline-offset: -3px;
|
||||
}
|
||||
|
||||
.elevation-banner {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 0.75rem;
|
||||
padding: 0.4rem 0.9rem;
|
||||
background: rgba(220, 53, 69, 0.95);
|
||||
color: #fff;
|
||||
font-size: 0.85rem;
|
||||
font-weight: 500;
|
||||
letter-spacing: 0.01em;
|
||||
position: sticky;
|
||||
top: 0;
|
||||
z-index: 9100; /* above modal-overlay (9000) so it's never hidden */
|
||||
box-shadow: 0 1px 4px rgba(0, 0, 0, 0.18);
|
||||
}
|
||||
|
||||
.elevation-banner__dot {
|
||||
width: 0.5rem;
|
||||
height: 0.5rem;
|
||||
background: #fff;
|
||||
border-radius: 50%;
|
||||
box-shadow: 0 0 0 0 rgba(255, 255, 255, 0.7);
|
||||
animation: elev-pulse 1.6s infinite;
|
||||
flex-shrink: 0;
|
||||
}
|
||||
|
||||
@keyframes elev-pulse {
|
||||
0% { box-shadow: 0 0 0 0 rgba(255, 255, 255, 0.7); }
|
||||
70% { box-shadow: 0 0 0 8px rgba(255, 255, 255, 0); }
|
||||
100% { box-shadow: 0 0 0 0 rgba(255, 255, 255, 0); }
|
||||
}
|
||||
|
||||
.elevation-banner__msg {
|
||||
flex: 1 1 auto;
|
||||
}
|
||||
|
||||
.elevation-banner__off {
|
||||
background: rgba(255, 255, 255, 0.18);
|
||||
border: 1px solid rgba(255, 255, 255, 0.7);
|
||||
color: #fff;
|
||||
padding: 0.18rem 0.65rem;
|
||||
border-radius: var(--radius, 4px);
|
||||
font-size: 0.78rem;
|
||||
font-weight: 600;
|
||||
letter-spacing: 0.02em;
|
||||
cursor: pointer;
|
||||
flex-shrink: 0;
|
||||
}
|
||||
.elevation-banner__off:hover {
|
||||
background: rgba(255, 255, 255, 0.3);
|
||||
}
|
||||
|
||||
/* shared/nav.css — lateral project-stage strip paired with shared/nav.js.
|
||||
Sits as a sibling immediately under .app-header (mounted by JS).
|
||||
Rendered only in online mode when a project segment is in the URL. */
|
||||
|
|
@ -1493,7 +1559,7 @@ body.help-open .app-header {
|
|||
</svg>
|
||||
<div class="header-title-group">
|
||||
<span class="app-header__title" id="table-title">ZDDC Table</span>
|
||||
<span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-alpha · 2026-05-15 20:58:00 · 167a56d-dirty</span></span>
|
||||
<span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-alpha · 2026-05-18 13:40:38 · 03d008f-dirty</span></span>
|
||||
</div>
|
||||
</div>
|
||||
<div class="header-right">
|
||||
|
|
@ -3063,7 +3129,52 @@ body.help-open .app-header {
|
|||
});
|
||||
}
|
||||
|
||||
// Page-wide affordances when elevation is active. The toggle alone
|
||||
// is easy to miss — admin mode silently bypasses WORM and ACL
|
||||
// restrictions, which produces surprising "I shouldn't have been
|
||||
// able to do that" moments. A body class + a sticky banner with a
|
||||
// one-click disable make the armed state unmistakable.
|
||||
function applyArmedChrome(elevated) {
|
||||
var b = document.body;
|
||||
if (!b) return;
|
||||
if (elevated) b.classList.add('is-elevated');
|
||||
else b.classList.remove('is-elevated');
|
||||
|
||||
var banner = document.getElementById('elevation-banner');
|
||||
if (elevated) {
|
||||
if (!banner) {
|
||||
banner = document.createElement('div');
|
||||
banner.id = 'elevation-banner';
|
||||
banner.className = 'elevation-banner';
|
||||
banner.setAttribute('role', 'alert');
|
||||
banner.innerHTML =
|
||||
'<span class="elevation-banner__dot" aria-hidden="true"></span>'
|
||||
+ '<span class="elevation-banner__msg">'
|
||||
+ 'Admin mode is on — write access bypasses WORM and ACL safeguards.'
|
||||
+ '</span>'
|
||||
+ '<button type="button" class="elevation-banner__off" id="elevation-banner-off">'
|
||||
+ 'Drop admin'
|
||||
+ '</button>';
|
||||
document.body.insertBefore(banner, document.body.firstChild);
|
||||
var off = banner.querySelector('#elevation-banner-off');
|
||||
if (off) off.addEventListener('click', function () {
|
||||
setElevated(false);
|
||||
window.location.reload();
|
||||
});
|
||||
}
|
||||
} else if (banner) {
|
||||
banner.parentNode.removeChild(banner);
|
||||
}
|
||||
}
|
||||
|
||||
async function init() {
|
||||
// Body chrome applies on every page load whether or not the
|
||||
// header has a toggle slot — the banner needs to surface in
|
||||
// tools / pages that don't host the toggle (e.g. iframed
|
||||
// classifier inside browse's grid mode), so the user can't
|
||||
// accidentally write through an elevated context elsewhere.
|
||||
applyArmedChrome(isElevated());
|
||||
|
||||
var host = document.getElementById('elevation-toggle');
|
||||
if (!host) return; // tool doesn't include the slot yet — no-op
|
||||
var access = await fetchAccess();
|
||||
|
|
|
|||
Loading…
Reference in a new issue