Add configurable splash screen with dismissal tracking and acceptance requirement

[Copilot]

Adds a startup splash screen for displaying policies (cookie, acceptable use, etc.) with admin-configurable messages, localStorage-based dismissal tracking, and optional acceptance requirement.

Backend Changes

• Added /api/splash endpoint to serve configuration from config/[overrides|defaults]/splash-config.json
• Added splash_config_file field to AppSettings following existing config manager patterns
• Added FEATURE_SPLASH_SCREEN_ENABLED feature flag in config_manager.py (default: false)
• Feature flag exposed in /api/config response under features.splash_screen
• /api/splash endpoint checks feature flag and returns disabled config when flag is false

Frontend Changes

• New SplashScreen.jsx component with modal overlay displaying configurable messages
• Supports two message types: heading and text
• Two operational modes:
  • Accept mode (require_accept: true): Forces explicit acceptance, no dismissal
  • Dismiss mode (require_accept: false): Optional dismissal with X button
• localStorage tracks dismissal with configurable duration (default 30 days)
• Integrated at App root level, fetches config on mount

Configuration

Enable the feature:

# In .env file
FEATURE_SPLASH_SCREEN_ENABLED=true

Configuration Schema:

{
  "enabled": true,
  "title": "Important Policies",
  "messages": [
    {"type": "heading", "content": "Cookie Policy"},
    {"type": "text", "content": "This application uses cookies..."}
  ],
  "dismissible": true,
  "require_accept": true,
  "dismiss_duration_days": 30,
  "accept_button_text": "I Accept",
  "dismiss_button_text": "Close",
  "show_on_every_visit": false
}

Documentation

• Added comprehensive section to docs/02_admin_guide.md explaining splash screen configuration
• Updated .env.example with FEATURE_SPLASH_SCREEN_ENABLED flag and SPLASH_CONFIG_FILE variable
• Documented both Accept and Dismiss operational modes with configuration examples

Screenshots

Accept Mode (require_accept: true)

Dismiss Mode (require_accept: false)

Testing

• 14 new frontend tests covering render conditions, dismissal logic, and localStorage persistence
• All 240 existing backend tests passing
• Feature flag validation with enabled/disabled states
• CodeQL scan: 0 vulnerabilities

[!WARNING]

Original prompt

---

This section details on the original issue you should resolve

<filter_complete></filter_complete>

<issue_title>add a splash screen</issue_title>
<issue_description>Add a splash screen on startup.

• the admin can define custom messages. probably show cookie policy and use policy.
• users can dismiss and this is saved for N days (as defined by the admin)
• admin can require user click "accept" to continue. </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes add a splash screen #78

Original prompt

---

This section details on the original issue you should resolve

<issue_title>add a splash screen</issue_title>
<issue_description>Add a splash screen on startup.

• the admin can define custom messages. probably show cookie policy and use policy.
• users can dismiss and this is saved for N days (as defined by the admin)
• admin can require user click "accept" to continue. </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes add a splash screen #78

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[garland3]

@copilot there should be a feature flag for enabling or disabling this feature in the config_manager.py. Also a small note in the admin guide documentation in the /docs is needed.

[Copilot]

@copilot there should be a feature flag for enabling or disabling this feature in the config_manager.py. Also a small note in the admin guide documentation in the /docs is needed.

Added feature flag FEATURE_SPLASH_SCREEN_ENABLED in config_manager.py with dual alias support. Updated .env.example with both the feature flag and SPLASH_CONFIG_FILE environment variable. Added comprehensive documentation to docs/02_admin_guide.md including configuration examples and field descriptions. Changes committed in 5e69562.

To fix the problem, simply remove the unused waitFor from the import statement on line 2 in frontend/src/test/splash-screen.test.jsx. This involves editing only the import statement so that it only imports the functions that are actually used in the file. No further code changes or additional imports are needed elsewhere.

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls