fix: address PR #398 review comments - test conventions, security hardening

[Copilot]

Description

Addresses three code quality and security issues identified in PR #398 review thread #3820969237:

• Test maintenance: skipped tests converted to todo items per repository convention
• Security: reverse-tabnabbing vulnerability in external link navigation
• Error handling: unsafe JSON parsing without response validation

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Test updates

Related Issues

Relates to #398

Changes Made

Test Maintenance

• DashboardClient.test.tsx: Convert it.skip() → it.todo() for two deferred tests
  • Reduces maintenance cost, prevents false coverage metrics
  • Matches existing convention from TrackingClient tests

Security Hardening

• AcceptTermsForm.tsx: Fix reverse-tabnabbing in legal link

  // Before: Manual window.open() without noopener
  onClick={(e) => {
    e.preventDefault();
    e.stopPropagation();
    window.open('/legal', '_blank');
  }}
  
  // After: Native link with noopener protection
  <Link href="/legal" target="_blank" rel="noopener noreferrer"
    onClick={(e) => e.stopPropagation()} />

Error Handling

• build-info/page.tsx: Validate response before parsing JSON

  // Before: Unconditional parse (unsafe data on error responses)
  fetch("/api/provenance")
    .then(res => res.json())
  
  // After: Status check guards against malformed error bodies
  fetch("/api/provenance")
    .then(res => {
      if (!res.ok) throw new Error(`HTTP error! status: ${res.status}`);
      return res.json();
    })

Version Bump

• Version automatically bumped by workflow (same-repo PRs)
• Version manually bumped using node scripts/bump-version.js (fork PRs)
• Version already up-to-date (no bump needed)

Testing

Test Environment

• Node version: 20.x
• npm version: 10.x
• OS: Ubuntu

Tests Performed

• Unit tests pass (npm run test)
• E2E tests pass (npm run test:e2e)
• Linting passes (npm run lint)
• Manual testing completed

Test Coverage

• Verified it.todo() syntax compiles correctly
• Confirmed link opens in new tab with proper security attributes
• Validated error state triggered on non-2xx API responses

Documentation

• Documentation updated (if needed)
• Code comments added for complex logic
• API documentation updated (if API changes)

Checklist

• My code follows the project's code style
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Screenshots (if applicable)

N/A - Changes are code-level security and maintenance fixes

Additional Notes

Changes are minimal and surgical:

• 2 test cases: body removed, converted to todo placeholders
• 1 link: added rel="noopener noreferrer", removed manual window.open
• 1 fetch: added response status validation before JSON parse

All changes address specific review feedback without modifying surrounding code.

---

For maintainers:

• PR title follows conventional commit format
• Version bump is correct
• All checks pass
• Documentation is complete
• Ready to merge

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR addresses three code quality and security issues identified during the review of PR #398. The changes fix test maintenance practices, eliminate a reverse-tabnabbing vulnerability, and add proper error handling for API responses.

Changes:

• Converted deferred tests from it.skip() to it.todo() to follow repository testing conventions and prevent false coverage metrics
• Added rel="noopener noreferrer" to external link with target="_blank" to prevent reverse-tabnabbing attacks
• Added response status validation before JSON parsing to prevent processing malformed error responses

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/app/(protected)/dashboard/tests/DashboardClient.test.tsx	Converts two skipped tests to todo placeholders by removing test bodies and changing it.skip() to it.todo()
src/components/legal/AcceptTermsForm.tsx	Adds rel="noopener noreferrer" security attribute and removes manual window.open() in favor of native Link behavior
src/app/(public)/build-info/page.tsx	Adds res.ok check before res.json() to validate response status and prevent unsafe JSON parsing

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.