fix: assign unique page_uid to custom-attribute tab/field ids

[Scharxi]

Summary

Fixes #1111. The case-details "Custom Attributes" tab didn't highlight or
switch correctly because
page_uid — used to namespace every generated attribute tab/field DOM id
— was referenced in 12
templates but never assigned anywhere in the codebase, so every render
produced the same unscoped
ids and Bootstrap 4's global id-based tab lookup collided.

What changed

• fix: assign unique page_uid to custom-attribute tab/field ids

Adds one generate_page_uid() helper (app/util.py) and wires it into
all 15 render_template()
call sites that reach the shared attribute-tab partials, across
case/asset/ioc/task/event/evidence
and manage/case/customer/attribute-preview modals. Zero template changes —
modal_attributes_tabs.html
and modal_attributes_nav.html already read {{page_uid}} correctly,
they just never received a value.

Also extends the test harness (tests/rest_api.py, tests/iris.py) with
a raw-HTML fetch and a real
cookie-session login helper — the existing suite only talks to the JSON
API via API key, which can't
reach this bug (only observable in server-rendered HTML behind a real
session). Adds a regression test
that renders two independent cases and asserts their attribute-tab ids
differ.

Validation

• Tests: 5/5 pass (4 pre-existing + 1 new regression test) against a
  fresh v2.4.29 stack running this
  branch's code — zero regressions.
• Syntax: python -m py_compile clean on all 12 touched files.
• Manual: verified live — "Info" is the default-active tab, two
  independently-rendered cases get
  distinct page_uids instead of both rendering
  1_investigation_metadata.
• docker-compose.dev.yml's from-source build could not be run in the
  authoring sandbox (unrelated
  Debian apt-signing/network issue, fails before any app code is copied
  in) — substituted with the
  published v2.4.29 images + this branch's source bind-mounted in; full
  details in the notes below.

Notes for the reviewer

• Base branch: targets hotfix_v2.4.29, not develop — develop has
  moved to a private
  v3.0.0-beta submodule architecture (iris-backend/iris-frontend)
  where this code no longer exists.
  Redirect me if there's a different intended target for v2.4.x fixes.
• SESSION_COOKIE_SECURE=True (configuration.py:294) means
  session-cookie auth only survives HTTPS —
  the new test helper goes through nginx (https://127.0.0.1, cert
  verification off for the dev
  self-signed cert), not the plain-HTTP port the existing API-key-based
  tests use.
• New test cases aren't seeded with custom_attributes at creation (only
  the "Add case" modal
  pre-fetches and echoes back defaults) — the regression test creates
  cases first, then updates the
  attribute definition, so update_all_attributes()'s backfill path is
  what seeds them. Commented
  inline in the test.

Linked

Fixes #1111

Ready for review.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• api_*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 011a03a0-65e5-4f68-95c8-55afe4668c7a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}