fix(phi): open the patient record when access justification is confirmed

[NeuroKoder3]

The bug

In the Risk Intel dashboard, clicking View next to a patient (aHHQ, Lab Currency, Readiness Barriers tabs) opens the access-justification prompt. Selecting a reason and clicking Confirm Access returned the user to the dashboard without ever opening the record.

Root cause

Radix's AlertDialogAction closes the dialog itself, so pressing Confirm Access fired onOpenChange(false) in addition to the submit handler. The dialog treated any close as a cancellation:

<AlertDialog open={open} onOpenChange={(isOpen) => { if (!isOpen) onCancel(); }}>

That ran the cancel path while the access:authorizePhiAccess IPC was still in flight. handleCancel settled the request as cancelled first, and because a promise resolves only once, the real grant arriving moments later was discarded — so accessGranted stayed false and PatientDetails's onCancel had already called window.history.back().

This affected every route into a patient record, not just the two tabs reported.

A second defect: Cancel invoked onCancel twice (its own onClick plus the close event), so window.history.back() ran twice and skipped a page.

Changes

• JustificationDialog records which button caused the close, so a confirm is no longer read as a cancellation. All non-confirm closes (Cancel, Escape, overlay) route through a single cancel path, emitting exactly one onCancel.
• useJustifiedAccess ignores a cancellation while a confirm owns the outcome — defence in depth against the same race.
• PatientDetails distinguishes denied from cancelled and shows the reason with a way back, instead of waiting forever on a dialog that already closed. This is what a viewer/user/regulator role (no patient:view_phi) would previously have hit.

Why CI missed it

tests/components/PatientDetails.test.jsx mocks both useJustifiedAccess and JustificationDialog, so their interaction was never exercised.

Testing

New tests/components/JustificationAccessFlow.test.jsx drives the real dialog and real hook through actual user events: confirm, slow IPC, custom text, empty justification, denial, thrown IPC error, Cancel, and Escape.

Verified the suite genuinely reproduces the bug — against the pre-fix code 7 of 10 fail, including the double-cancel; all 10 pass after.

• 10/10 new tests pass
• 137/137 component tests pass
• 37/37 Electron suites pass
• lint clean, production build clean

Epic Connection Hub

Not touched. The change is confined to three renderer files; no main-process, FHIR, HL7, or EHR code is modified.

Made with Cursor

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.