Enhance HTML reports with source navigation and improve remote JAR extraction lifecycle

[khalilmalla95]

Summary

The DSF linter generates HTML reports for plugin lint results. Today, findings are listed by severity but there is no way to jump from a message to the underlying BPMN/FHIR source. When linting remote JARs, extracted content is treated like a disposable temp directory, which makes repeat runs and inspection harder.

This issue proposes interactive HTML reporting (click-to-source with highlighting), dashboard navigation, and a more predictable lifecycle for remotely downloaded JAR extractions.

Background / Problem

1. HTML reports are read-only lists
   Users must manually locate BPMN/FHIR files and search for the relevant element or reference mentioned in a lint message.

2. Remote JAR extraction is ephemeral
   After linting a JAR from a remote URL, the extraction directory is removed automatically. Re-running the same URL re-downloads and re-extracts from scratch, and users cannot easily inspect the extracted tree between runs.

3. Dashboard summary cards are not navigational
   Severity counts (Success, Errors, Warnings, Info) are displayed but do not link to the corresponding sections in the report.

4. Inconsistent UX for SUCCESS items
   Some SUCCESS findings (especially plugin-level checks) reference project directories rather than concrete resource files. Clicking them appears interactive but cannot show meaningful source content.

Proposed Solution

1. In-report source file viewer (click lint message → source)

• Embed referenced source file contents into the single-plugin HTML report during generation.
• Resolve files relative to the linted project/extraction path (by filename, recursively if needed).
• Make lint items clickable when a viewable source file is available.
• Open a modal overlay showing the file content.
• Scroll to and highlight the relevant location:
  • BPMN: search for id="<elementId>" (element definition, not bare IDs in sourceRef/targetRef).
  • FHIR: search for the canonical fhirReference URL (strip |version suffix if present).
  • Fallback: use resourceId when neither applies.
• Show a “View in source ›” hint only when source navigation is actually available.

Implementation notes (for developers):

• Pre-compute sourceFile in HtmlReportGenerator (from resourceFile, bpmnFile, or fileName) — do not use OGNL Elvis (?:) in Thymeleaf th:attr; it is not supported and causes template processing errors.
• Pass projectPath into report generation so file contents can be loaded.
• After building the fileContents map, remove sourceFile from items whose file could not be loaded (avoids false affordance for plugin-level SUCCESS items that only have a directory name).

2. Persistent remote JAR extraction directories

• When input is a remote JAR URL:
  • Keep the extraction directory on disk after linting completes.
  • Reuse the same directory on subsequent runs for the same URL (delete and recreate contents before re-extracting).
  • Delete only the temporary downloaded .jar file after extraction (log a warning if deletion fails; do not fail the lint run).
• When input is a local JAR:
  • Keep current behavior: extraction directory remains temporary and is cleaned up after linting.

Expected path pattern: {java.io.tmpdir}/dsf-linter-{sanitized-jar-name}/

3. Dashboard cards scroll to severity sections

• Make summary dashboard cards (Success, Errors, Warnings, Info) clickable.
• On click:
  • Expand the target severity section if it is collapsed.
  • Smooth-scroll the section into view.

4. Template & front-end changes

Update single_plugin_report.html to include:

• Modal markup and styles for the file viewer (<mark> highlighting, overlay, close on backdrop/Escape).
• data-file and data-target attributes on lint items.
• JavaScript: FILE_CONTENTS (Thymeleaf inline), openFileViewer(), closeFileViewer(), scrollToSection().
• Clickable dashboard card styling.

Acceptance Criteria

• Clicking an ERROR/WARN/INFO lint item with a resolvable BPMN or FHIR file opens the modal and shows the correct file.
• The viewer scrolls to the first highlighted match for BPMN element issues and FHIR canonical references.
• Lint items without loadable source content are not shown as clickable (no misleading pointer/hint).
• Remote JAR lint runs leave an extraction folder under the temp directory; a second run with the same URL overwrites that folder instead of leaving stale duplicates.
• Local JAR runs still clean up temporary extraction directories as today.
• Clicking dashboard severity cards scrolls to and expands the matching section.
• HTML report generation does not fail with OGNL/Thymeleaf expression errors for source file attributes.

Affected Components (estimated)

Area	Files
JAR input handling	JarHandler.java
HTML report generation	HtmlReportGenerator.java, LintingReportGenerator.java
Report template	single_plugin_report.html