Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: ⛔ Files ignored due to path filters (322)
📒 Files selected for processing (103)
📝 WalkthroughWalkthroughThe pull request expands documentation for product capabilities, organization setup, Records, and self-hosting. It also redesigns the Docusaurus navbar and homepage with categorized navigation, shared icons, responsive layouts, and new landing-page content. ChangesDocumentation foundation
Web application and Records documentation
Site navigation and homepage
Estimated code review effort: 5 (Critical) | ~90 minutes ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Code Review Completed! 🔥The code review was successfully completed based on your current configurations. Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
| ./setup.sh | ||
| ``` | ||
|
|
||
| Without supplied TLS files, setup generates a self-signed certificate containing all three hostnames. Distribute/trust `deploy/generated/tls.crt` on clients. |
There was a problem hiding this comment.
TLS guidance in docs/self-hosted/multi.md and docs/web-app/security-permissions.md:106-106 permits self-signed certificates for externally exposed endpoints, weakening trust establishment for public services. Restrict self-signed certificates to local non-production testing and document that public endpoints require TLS 1.2+ with a trusted CA-issued certificate and HSTS enabled.
Kody rule violation: Enforce TLS 1.2+ and HSTS on all external endpoints
Prompt for LLM
File docs/self-hosted/multi.md:
Line 80:
TLS guidance in `docs/self-hosted/multi.md` and `docs/web-app/security-permissions.md:106-106` permits self-signed certificates for externally exposed endpoints, weakening trust establishment for public services. Restrict self-signed certificates to local non-production testing and document that public endpoints require TLS 1.2+ with a trusted CA-issued certificate and HSTS enabled.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
|
|
||
| # Setting Up a Security Company, Campus Security or Facilities Team | ||
|
|
||
| For contract security companies with many client sites, campus / healthcare / corporate security departments, and facilities teams that respond to alarms, incidents and service requests. In Resgrid a **client site is a station group**, a **patrol vehicle or post is a unit**, an **incident or request is a call**, and patrol logs and incident reports are **records**. |
There was a problem hiding this comment.
Legal-basis omission in docs/setup-guides/security-and-facilities.md and the matching references in docs/web-app/contacts.md:8-8, docs/web-app/unit-tracking.md:44-44, docs/web-app/dispatch-calls.md:127-127, docs/web-app/account-security.md:60-60, docs/web-app/records/reports-and-exports.md:58-58, docs/setup-guides/security-and-facilities.md:27-27, docs/web-app/records/reports-and-exports.md:54-54, docs/web-app/security-permissions.md:76-76, docs/apps/unit.md:152-152, docs/setup-guides/security-and-facilities.md:57-57, and docs/web-app/personnel.md:38-38 leaves sensitive-data handling requirements undefined. State that processing health-related or other sensitive data requires explicit consent or another valid legal basis, require the consent or authorization identifier where applicable, and document consent verification before handling that data.
Kody rule violation: Require explicit consent before processing sensitive data
Prompt for LLM
File docs/setup-guides/security-and-facilities.md:
Line 8:
Legal-basis omission in `docs/setup-guides/security-and-facilities.md` and the matching references in `docs/web-app/contacts.md:8-8`, `docs/web-app/unit-tracking.md:44-44`, `docs/web-app/dispatch-calls.md:127-127`, `docs/web-app/account-security.md:60-60`, `docs/web-app/records/reports-and-exports.md:58-58`, `docs/setup-guides/security-and-facilities.md:27-27`, `docs/web-app/records/reports-and-exports.md:54-54`, `docs/web-app/security-permissions.md:76-76`, `docs/apps/unit.md:152-152`, `docs/setup-guides/security-and-facilities.md:57-57`, and `docs/web-app/personnel.md:38-38` leaves sensitive-data handling requirements undefined. State that processing health-related or other sensitive data requires explicit consent or another valid legal basis, require the consent or authorization identifier where applicable, and document consent verification before handling that data.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| ## Editing profiles from the dashboard | ||
|
|
||
| ### Custom Staffing Levels | ||
| Clicking a name opens the person; administrators can **edit the profile** (name, email, phone numbers and carrier, group and roles, addresses, language, time zone, notification options, department admin / disabled / hidden flags). See [Personnel](personnel) and [Profile & Account](profile-account). |
There was a problem hiding this comment.
PII exposure in docs/web-app/dashboard.md lists raw personal data fields without privacy-handling constraints. Minimize direct enumeration of name, email, phone numbers, carrier, addresses, and related profile fields, or state explicitly that diagnostics and telemetry must redact or hash PII by default.
Kody rule violation: Redact PII in logs and metrics by default
Clicking a name opens the person; administrators can edit profile details permitted by policy, with personal data minimized and redacted in diagnostics/telemetry. See [Personnel](personnel) and [Profile & Account](profile-account).Prompt for LLM
File docs/web-app/dashboard.md:
Line 36:
PII exposure in `docs/web-app/dashboard.md` lists raw personal data fields without privacy-handling constraints. Minimize direct enumeration of name, email, phone numbers, carrier, addresses, and related profile fields, or state explicitly that diagnostics and telemetry must redact or hash PII by default.
Suggested Code:
Clicking a name opens the person; administrators can edit profile details permitted by policy, with personal data minimized and redacted in diagnostics/telemetry. See [Personnel](personnel) and [Profile & Account](profile-account).
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| | Data endpoints | `GetActiveCallsList`, `GetArchivedCallsList?year=`, `GetScheduledCallsList`, `GetCallNotes`, `GetPersonnelForCall`, `GetAllDispatchesForCall`, `GetMapDataForCall`, `GetCallTypes`, `GetCallPriorities`, `GetCallsForSelectList`, `GetCoordinatesFromW3W`, `GetAlertNotesForContact`, `GetDispatchRecommendation`, `CallsYTD`, `CallsTypesInRange`, `CallsStatesInRange` | | ||
| | Attachments | 10 MB; images jpg/jpeg/png/gif/bmp; documents pdf/doc/docx/ppt/pptx/xls/xlsx/txt; audio mp3/m4a/ogg/wav; video mp4/m4v/mov/wmv/avi/mpg | | ||
| | Soft delete | `IsDeleted`, `DeletedOn`, `DeletedByUserId`, `DeletedReason` | | ||
| | Protected data | Name, nature, notes, address and attachments are ADP-protected fields | |
There was a problem hiding this comment.
Protected-data documentation in docs/web-app/dispatch-calls.md and the matching references in docs/web-app/contacts.md:8-8, docs/setup-guides/security-and-facilities.md:45-45, docs/setup-guides/industrial-emergency-response.md:51-51, docs/web-app/dashboard.md:36-36, docs/apps/unit.md:148-148, docs/web-app/records/authoring.md:102-102, docs/web-app/data-protection.md:59-59, docs/web-app/personnel.md:8-8, and docs/web-app/personnel.md:47-47 enumerates PHI-like fields such as name and address without stating log-handling constraints. Clarify that these fields must be masked or redacted, never written to logs, and, if the section describes storage or protection, documented as protected at rest and in transit and excluded from logs and audit payloads except tokenized metadata.
Kody rule violation: Do not log PHI; mask and drop sensitive fields
Prompt for LLM
File docs/web-app/dispatch-calls.md:
Line 127:
Protected-data documentation in `docs/web-app/dispatch-calls.md` and the matching references in `docs/web-app/contacts.md:8-8`, `docs/setup-guides/security-and-facilities.md:45-45`, `docs/setup-guides/industrial-emergency-response.md:51-51`, `docs/web-app/dashboard.md:36-36`, `docs/apps/unit.md:148-148`, `docs/web-app/records/authoring.md:102-102`, `docs/web-app/data-protection.md:59-59`, `docs/web-app/personnel.md:8-8`, and `docs/web-app/personnel.md:47-47` enumerates PHI-like fields such as name and address without stating log-handling constraints. Clarify that these fields must be masked or redacted, never written to logs, and, if the section describes storage or protection, documented as protected at rest and in transit and excluded from logs and audit payloads except tokenized metadata.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| ### Removing someone | ||
|
|
||
| **Authorization:** `Personnel_View` policy + `CanUserViewUser` runtime check | ||
| **Delete** removes the member from the department. Resgrid recommends **disabling** instead of deleting so history, logs and reports stay intact; underlying data is retained, so clear personal details first if you must delete. A member who still owns unfinished [Records](records/authoring) must have them reassigned first. Deleted members can be **reactivated** by adding them again with the same email. |
There was a problem hiding this comment.
Deletion-semantics conflict in docs/web-app/personnel.md retains underlying data and allows reactivation by the same email, which does not satisfy irreversible deletion or anonymization expectations. Document an irreversible anonymization or hard-delete path for deletion requests, including cache purging and retention of only minimal non-linkable audit metadata.
Kody rule violation: Deletion requests: anonymize or hard-delete PII irreversibly
Prompt for LLM
File docs/web-app/personnel.md:
Line 64:
Deletion-semantics conflict in `docs/web-app/personnel.md` retains underlying data and allows reactivation by the same email, which does not satisfy irreversible deletion or anonymization expectations. Document an irreversible anonymization or hard-delete path for deletion requests, including cache purging and retention of only minimal non-linkable audit metadata.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
|
|
||
| Feature flag: `Records.Analytics`. Menu: **Records → Analytics**. | ||
|
|
||
|  |
There was a problem hiding this comment.
Image-delivery inefficiency in docs/web-app/records/analytics.md and the matching references uses a PNG without responsive sources, explicit dimensions, lazy loading, or async decoding. Prefer modern formats such as WebP or AVIF and, where supported by the site tooling, document responsive images with explicit sizing and lazy loading to reduce payload and improve rendering performance.
Kody rule violation: Serve responsive images with modern formats and lazy-load
Prompt for LLM
File docs/web-app/records/analytics.md:
Line 12:
Image-delivery inefficiency in `docs/web-app/records/analytics.md` and the matching references uses a PNG without responsive sources, explicit dimensions, lazy loading, or async decoding. Prefer modern formats such as WebP or AVIF and, where supported by the site tooling, document responsive images with explicit sizing and lazy loading to reduce payload and improve rendering performance.
Suggested Code:
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
|
|
||
| | Item | Value | | ||
| |---|---| | ||
| | Routes | `/User/Records/Dashboard`, `/User/Records/Index?year=&definitionKey=&state=&q=&owner=&group=&page=`, `/User/Records/ExportList?format=csv|json`, `/User/Records/Bulk` (POST), `/User/Records/Accountability?pivot=person|group|unit&days=`, `/User/Records/FieldRollout`, `/User/RecordsHealth/Index` | |
There was a problem hiding this comment.
Contract-change ambiguity in docs/web-app/records/dashboard-and-queue.md and docs/web-app/notifications.md:2-2 documents API and UI route contracts without stating whether any path, query parameter, or behavior is breaking. Add a dedicated BREAKING CHANGE section whenever an existing route, query parameter, or behavior changed, including migration guidance for affected consumers.
Kody rule violation: Call out breaking changes explicitly
Prompt for LLM
File docs/web-app/records/dashboard-and-queue.md:
Line 76:
Contract-change ambiguity in `docs/web-app/records/dashboard-and-queue.md` and `docs/web-app/notifications.md:2-2` documents API and UI route contracts without stating whether any path, query parameter, or behavior is breaking. Add a dedicated `BREAKING CHANGE` section whenever an existing route, query parameter, or behavior changed, including migration guidance for affected consumers.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
|
|
||
| # Investigations | ||
|
|
||
| Fire and arson investigations, cause-and-origin work and any other case that needs **restricted, need-to-know access**. A case is visible only to its **members**, every read is written to an **access audit**, evidence items carry an append-only **chain of custody**, and findings must be **approved by someone other than their author** before they can be recommended as an amendment to the incident report. |
There was a problem hiding this comment.
Audit-field omission in docs/web-app/records/investigations.md and the matching references in docs/web-app/unit-tracking.md:44-44, docs/web-app/records/reports-and-exports.md:52-52, docs/setup-guides/industrial-emergency-response.md:51-51, docs/apps/unit.md:152-152, docs/web-app/security-permissions.md:76-76, docs/web-app/contacts.md:146-146, and docs/web-app/personnel.md:64-64 leaves protected-record access auditing underspecified. Define an append-only audit payload for every protected-record read and write that includes user id, patient/subject or case id, action, purpose-of-use, timestamp, and request id.
Kody rule violation: Write immutable audit logs for all ePHI access
Prompt for LLM
File docs/web-app/records/investigations.md:
Line 8:
Audit-field omission in `docs/web-app/records/investigations.md` and the matching references in `docs/web-app/unit-tracking.md:44-44`, `docs/web-app/records/reports-and-exports.md:52-52`, `docs/setup-guides/industrial-emergency-response.md:51-51`, `docs/apps/unit.md:152-152`, `docs/web-app/security-permissions.md:76-76`, `docs/web-app/contacts.md:146-146`, and `docs/web-app/personnel.md:64-64` leaves protected-record access auditing underspecified. Define an append-only audit payload for every protected-record read and write that includes user id, patient/subject or case id, action, purpose-of-use, timestamp, and request id.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| | **Referrals** | Referrals to law enforcement, insurers, prosecutors, with agency and status. | | ||
| | **Findings** | Cause classification (accidental, natural, incendiary, undetermined), cause detail, origin description, incident summary, **recommends amendment**. **Record findings** sends them for approval; a reviewer or the lead (other than the author) **approves** or **returns** them. | | ||
| | **Access audit** | Who opened the case and when. | | ||
| | **Export packet** | A packet of the case for the prosecutor or insurer. | |
There was a problem hiding this comment.
Export-control omission in docs/web-app/records/investigations.md and the matching references in docs/web-app/records/reports-and-exports.md:52-52, docs/web-app/security-permissions.md:76-76, and docs/setup-guides/security-and-facilities.md:57-57 leaves bulk export of protected investigative data insufficiently controlled. Document approval requirements, step-up MFA, rate limits, watermarking with requestor and timestamp, and an export_id recorded in the audit log for the export packet workflow.
Kody rule violation: Define data export controls and watermarking
Prompt for LLM
File docs/web-app/records/investigations.md:
Line 33:
Export-control omission in `docs/web-app/records/investigations.md` and the matching references in `docs/web-app/records/reports-and-exports.md:52-52`, `docs/web-app/security-permissions.md:76-76`, and `docs/setup-guides/security-and-facilities.md:57-57` leaves bulk export of protected investigative data insufficiently controlled. Document approval requirements, step-up MFA, rate limits, watermarking with requestor and timestamp, and an `export_id` recorded in the audit log for the export packet workflow.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
|
|
||
| # Investigations | ||
|
|
||
| Fire and arson investigations, cause-and-origin work and any other case that needs **restricted, need-to-know access**. A case is visible only to its **members**, every read is written to an **access audit**, evidence items carry an append-only **chain of custody**, and findings must be **approved by someone other than their author** before they can be recommended as an amendment to the incident report. |
There was a problem hiding this comment.
Audit-schema omission in docs/web-app/records/investigations.md and the matching references in docs/web-app/unit-tracking.md:42-42, docs/web-app/security-permissions.md:84-84, docs/web-app/records/reports-and-exports.md:52-52, and docs/web-app/personnel.md:103-103 leaves security-relevant access logging underspecified. State that tamper-evident audit logs must include timestamp, actor.user_id, actor.role, action, resource.id, result, trace_id, ip, and user_agent, and that they are stored immutably or forwarded appropriately.
Kody rule violation: Emit tamper-evident audit logs with required fields
Prompt for LLM
File docs/web-app/records/investigations.md:
Line 8:
Audit-schema omission in `docs/web-app/records/investigations.md` and the matching references in `docs/web-app/unit-tracking.md:42-42`, `docs/web-app/security-permissions.md:84-84`, `docs/web-app/records/reports-and-exports.md:52-52`, and `docs/web-app/personnel.md:103-103` leaves security-relevant access logging underspecified. State that tamper-evident audit logs must include timestamp, actor.user_id, actor.role, action, resource.id, result, trace_id, ip, and user_agent, and that they are stored immutably or forwarded appropriately.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| | **Referrals** | Referrals to law enforcement, insurers, prosecutors, with agency and status. | | ||
| | **Findings** | Cause classification (accidental, natural, incendiary, undetermined), cause detail, origin description, incident summary, **recommends amendment**. **Record findings** sends them for approval; a reviewer or the lead (other than the author) **approves** or **returns** them. | | ||
| | **Access audit** | Who opened the case and when. | | ||
| | **Export packet** | A packet of the case for the prosecutor or insurer. | |
There was a problem hiding this comment.
MFA-control omission in docs/web-app/records/investigations.md and docs/web-app/security-permissions.md:76-76 treats export of sensitive case data as a privileged operation without a fresh-authentication requirement. Document that privileged exports require MFA within the last 5 minutes and that the audit log records mfa_verified_at.
Kody rule violation: Require step-up MFA for privileged operations
Prompt for LLM
File docs/web-app/records/investigations.md:
Line 33:
MFA-control omission in `docs/web-app/records/investigations.md` and `docs/web-app/security-permissions.md:76-76` treats export of sensitive case data as a privileged operation without a fresh-authentication requirement. Document that privileged exports require MFA within the last 5 minutes and that the audit log records `mfa_verified_at`.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
|
|
||
| | Item | Value | | ||
| |---|---| | ||
| | Routes | `/User/RecordInvestigations/{Index,Details,Open,Custody,Export}` | |
There was a problem hiding this comment.
Authorization-model omission in docs/web-app/records/investigations.md leaves /User/RecordInvestigations/{Index,Details,Open,Custody,Export} without explicit route-level enforcement semantics. State that every investigations route applies deny-by-default authorization by role and resource scope, including case-membership checks for Export and Custody.
Kody rule violation: Implement RBAC with least privilege and deny-by-default
Prompt for LLM
File docs/web-app/records/investigations.md:
Line 49:
Authorization-model omission in `docs/web-app/records/investigations.md` leaves `/User/RecordInvestigations/{Index,Details,Open,Custody,Export}` without explicit route-level enforcement semantics. State that every investigations route applies deny-by-default authorization by role and resource scope, including case-membership checks for `Export` and `Custody`.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| | Field | Notes | | ||
| |---|---| | ||
| | **Permit type / Occupancy** | What and where. | | ||
| | **Applicant, e-mail, phone, contact** | Who applied; can link a [Contact](../contacts). | |
There was a problem hiding this comment.
PII-handling gap in docs/web-app/records/permits.md and the matching references in docs/web-app/personnel.md:8-8, docs/web-app/personnel.md:30-30, docs/self-hosted/installation.md:68-68, and docs/web-app/personnel.md:47-47 documents e-mail, phone, and applicant or contact fields without log-safety guidance. Specify that these values must be redacted or hashed if logged and avoid examples or telemetry references that imply raw PII in logs.
Kody rule violation: Mask PII and secrets in logs
Prompt for LLM
File docs/web-app/records/permits.md:
Line 27:
PII-handling gap in `docs/web-app/records/permits.md` and the matching references in `docs/web-app/personnel.md:8-8`, `docs/web-app/personnel.md:30-30`, `docs/self-hosted/installation.md:68-68`, and `docs/web-app/personnel.md:47-47` documents `e-mail`, `phone`, and applicant or contact fields without log-safety guidance. Specify that these values must be redacted or hashed if logged and avoid examples or telemetry references that imply raw PII in logs.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
|
|
||
| ## Technical reference | ||
|
|
||
| `ReportsController` (+ `ChecklistReportsController`); routes `/User/Reports/{Index,PersonnelReport,StaffingReport,CertificationsReport,UpcomingShiftReadinessReport,DepartmentActivityReport,PersonnelHoursReportParams,PersonnelStaffingHistoryReportParams,UnitStateHistoryReportParams,ActionLogsParams,CallSummaryReportParams,ActiveCallsResourcesReport,FlaggedCallNotesReportParams,EventAttendanceReportParams,ChecklistComplianceReport,LogReport}`; scheduled delivery via `ProfileController.Reporting` and the worker; module switch `ReportsDisabled`. |
There was a problem hiding this comment.
Endpoint-health evidence omission in docs/web-app/reports.md documents ReportsController, ChecklistReportsController, and routes /User/Reports/{Index,PersonnelReport,StaffingReport,CertificationsReport,UpcomingShiftReadinessReport,DepartmentActivityReport,PersonnelHoursReportParams,PersonnelStaffingHistoryReportParams,UnitStateHistoryReportParams,ActionLogsParams,CallSummaryReportParams,ActiveCallsResourcesReport,FlaggedCallNotesReportParams,EventAttendanceReportParams,ChecklistComplianceReport,LogReport} without production health data. Include the endpoint path or controller name together with current production evidence such as p95 latency and error rate, and, if degraded, document a safe rollout or performance mitigation before adding heavier logic.
Kody rule violation: Warn when modifying unstable or high-latency endpoints
Prompt for LLM
File docs/web-app/reports.md:
Line 171:
Endpoint-health evidence omission in `docs/web-app/reports.md` documents `ReportsController`, `ChecklistReportsController`, and routes `/User/Reports/{Index,PersonnelReport,StaffingReport,CertificationsReport,UpcomingShiftReadinessReport,DepartmentActivityReport,PersonnelHoursReportParams,PersonnelStaffingHistoryReportParams,UnitStateHistoryReportParams,ActionLogsParams,CallSummaryReportParams,ActiveCallsResourcesReport,FlaggedCallNotesReportParams,EventAttendanceReportParams,ChecklistComplianceReport,LogReport}` without production health data. Include the endpoint path or controller name together with current production evidence such as p95 latency and error rate, and, if degraded, document a safe rollout or performance mitigation before adding heavier logic.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| |---|---| | ||
| | **Require MFA for all members** | Members without MFA are prompted to enrol at next login. | | ||
| | **Require SSO — disable password login** | Needs an active SSO configuration and at least one admin who has tested SSO login. | | ||
| | **Session timeout (minutes)** | 0 = system default; 480 = 8 h. | |
There was a problem hiding this comment.
Session-policy weakness in docs/web-app/security-permissions.md permits an 8-hour setting without distinguishing idle versus absolute timeout or defining cookie protections. Require idle timeout ≤ 15 minutes, absolute timeout ≤ 12 hours, and Secure, HttpOnly, and SameSite=Lax or Strict session cookies.
Kody rule violation: Harden session management with idle and absolute timeouts
| **Session timeout (minutes)** | Idle timeout should be ≤ 15 minutes; absolute timeout should be ≤ 12 hours. Cookies must be Secure, HttpOnly, and SameSite=Lax or Strict. |Prompt for LLM
File docs/web-app/security-permissions.md:
Line 98:
Session-policy weakness in `docs/web-app/security-permissions.md` permits an 8-hour setting without distinguishing idle versus absolute timeout or defining cookie protections. Require idle timeout ≤ 15 minutes, absolute timeout ≤ 12 hours, and Secure, HttpOnly, and SameSite=Lax or Strict session cookies.
Suggested Code:
| **Session timeout (minutes)** | Idle timeout should be ≤ 15 minutes; absolute timeout should be ≤ 12 hours. Cookies must be Secure, HttpOnly, and SameSite=Lax or Strict. |
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| @@ -0,0 +1,63 @@ | |||
| --- | |||
There was a problem hiding this comment.
Security-and-privacy documentation gap in docs/web-app/unit-tracking.md and the matching references in docs/web-app/records/legal-holds-and-disclosures.md:8-8, docs/web-app/data-protection.md:1-79, and docs/web-app/records/community-risk-reduction.md:40-45 leaves credentials, device identifiers, source networks, retention, monitoring, and location-data processing without a dedicated control model. Add a Security & Privacy section covering credential storage and rotation, IP allowlisting, retention boundaries, audit logging, and how location data is protected and minimized.
Kody rule violation: Capture security and privacy implications
Prompt for LLM
File docs/web-app/unit-tracking.md:
Line 1:
Security-and-privacy documentation gap in `docs/web-app/unit-tracking.md` and the matching references in `docs/web-app/records/legal-holds-and-disclosures.md:8-8`, `docs/web-app/data-protection.md:1-79`, and `docs/web-app/records/community-risk-reduction.md:40-45` leaves credentials, device identifiers, source networks, retention, monitoring, and location-data processing without a dedicated control model. Add a `Security & Privacy` section covering credential storage and rotation, IP allowlisting, retention boundaries, audit logging, and how location data is protected and minimized.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
| border-bottom: 1px solid var(--ifm-toc-border-color); | ||
| } | ||
|
|
||
| .navbar__title { |
There was a problem hiding this comment.
Global-style scope creep in src/css/custom.css and the matching references in src/css/custom.css:140-140, src/css/custom.css:167-167, src/css/custom.css:161-161, src/css/custom.css:208-208, src/css/custom.css:152-152, src/css/custom.css:182-182, src/css/custom.css:147-147, src/css/custom.css:203-203, src/css/custom.css:148-148, src/css/custom.css:156-156, src/css/custom.css:226-226, src/css/custom.css:214-214, src/css/custom.css:235-235, src/css/custom.css:192-192, src/css/custom.css:178-178, src/css/custom.css:191-191, src/css/custom.css:198-198, and src/css/custom.css:197-197 adds styling through a global stylesheet rather than a scoped mechanism. Prefer CSS modules, scoped styles, or component-local styling unless this selector is intentionally top-level app or layout styling.
Kody rule violation: Use component-scoped styling
Prompt for LLM
File src/css/custom.css:
Line 135:
Global-style scope creep in `src/css/custom.css` and the matching references in `src/css/custom.css:140-140`, `src/css/custom.css:167-167`, `src/css/custom.css:161-161`, `src/css/custom.css:208-208`, `src/css/custom.css:152-152`, `src/css/custom.css:182-182`, `src/css/custom.css:147-147`, `src/css/custom.css:203-203`, `src/css/custom.css:148-148`, `src/css/custom.css:156-156`, `src/css/custom.css:226-226`, `src/css/custom.css:214-214`, `src/css/custom.css:235-235`, `src/css/custom.css:192-192`, `src/css/custom.css:178-178`, `src/css/custom.css:191-191`, `src/css/custom.css:198-198`, and `src/css/custom.css:197-197` adds styling through a global stylesheet rather than a scoped mechanism. Prefer CSS modules, scoped styles, or component-local styling unless this selector is intentionally top-level app or layout styling.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
2 participants
Summary
This PR significantly expands and restructures the Resgrid documentation to better reflect the current product and guide users by role, deployment model, and organization type.
What changed
Documentation overhaul for product coverage
New Records documentation set
Expanded app documentation
Setup guidance by organization type
Self-hosted documentation refresh
Navigation and landing page improvements
Broader web app page improvements
Legacy/retired feature clarification
Functional impact