---
phase: 22-approval-ui-livelink-addressable-campaign-review-and-approve
plan: 03
subsystem: ui
tags: [shadcn, radix, tooltip, react, tabs, phishing, xss-safety, clipboard]

# Dependency graph
requires: []
provides:
  - "components/ui/tooltip.tsx — shadcn tooltip primitive (Tooltip/TooltipTrigger/TooltipContent/TooltipProvider)"
  - "components/phishing/url-list.tsx — inert copy-only UrlList component (D-09)"
  - "components/phishing/evidence-card.tsx — tabbed EvidenceCard (Headers/URLs/Attachments/Body preview/Blast Radius)"
affects: [22-04, 22-05, 22-06]

# Tech tracking
tech-stack:
  added: []
  patterns:
    - "shadcn official-registry primitive addition via `npx shadcn add <name>` (no npm dependency delta — radix-ui already a project dependency)"
    - "Inert-render pattern for attacker-controlled URLs: <code> text + copy-to-clipboard button only, never <a>/href/Link (D-09)"
    - "Body-preview rendering exclusively inside a JSX-text <pre>, never a raw-HTML injection prop, for attacker-controlled email content"

key-files:
  created:
    - components/ui/tooltip.tsx
    - components/phishing/url-list.tsx
    - components/phishing/evidence-card.tsx
  modified: []

key-decisions:
  - "EvidenceCard exports EvidenceMessage/EvidenceAttachment/BlastRadiusResult TypeScript interfaces alongside the component so plan 06 (review page composition) and the extended detail route can share the exact shape without re-declaring it."
  - "Message selector (multi-report Select) keeps local useState for selectedId, defaulting to messages[0] (most-recently-linked, per the caller's expected sort order) rather than fetching/sorting inside the component — EvidenceCard stays a pure presentational component per the plan's stated purpose."
  - "Used date-fns formatDistanceToNow for the Select's relative-date label, matching the existing precedent in components/admin/SyncDashboard.tsx and components/mobile/EngagementProfileHeader.tsx rather than introducing a new relTime() helper."

patterns-established:
  - "Pattern: inert-evidence-display — any future surface rendering attacker-controlled extracted data (URLs, hashes, raw text) should copy UrlList's stricter-than-sanitization approach: read-only <code>/<pre> + copy button, zero interactive/navigating affordances."

requirements-completed: [REVIEW-03]

# Metrics
duration: 20min
completed: 2026-07-16
---

# Phase 22 Plan 03: Evidence Display (Tooltip primitive + UrlList + EvidenceCard) Summary

**Tabbed, read-only EML evidence display (Headers/URLs/Attachments/Body preview/Blast Radius) built on a new shadcn tooltip primitive and a D-09-compliant inert URL list, with zero clickable-link surface and zero raw-HTML rendering of attacker-controlled email content.**

## Performance

- **Duration:** ~20 min
- **Started:** 2026-07-16T18:10:33Z
- **Completed:** 2026-07-16T18:29:40Z
- **Tasks:** 2 completed
- **Files modified:** 3 created

## Accomplishments
- Added the `tooltip` shadcn primitive via the official registry (`npx shadcn add tooltip`) — zero new npm dependency, since `radix-ui` was already a project dependency.
- Built `UrlList` (`components/phishing/url-list.tsx`): extracted URLs render as inert `<code>` monospace text with an icon-only copy-to-clipboard button; no `<a>`/`href`, no `<Link>`, no navigating `onClick` anywhere in the file (D-09).
- Built `EvidenceCard` (`components/phishing/evidence-card.tsx`): tabbed display of Headers (2-col definition list + SPF/DKIM/DMARC badges + collapsible received chain), URLs (delegates to `UrlList`), Attachments (metadata-only table with copy-hash affordance), Body preview (plain-text `<pre>`, never raw-HTML rendering), and Blast Radius (explicit unavailable-state copy or stat row + per-recipient table).

## Task Commits

Each task was committed atomically:

1. **Task 1: Add tooltip primitive + build UrlList (D-09 inert)** - `87008a5` (feat)
2. **Task 2: EvidenceCard — tabbed EML evidence (REVIEW-03)** - `4ec5ba4` (feat)

Additional commit: `2d5761b` (docs) — logged pre-existing, out-of-scope test failures to `deferred-items.md`.

**Plan metadata:** SUMMARY commit (this file) follows below.

## Files Created/Modified
- `components/ui/tooltip.tsx` - shadcn tooltip primitive (Tooltip/TooltipTrigger/TooltipContent/TooltipProvider), generated by the official registry, no new npm dependency
- `components/phishing/url-list.tsx` - inert, copy-only rendering of extracted URLs (D-09); exports `UrlList({ urls })`
- `components/phishing/evidence-card.tsx` - tabbed EML evidence display; exports `EvidenceCard({ messages, blastRadius })` plus the `EvidenceMessage`/`EvidenceAttachment`/`BlastRadiusResult` shared TypeScript shapes

## Decisions Made
- Exported the evidence data shapes (`EvidenceMessage`, `EvidenceAttachment`, `BlastRadiusResult`) directly from `evidence-card.tsx` rather than a separate types file, since this plan is the sole owner of the shape today and plan 02's extended detail route / plan 06's review page can import from here without duplication.
- Kept the multi-report `<Select>` state fully local (`useState<string | undefined>`), matching the plan's "pure presentational component" framing — no fetch, no sorting logic inside `EvidenceCard` itself.

## Deviations from Plan

None - plan executed exactly as written. Both tasks matched the UI-SPEC's exact markup/class specifications (grid layout, badge tint recipes, `<pre className="whitespace-pre-wrap">`, icon-only Copy buttons with explicit `aria-label`s).

One incidental fix during self-verification: two source-comment strings in `url-list.tsx` and `evidence-card.tsx` literally contained the substrings `href` and `dangerouslySetInnerHTML` (in prose explaining what NOT to do), which caused the plan's own `grep -c` acceptance checks to false-positive. Reworded the comments to describe the same constraint without using the literal grep-target substrings. This is a documentation-only wording change, not a behavior change — not logged as a numbered deviation since it didn't touch any code path.

## Issues Encountered
- `npm test` surfaced 2 pre-existing failures in `lib/services/analyzer/itglue-search.test.ts`, unrelated to this plan's files. Logged to `.planning/phases/22-approval-ui-livelink-addressable-campaign-review-and-approve/deferred-items.md` per the scope-boundary rule (not fixed, not in scope for 22-03).

## Known Stubs

None. Both components render whatever data they're given; no hardcoded/empty placeholder data paths were introduced. (The components have no callers yet — that's plan 06's job — so there is no live data flow to verify beyond typechecking against the documented shapes.)

## User Setup Required

None - no external service configuration required.

## Next Phase Readiness
- `components/ui/tooltip.tsx`, `components/phishing/url-list.tsx`, and `components/phishing/evidence-card.tsx` are ready for consumption by plan 06 (the ticket-scoped review page) and by `ActionAreaCard` (plan 04, for D-05/D-06 disabled-button tooltips).
- No blockers. The `EvidenceCard` props (`messages: EvidenceMessage[]`, `blastRadius: BlastRadiusResult`) are the exact contract the extended `campaigns/[id]` detail route (plan 02) must produce — future plans should conform to these exported interfaces rather than re-deriving the shape.

---
*Phase: 22-approval-ui-livelink-addressable-campaign-review-and-approve*
*Plan: 03*
*Completed: 2026-07-16*

## Self-Check: PASSED

All created files verified present on disk; all task/docs commits verified present in git log (87008a5, 4ec5ba4, 2d5761b, f7516c0).
