[Bug] Redaction uses the default country packs, not the configured ones #512

New issue

Closed

opened 2026-07-22 09:28:22 +00:00 by brenno · 0 comments

brenno commented

2026-07-22 09:28:22 +00:00

Owner

PrivacyProjection._project (lib/services/privacy/privacy_projection.dart, around line 148) builds its PrivacyScanner without passing regions:, so it falls back to defaultPrivacyRegions from privacy_scanner.dart. The warning scanner does it correctly: lib/state/privacy_provider.dart passes settings.privacyRegions.

What goes wrong. Turn a country pack off and export or present: you get black boxes over hits OciWacht never reported to you. Turn an extra pack on and the reverse happens — the finding shows in the quality panel but the value is not redacted. Preview and export disagree, exactly where the user is relying on the warning to decide what to share.

Before fixing, weigh it. The doc comment on _project explains why the master switch and the disabled rules are deliberately treated differently there. Regions most likely belong with the disabled rules, so they should be passed through — but check that against docs/design/OCIWACHT.md rather than assuming.

Regression test required. A deck with a hit from a non-default region, exercised with that pack on and off, comparing the reported findings against what redaction actually removes. It must have been red once.

This is the same class of gap as the checklistScope field (fixed earlier): there, a field was scanned but never redacted. That fix produced a parity test comparing scan fields against projection fields. This one is the same shape one level up — the rules differ between scanning and redacting — so it belongs next to that test.

Pre-existing behaviour. Found during a privacy review on feat/gebruiksgemak-eerste-minuten; not caused by that branch.

`PrivacyProjection._project` (`lib/services/privacy/privacy_projection.dart`, around line 148) builds its `PrivacyScanner` **without** passing `regions:`, so it falls back to `defaultPrivacyRegions` from `privacy_scanner.dart`. The warning scanner does it correctly: `lib/state/privacy_provider.dart` passes `settings.privacyRegions`. **What goes wrong.** Turn a country pack off and export or present: you get black boxes over hits OciWacht never reported to you. Turn an extra pack on and the reverse happens — the finding shows in the quality panel but the value is not redacted. Preview and export disagree, exactly where the user is relying on the warning to decide what to share. **Before fixing, weigh it.** The doc comment on `_project` explains why the master switch and the disabled rules are deliberately treated differently there. Regions most likely belong with the disabled rules, so they should be passed through — but check that against `docs/design/OCIWACHT.md` rather than assuming. **Regression test required.** A deck with a hit from a non-default region, exercised with that pack on and off, comparing the reported findings against what redaction actually removes. It must have been red once. This is the same class of gap as the `checklistScope` field (fixed earlier): there, a field was scanned but never redacted. That fix produced a parity test comparing scan fields against projection fields. This one is the same shape one level up — the *rules* differ between scanning and redacting — so it belongs next to that test. Pre-existing behaviour. Found during a privacy review on `feat/gebruiksgemak-eerste-minuten`; not caused by that branch.

brenno added the

accepted

bug

labels

2026-07-22 09:28:22 +00:00

brenno referenced this issue from a pull request that will close it,

2026-07-22 10:39:46 +00:00

fix: laat redactie de ingestelde landenpakketten volgen #529

brenno referenced this issue from a commit

2026-07-22 10:39:48 +00:00

fix(privacy): laat redactie de ingestelde landenpakketten volgen

brenno closed this issue