Address 3 product blockers from Pepe's review:
- Add sort=-status to getFindingGroupResources and
getLatestFindingGroupResources so FAIL resources appear before PASS
in the drill-down list (sort kept as future-proofing even when
filter[status]=FAIL makes it a no-op for now)
- Add filter[status]=FAIL to both resource endpoints so drill-down
only shows impacted resources, matching the count in the group header
- Add filter[status]=FAIL to createResourceFindingResolutionUrl so
muting a group only affects active FAIL findings, not all historical
- Use .set() after appendSanitizedProviderFilters to guarantee
hardcoded FAIL wins even if caller passes filter[status] in filters
(prevents duplicate filter[status] params with undefined API behavior)
- Apply symmetric .set() pattern in findings-by-resource.ts for
consistency
26 tests (10 new). All passing.
Judgment Day: 2 rounds, 0 discrepancies remaining.
- Fix SSRF path traversal: encode checkId with encodeURIComponent in
getFindingGroupResources and getLatestFindingGroupResources URL paths
- Fix SSR crash: add isMounted guard for createPortal(document.body) in
InlineResourceContainer to prevent document access during server render
- Fix invalid Tailwind: replace mt-[-10] (no unit) with -mt-2.5 scale token
- Fix unbounded page[size]: cap at 500 via Math.min in URL builder as
defense-in-depth alongside existing chunking
- Fix pageRef race condition: move page counter increment inside fetchPage
after successful non-aborted response, remove redundant pre-set from
refresh() to prevent permanent page skip on concurrent abort
26 tests across 4 test suites (2 new, 2 extended). All passing.
TypeScript: 0 errors in changed files. ESLint: 0 errors.
Claude Code validation: PASSED.
Pre-existing healthcheck failures (.next/types, @codemirror) unrelated.
Alan Buscaglia