[CHAIN] feat(ui): harden Registry accessibility and acceptance

[Alan-TheGentleman]

🔗 Part of Chained PRs

Field	Value
Feature Branch	feat/prowler-2414-registry-ui
Main PR	#12494
Position	8 of 9
Base	feat/prowler-2414-registry-ui-07-interactive-explorer
Depends on	#12515
Follow-up	#12524 PR 9 marketplace redesign, then the #12494 tracker
Commit	01dc698522
Non-test budget	363 / 600 changed lines
Excluded test lines	1,329 changed lines
All-path diff	1,692 changed lines
Starts at	Complete explorer and authoritative Add/Remove transactions
Ends with	Accessibility and reduced motion, deterministic browser acceptance fixture, CI impact routing, rollout documentation, build compatibility, and final implementation evidence

Chain Overview

feat/prowler-2414-registry-ui (#12494 tracker)
└── #12495 PR 1: permissions and flag typing
    └── #12497 PR 2: fresh access authority
        └── #12499 PR 3: lease, navigation, and route guards
            └── #12503 PR 4: DTO and error adapters
                └── #12504 PR 5: complete catalog model
                    └── #12505 PR 6: guarded Registry server integration
                        └── #12515 PR 7: interactive explorer and authoritative Add/Remove
                            └── 📍 #12520 PR 8: acceptance hardening
                                └── #12524 PR 9: marketplace redesign
                                    └── #12494 tracker: final SDD verification, lifecycle, and rollout prerequisites

Scope

• Includes shared primitive accessibility and reduced-motion hardening, Registry focus and status behavior, a deterministic test-only browser acceptance fixture, CI test-impact routing, rollout and rollback documentation, and Next.js build compatibility.
• Completes all 46 implementation-owned Registry UI tasks. The tracker retains final SDD verification and lifecycle ownership.
• The fixture exercises the browser, UI, and runtime contract only. Live controlled-backend acceptance remains mandatory before rollout.
• UI_REGISTRY_ENABLED remains default-off. This child does not change backend endpoints, API contracts, migrations, deployment manifests, Cloud grants, or runtime-flag enablement.
• No new npm dependencies are introduced. This internal hardening follows no-changelog; the visible UI changelog fragment is in [CHAIN] feat(ui): add Registry artifact explorer #12515.
• Rollback is limited to this child. Reverting it removes fixture, CI-routing, accessibility, documentation, and build-hardening changes without invoking Registry APIs or mutating credentials or tenant artifacts.

Context

This final child closes the acceptance-hardening boundary after #12515 completed the explorer and authoritative transactions. It keeps the Registry rollout fail-closed while making the browser coverage deterministic and self-contained.

The fixture uses synthetic contracts and three real Next.js profiles: enabled Cloud/Registry, Cloud with Registry disabled, and Local with Registry enabled. It neither reads local environment files nor requires a live Registry credential, private endpoint, or manual artifact/version configuration. A live controlled-backend acceptance run remains a rollout prerequisite, not a code blocker for this child.

Description

• Add reduced-motion and focus behavior for shared primitives and Registry dialogs, including keyboard and mobile Sheet coverage.
• Add deterministic Registry Playwright acceptance coverage and test-only synthetic API/auth contracts for real proxy and server-action paths.
• Add Registry-specific CI impact routing while leaving standard E2E scope unchanged.
• Document dependency-first rollout and rollback behavior, retaining the default-off Registry runtime flag.
• Verify build compatibility and final candidate hygiene without changing backend/API, migration, deployment, or grant behavior.

Steps to review

1. Run cd ui && pnpm run test:e2e:registry. Recorded result: PASS, 8 passed and 17 profile-inapplicable skipped. Confirm all six scenarios exercise direct-route denial, manager navigation, current-authority revocation, credential settlement, complete catalog and authoritative mutations, and Pixel 5 keyboard/focus/reduced-motion behavior.
2. Confirm fixture mode is self-contained and does not load ui/.env.local, require a live Registry credential, or enable the Registry flag outside its isolated test processes.
3. Run cd ui && pnpm run test:unit and cd ui && pnpm run test:integration. Recorded results: PASS, 3,119 unit tests and 140 integration tests.
4. Run cd ui && pnpm run typecheck, cd ui && pnpm run lint:check, cd ui && pnpm run format:check, and cd ui && pnpm run build. Recorded result: PASS. The final 45/45 validation cohort, candidate git diff --check, Prek, YAML, test-impact and path-routing checks, and TypeScript diagnostics also pass.
5. Confirm ui-registry routing selects Registry fixture acceptance only for Registry paths or an intentionally all-E2E selection, and that normal E2E scope is unchanged.
6. Before enabling UI_REGISTRY_ENABLED in a prepared deployment, run the required live controlled-backend acceptance. This is a rollout prerequisite; this PR does not perform it.

Checklist

Community Checklist

• This feature/issue is listed in the open issues or roadmap.prowler.com
• Is it assigned to me, if not, request it via the open issues or Prowler Community Slack
• I have reviewed the open pull requests and confirmed there is no existing PR that implements the same outcome

• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the README.md: not required for this child.
• Ensure a changelog fragment is added under prowler/changelog.d/, if applicable: SDK/CLI is not changed.

SDK/CLI

• Are there new checks included in this PR? No

UI

• All implementation-owned UI requirements work as expected in the deterministic browser fixture. Final tracker SDD verification, lifecycle, and live controlled-backend rollout acceptance remain pending.
• This PR adds or updates no npm dependencies.
• Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px): automated Pixel 5 acceptance is recorded; no separate visual attachment is included.
• Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px): no separate visual attachment is included.
• Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px): automated browser acceptance is recorded; no separate visual attachment is included.
• Ensure a changelog fragment is added under ui/changelog.d/, if applicable: this internal hardening uses no-changelog; the visible Registry fragment is in [CHAIN] feat(ui): add Registry artifact explorer #12515.

API

• The API is not changed by this PR.
• Endpoint response output, query analysis, performance evidence, API specs, versions, and API changelog are not applicable.

MCP Server

• The MCP Server is not changed by this PR.
• The MCP changelog is not applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Alan-TheGentleman]

Do not test the obsolete tree and onboarding presentation in this PR. registry-artifact-detail and registry-onboarding are removed by #12524, while final marketplace behavior is validated there and async Add is validated in #12579 and #12590. The retained access-server, accessibility, E2E configuration, and layout changes still require contract review.

[alejandrobailo]

Consolidated into #12494. All changes are preserved there. GitHub marked this PR as merged when its commits were pushed to the parent branch; #12494 remains open and has not been merged into master.