# SecureCVDownload

> Gated CV download whose trigger opens a verification modal before the file is served. Renders a fragment: the trigger Button inline plus a portaled Modal, with no wrapper element.

- Status: stable
- Group: structure
- Page: https://www.digitaltableteur.com/design-system/components/secure-cv-download
- Contract: https://www.digitaltableteur.com/contracts/v1/SecureCVDownload.contract.json

## When to use

Gated download control for the CV: a trigger button opens a verification modal before the file is served.

## When not to use

The contract records no forbidden uses.

## Look-alikes

The contract names no look-alike with a deciding condition.

## Props

| Prop | Type | Default | Description | Required |
| --- | --- | --- | --- | --- |
| `buttonText` | `string` | none | Button text to trigger the modal. | No |
| `buttonVariant` | `"info" \| "success" \| "warning" \| "error" \| "primary" \| "secondary" \| "tertiary"` | `primary` | Trigger style. primary, secondary and tertiary map to the Button variant; info, success, warning and error render a primary Button with that tone. | No |
| `inverse` | `boolean` | `false` | Make the trigger button use inverse styling (white text/border) | No |

## Variants

- Allowed `buttonVariant` values: `info`, `success`, `warning`, `error`, `primary`, `secondary`, `tertiary` (default `primary`).

## Invalid combinations

The contract records no invalid combinations.

## Keyboard

| Key | Behaviour |
| --- | --- |
| Tab | Moves focus to the control and on to the next focusable element. (standard) |
| Enter | Activates the focused control. (standard) |
| Space | Activates or toggles the focused control. (standard) |
| Escape | Closes or dismisses the open layer. (standard) |

Rows marked (standard) name a key the contract lists without a description; the behaviour shown is the usual one for that key.

## Rules

Every item under When not to use is a MUST NOT. MUST and SHOULD follow RFC 2119.

| Level | Rule | How it is checked |
| --- | --- | --- |
| MUST | ARIA: The trigger is a Button; it opens a Modal dialog titled by downloadResumeModalTitle, with a close icon, Cancel and Download buttons, and Escape closes it. | Not yet verified: no evidence record. WCAG 4.1.2. |
| MUST | ARIA: The password field is a labelled Input that takes focus when the modal opens; Enter submits only once the password validates. | Not yet verified: no evidence record. WCAG 4.1.2. |
| MUST | ARIA: The valid-password result is announced through a visually hidden role="status" region that stays mounted while the dialog is open and receives the downloadResumeValid text when the password checks out; the visible check icon is decorative. | Not yet verified: no evidence record. WCAG 4.1.2. |
| MUST | Required stories produce no axe violations at the configured severity. | Automated by `npm run test:stories:matrix:ci`. WCAG 2.5.8. |
| MUST | The accessibility tree (role, name, state) matches the committed snapshot for every required story. | Automated by `npm run test:stories:matrix:ci`. WCAG 1.3.1, 4.1.2. |
| MUST | The component remains legible and operable under a real browser forced-colors: active pass. | Automated by `npm run test:stories:hc`. |
| MUST | Every documented keyboard interaction works as specified. | Not yet verified: no evidence record. WCAG 2.1.1, 2.1.2. |
| MUST | A human completed an end-to-end accessibility review of this component. | Manual review, last on 2026-11-04. |
| MUST NOT | Maintainers: Do not bypass design tokens or skip forced-colors verification at beta. | Release review; not machine-checked. |

## Install and import

- In-repo only. SecureCVDownload is not exported from `@digitaltableteur/react`, so there is no public import path.

## Links

- Machine-readable contract (Design System Contract 1.0): https://www.digitaltableteur.com/contracts/v1/SecureCVDownload.contract.json
- Markdown version of this page: https://www.digitaltableteur.com/design-system/components/secure-cv-download.md
- Component index as JSON: https://www.digitaltableteur.com/design-system/components.json
- All components: https://www.digitaltableteur.com/design-system/components
- Source: The implementation lives in a private repository. This page, its Markdown twin and the contract are generated from it at build time and are the public source of truth.