feat(security): add System Use Notification gate for FedRAMP AC-8 (WCH-AC8-001)

[smohite-nice]

Implements the AC-8 System Use Notification as a separate feature from the existing privacyNotice, satisfying FedRAMP Moderate control AC-8.

Jira: CSA-97598
Confluence: WCH-AC8-001
Platform PR: cognigy-ai-app #66423 — adds FEATURE_SYSTEM_USE_NOTIFICATION_ENABLED Helm flag to serviceEndpoint

Key design decisions

Separate from privacyNotice — these serve different purposes and must not be merged:

	privacyNotice (existing)	systemUseNotification (new)
Purpose	GDPR / data consent	US Gov security warning (AC-8)
Who needs it	All customers (EU, Asia, etc.)	Regulated deployments only
Persistence	Per userId (once per user lifetime)	Per sessionId (prior to every user session)
Default	enabled: false	enabled: false — auto-enabled via FEATURE_SYSTEM_USE_NOTIFICATION_ENABLED platform flag

Per-session display — shown before every new conversation (sessionId changes), not every page refresh. Resets on SWITCH_SESSION and re-checks storage for the new session.

No silent bypass — disableLocalStorage: true returns false (show notice), not true (skip).

Changes

• webchat-config.ts — systemUseNotification? config section added
• config-reducer.ts — defaults with AC-8 placeholder text (pending compliance approval)
• privacyPolicy.ts — hasAcceptedSunInStorage / setHasAcceptedSunInStorage keyed by sessionId
• ui-reducer.ts — hasAcceptedSystemUseNotification state + action; resets on SWITCH_SESSION
• ui-middleware.ts — persists SUN acceptance by sessionId; re-checks storage after SWITCH_SESSION
• SystemUseNotification.tsx — new component (reuses PrivacyNotice UI)
• WebchatUI.tsx — SUN gate shown before PrivacyNotice; all send gates updated
• Webchat.tsx — restores SUN acceptance on mount from sessionId
• ConnectedWebchatUI.tsx — wires new state + action
• systemUseNotification.cy.ts — E2E test suite (11 tests: rendering, accept flow, per-session gating, ordering, WCAG 2.2 AA)

Still needed before production

• Legal/Compliance approves final AC-8 banner text (replace placeholder in config-reducer.ts)
• Platform team merges cognigy-ai-app #66423 so FEATURE_SYSTEM_USE_NOTIFICATION_ENABLED=true auto-activates the notice

Success criteria

• Notice shown before every new conversation session (keyed by sessionId)
• Notice NOT shown on page refresh within the same session
• Notice shown again after switchSession (new conversation)
• Socket does not connect before the user accepts the notice
• Non-regulated customers (EU/Asia) are unaffected — privacyNotice behaviour unchanged
• disableLocalStorage: true does not bypass the notice

Security

• No security implications

Accessibility (WCAG 2.2 AA)

• npm run lint:a11y passes
• Added cy.checkA11yCompliance() for the new SUN surface (systemUseNotification.cy.ts)
• Keyboard-only operable; focus visible and managed
• All interactive elements have an accessible name

Documentation Considerations

AC-8 banner text in config-reducer.ts is a placeholder pending Legal/Compliance approval.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR implements a FedRAMP AC-8 “System Use Notification” (SUN) gate in Webchat v3 by adding a new configurable notice screen and persisting per-session acceptance in browser storage, integrating it into the existing “privacy notice” gating flow.

Changes:

• Adds systemUseNotification settings to the config schema and default config state.
• Introduces a new SystemUseNotification presentational screen and renders it before the privacy notice in WebchatUI.
• Stores/restores SUN acceptance via Redux UI state + browser storage, wired through UI middleware.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/webchat/store/ui/ui-reducer.ts	Adds SUN acceptance state + action.
src/webchat/store/ui/ui-middleware.ts	Persists SUN acceptance to browser storage.
src/webchat/store/config/config-reducer.ts	Adds default systemUseNotification config block.
src/webchat/helper/privacyPolicy.ts	Adds storage helpers for per-session SUN acceptance.
src/webchat/components/Webchat.tsx	Restores SUN acceptance from storage on mount.
src/webchat/components/ConnectedWebchatUI.tsx	Plumbs SUN acceptance state/dispatch into WebchatUI props.
src/webchat-ui/components/WebchatUI.tsx	Gates chat start/send behind SUN (before privacy notice) and renders the new screen.
src/webchat-ui/components/presentational/SystemUseNotification.tsx	New SUN screen component.
src/common/interfaces/webchat-config.ts	Extends IWebchatSettings with systemUseNotification.

Suppressed comments (2)

src/webchat-ui/components/WebchatUI.tsx:1726

• The implementation treats hasAcceptedSystemUseNotification as a global boolean, but sessions can change at runtime via SWITCH_SESSION (new conversation / previous conversations). Once set to true, the notice will stay bypassed even after switching to a new sessionId, which contradicts the intended per-session gating.

			// System Use Notification (AC-8 / FedRAMP) is shown BEFORE the privacy notice.
			// It is gated per session: a new conversation (new sessionId) requires re-acceptance.
			if (sun?.enabled && !hasAcceptedSystemUseNotification)

src/webchat-ui/components/presentational/SystemUseNotification.tsx:67

• External links rendered from markdown open a new tab (target="_blank") but use rel="noreferrer" only. Use rel="noopener noreferrer" to prevent reverse-tabnabbing and to align with existing Cypress expectations for external links.

							a: ({ node, ...props }) => (
								// eslint-disable-next-line jsx-a11y/anchor-has-content
								<a {...props} target="_blank" rel="noreferrer" />
							),

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.