SecureCVDownload

Gated CV download whose trigger opens a verification modal before the file is served. Renders a fragment: the trigger Button inline plus a portaled Modal, with no wrapper element.

Status: stable. Group: structure. Markdown version: /design-system/components/secure-cv-download.md

When to use

Gated download control for the CV: a trigger button opens a verification modal before the file is served.

When not to use

The contract records no forbidden uses.

Look-alikes

The contract names no look-alike with a deciding condition.

Props

SecureCVDownload props
Prop	Type	Default	Description	Required
`buttonText`	`string`	none	Button text to trigger the modal.	No
`buttonVariant`	`"info" \| "success" \| "warning" \| "error" \| "primary" \| "secondary" \| "tertiary"`	`primary`	Trigger style. primary, secondary and tertiary map to the Button variant; info, success, warning and error render a primary Button with that tone.	No
`inverse`	`boolean`	`false`	Make the trigger button use inverse styling (white text/border)	No

Variants

Allowed buttonVariant values: info, success, warning, error, primary, secondary, tertiary (default primary).

Invalid combinations

The contract records no invalid combinations.

Keyboard

SecureCVDownload keyboard behaviour
Key	Behaviour
Tab	Moves focus to the control and on to the next focusable element. (standard)
Enter	Activates the focused control. (standard)
Space	Activates or toggles the focused control. (standard)
Escape	Closes or dismisses the open layer. (standard)

Rows marked (standard) name a key the contract lists without a description; the behaviour shown is the usual one for that key.

Rules

Every item under When not to use is a MUST NOT. MUST and SHOULD follow RFC 2119.

SecureCVDownload rules
Level	Rule	How it is checked
MUST	ARIA: The trigger is a Button; it opens a Modal dialog titled by downloadResumeModalTitle, with a close icon, Cancel and Download buttons, and Escape closes it.	Not yet verified: no evidence record. WCAG 4.1.2.
MUST	ARIA: The password field is a labelled Input that takes focus when the modal opens; Enter submits only once the password validates.	Not yet verified: no evidence record. WCAG 4.1.2.
MUST	ARIA: The valid-password result is announced through a visually hidden role="status" region that stays mounted while the dialog is open and receives the downloadResumeValid text when the password checks out; the visible check icon is decorative.	Not yet verified: no evidence record. WCAG 4.1.2.
MUST	Required stories produce no axe violations at the configured severity.	Automated by `npm run test:stories:matrix:ci`. WCAG 2.5.8.
MUST	The accessibility tree (role, name, state) matches the committed snapshot for every required story.	Automated by `npm run test:stories:matrix:ci`. WCAG 1.3.1, 4.1.2.
MUST	The component remains legible and operable under a real browser forced-colors: active pass.	Automated by `npm run test:stories:hc`.
MUST	Every documented keyboard interaction works as specified.	Not yet verified: no evidence record. WCAG 2.1.1, 2.1.2.
MUST	A human completed an end-to-end accessibility review of this component.	Manual review, last on 2026-11-04.
MUST NOT	Maintainers: Do not bypass design tokens or skip forced-colors verification at beta.	Release review; not machine-checked.

Install and import

In-repo only. SecureCVDownload is not exported from @digitaltableteur/react, so there is no public import path.