Make columns in security inventory toggle-able

What does this MR do and why?

Make columns in security inventory toggle-able

Add a display options button above the table that opens a drawer
where each column's visibility can be toggled
Only show security attributes toggle when user has read permission
Always show name and actions columns, and checkbox column if available
Persist the list of hidden columns in localStorage

References

• epic: Security Inventory: UX and Usability Improvements (gitlab-org#22124)
• the security attributes column this can now hide was added in Add security attributes column to inventory (!199973 - merged)

There is no issue for this - it came out of a conversation at the R&D Summit

Screenshots or screen recordings

Before	After

expand for previous screen recordings

How to set up and validate locally

0. git checkout mfluharty-inventory-toggleable-columns
   echo "Feature.enable(:security_inventory_toggleable_columns)" | gdk rails c

1. have a GitLab Ultimate licence
2. go to a group => Secure => Security inventory

toggling a column off and on

1. check that there is a Display button above the table
2. select Display and check the drawer:
   • it should be titled Display
   • under Columns there should be a toggle for Vulnerabilities, Tool Coverage and Security attributes
   • there should be no toggle for Name or for the actions column
3. toggle Vulnerabilities off
4. check the table:
   • the Vulnerabilities column should disappear
   • Name and the actions column should still be there
   • the remaining columns should spread to fill the width rather than leaving a gap
5. toggle it back on and check the column returns in its original position

hiding everything that can be hidden

1. toggle all three columns off
2. check that the table is still usable:
   • Name should still be shown
   • the actions column should still be shown
   • the checkbox column should still be shown, if it was there to begin with (permission-dependent)

the hidden columns are persisted to localStorage

1. toggle Tool Coverage off
2. reload the page
3. check that Tool Coverage is still hidden
4. navigate to a different group and back, and check it is still hidden
5. clear the setting and check the default returns

   localStorage.removeItem('security_inventory_hidden_columns')

   then reload - all columns should be visible again

without permission to read security attributes

1. sign in as a user who can see the security inventory but cannot read security attributes
2. open the Display drawer
3. check that the Security attributes toggle is absent:
   • the Vulnerabilities and Tool Coverage toggles should still be there
   • the Security attributes column should not be in the table either
   • this is the canReadAttributes branch, so it gates the toggle and the column together

with the flag off

1. disable the flag

   echo "Feature.disable(:security_inventory_toggleable_columns, Group.find(ID))" | gdk rails c

2. reload the security inventory
3. check that the table is back to how it was before this MR:
   • there should be no Display button
   • every column should be visible, including any you had hidden while the flag was on
   • the hidden column set is not read from local storage while the flag is off, so a stale setting cannot leave a column hidden with no drawer to restore it

to run tests

yarn jest ee/spec/frontend/security_inventory/components/display_options_spec.js ee/spec/frontend/security_inventory/components/security_inventory_table_spec.js ee/spec/frontend/security_inventory/components/inventory_dashboard_spec.js

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.