[CHAIN] feat(ui): add Registry artifact explorer

[Alan-TheGentleman]

🔗 Part of Chained PRs

Field	Value
Feature Branch	feat/prowler-2414-registry-ui
Main PR	#12494
Position	7 of 8
Base	feat/prowler-2414-registry-ui-06-guarded-reads
Depends on	#12505
Follow-up	PR 8, acceptance hardening
Non-test budget	1,198 / 1,200 changed lines, explicit maintainer-approved size exception
Excluded test lines	807 changed lines
All-path diff	2,005 changed lines
Starts at	Guarded Registry server integration
Ends with	Complete interactive explorer plus refresh-confirmed Add/Remove and access management

Chain Overview

feat/prowler-2414-registry-ui (#12494 tracker)
└── #12495 PR 1: permissions and flag typing
    └── #12497 PR 2: fresh access authority
        └── #12499 PR 3: lease, navigation, and route guards
            └── #12503 PR 4: DTO and error adapters
                └── #12504 PR 5: complete catalog model
                    └── #12505 PR 6: guarded Registry server integration
                        └── 📍 #12515 PR 7: interactive explorer and authoritative Add/Remove
                            └── PR 8: acceptance hardening (planned)
                                └── #12494 tracker -> master

Scope

• Includes the complete interactive Registry explorer, authoritative Available and My artifact views, search, filters, provider navigation, onboarding, access management, and refresh-confirmed Add/Remove transactions.
• Rollback is limited to this child PR. Reverting it removes the explorer and its transactions without changing backend credentials or tenant artifacts.
• Excludes shared primitive changes; Playwright, configuration, and documentation work; backend changes; migrations; deployment; and runtime-flag enablement. Those boundaries remain with PR 8 or outside this chain.
• No new npm dependencies are introduced.

Context

The Registry experience must show only complete, authoritative server state. A successful mutation does not move an artifact between views or produce a success toast until a fresh My-artifacts read confirms the expected presence or absence.

This child builds on the guarded Registry server integration in #12505 and completes the interactive explorer and access-management work. PR 8 remains responsible for shared accessibility and reduced-motion primitives, Playwright/configuration/documentation work, browser acceptance, and final feature-level evidence.

Description

• Render onboarding, validation-pending, ready, incomplete, empty, stale, and recoverable error states from authoritative bootstrap DTOs.
• Provide complete-catalog search, filtering, metrics, provider grouping, Multi-provider navigation, and artifact details without partial-catalog controls or version browsing.
• Add guarded Add and Remove actions with literal latest or an exact pin, encoded removal, confirmation, fixed refusal outcomes, and no optimistic membership moves.
• Refresh My artifacts after each mutation and update membership and toasts only after the expected authoritative result is confirmed.
• Provide reconnect and manage-access dialogs that preserve confirmed catalog state on failed credential replacement and immediately clear submitted write-only keys.
• Preserve access invalidation, late-result suppression, accessible dialog labels and confirmations, and no animation-dependent success behavior.
• Include the approved UI changelog fragment at ui/changelog.d/registry-artifact-transactions.added.md.

Steps to review

1. Confirm the explorer exposes only complete-catalog search, filters, metrics, navigation, and details, with clear onboarding, pending, incomplete, stale, and error boundaries.
2. Verify that Add and Remove use authoritative My-artifact refreshes before changing visible membership or emitting success feedback. Check both literal latest and exact-pin input behavior, encoded removal, confirmation, and refusal outcomes.
3. Verify access-management failure preserves confirmed catalog state and submitted keys are immediately reset and never surfaced in returned data, URLs, storage, logs, or toast inputs.
4. Run cd ui && pnpm exec vitest run --project unit actions/registry/registry.test.ts; recorded result: PASS, 33 tests.
5. Run cd ui && pnpm exec vitest run --project integration components/registry/registry-explorer.integration.test.tsx; recorded result: PASS, 21 tests.
6. Run cd ui && pnpm exec vitest run --project unit actions/registry/registry.adapter.test.ts components/registry/registry-explorer.model.test.ts lib/registry/access.test.ts lib/registry/access.server.test.ts; recorded result: PASS, 4 files / 26 tests.
7. Run cd ui && pnpm exec vitest run --project unit proxy.test.ts lib/registry/access.server.test.ts components/layout/main-layout/main-layout.test.tsx components/layout/app-sidebar/navigation-config.test.ts components/layout/app-sidebar/app-sidebar-content.test.tsx; recorded result: PASS, 5 files / 29 tests.
8. Run cd ui && pnpm run test:unit; recorded result: PASS, 436 files / 3,119 tests. Run cd ui && pnpm run test:integration; recorded result: PASS, 8 files / 132 tests.
9. Recorded checks also pass: cd ui && pnpm run typecheck, cd ui && pnpm run lint:check, cd ui && pnpm run format:check, tracked and untracked candidate git diff --check, and PREK_NO_CONCURRENCY=1 uv run --directory . prek run --files <all 14 PR 7 candidate paths>.
10. typescript-language-server was unavailable; local tsserver reported PASS with 0 syntax or semantic diagnostics across the 13 TS/TSX candidate files.

Checklist

Community Checklist

• This feature/issue is listed in the open issues or roadmap.prowler.com
• Is it assigned to me, if not, request it via the open issues or Prowler Community Slack
• I have reviewed the open pull requests and confirmed there is no existing PR that implements the same outcome

• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the README.md: not required for this child.
• Ensure a changelog fragment is added under prowler/changelog.d/, if applicable: SDK/CLI is not changed.

SDK/CLI

• Are there new checks included in this PR? No

UI

• All issue/task requirements work as expected on the UI: PR 8 acceptance hardening remains pending.
• This PR adds or updates no npm dependencies.
• Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px): pending PR 8 acceptance.
• Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px): pending PR 8 acceptance.
• Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px): pending PR 8 acceptance.
• Ensure a changelog fragment is added under ui/changelog.d/, if applicable: registry-artifact-transactions.added.md is included.

API

• The API is not changed by this PR.
• Endpoint response output, query analysis, performance evidence, API specs, versions, and API changelog are not applicable.

MCP Server

• The MCP Server is not changed by this PR.
• The MCP changelog is not applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Alan-TheGentleman]

Do not test the historical tree-explorer UI in this PR. registry-artifact-detail, registry-navigation, registry-onboarding, and registry-overview are deleted by #12524, which supersedes this presentation with marketplace cards. Final mutation and task behavior is then finalized by #12579 and #12590, so use those PRs for validation.

[alejandrobailo]

Consolidated into #12494. All changes are preserved there. GitHub marked this PR as merged when its commits were pushed to the parent branch; #12494 remains open and has not been merged into master.