[Project Solar / Phase 1 / Engineering Follow-ups] Add localStorage parsing validation

[didoo]

📌 Summary

In a previous review, Copilot suggested to add validation of the localStorage.getItem result, to protect against corrupted or malicious data.

This PR addresses this issue.

🛠️ Detailed description

In this PR I have:

• added validation of parsed localStorage in hdsTheming service
• added validation of parsed localStorage in shwTheming service

🔗 External links

Jira ticket: https://hashicorp.atlassian.net/browse/HDS-5689

---

👀 Component checklist

💬 Please consider using conventional comments when reviewing this PR.

📋 PCI review checklist

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've worked with GRC to document the impact of any changes to security controls.
  Examples of changes to controls include access controls, encryption, logging, etc.
• If applicable, I've worked with GRC to ensure compliance due to a significant change to the in-scope PCI environment.
  Examples include changes to operating systems, ports, protocols, services, cryptography-related components, PII processing code, etc.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
hds-showcase	Ready	Preview	Dec 5, 2025 10:30am
hds-website	Ready	Preview	Dec 5, 2025 10:30am

[Copilot]

Pull request overview

This PR adds validation for localStorage data to protect against corrupted or malicious input when initializing theming settings. The changes implement type guards to verify that parsed data conforms to expected structures before use, with fallback to default values when validation fails.

Key changes:

• Added isSafeStoredThemingData type guard function to validate theming data structure and values in the hds-theming service
• Added isSafeStylesheetData type guard function to validate stylesheet selection in the shw-theming service
• Refactored ShwStylesheets type to derive from a const array for runtime validation

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
packages/components/src/services/hds-theming.ts	Added comprehensive validation for theming data with type guard and fallback to defaults
showcase/app/services/shw-theming.ts	Added validation for stylesheet data and refactored type definition to enable runtime checks

[KristinLBradley]

Logic, etc. look good to me.

[KristinLBradley]

The Percy diff was with the rendering of some CodeBlock line numbers, which is not a real issue, so I approved it.