forked from jappel/leistungsbilanz-ts
Full-codebase review turned up five real correctness/security bugs and
a dozen smaller inconsistencies; all are fixed here with matching test
coverage:
- BMK uniqueness silently allowed German-umlaut duplicates ("Ä1" vs
"ä1") because the DB's normalized index only folds ASCII case. Added
a shared Unicode-aware pre-check used by every circuit/component
insert and rename path (one of which had no pre-check at all).
- CircuitDeviceRow.simultaneityFactor had no upper bound at the row
level (command model and snapshot/restore schema), unlike every
sibling entity, letting a bad value silently corrupt power totals.
- Grid cell editing silently misread German thousands-separator input
("1.500" parsed as 1.5); "." is now rejected outright with a clear
message instead of guessing.
- The editor's shared command runner (runCommand/applyHistory) had no
re-entrancy guard, so a double click/drop could fire the same
command twice and race a BMK collision or revision conflict. Added a
synchronous ref guard plus isSaving on the buttons that lacked it.
- GET .../next-identifier leaked circuit-numbering state for sections
in other projects (no ownership check, 400 instead of 404). Moved
under /projects/:projectId and scoped it.
Also: added the missing circuits.section_id / circuit_device_rows.
circuit_id indexes (migration 0006), gave FormModal a focus trap /
Escape-to-close / focus restore and rebuilt ProjectSettingsModal on
top of it instead of duplicated markup, removed dead code (3 orphaned
domain model files, an unused persistence helper, a wrapper only used
by its own test), pointed the project page at GET /projects/:id
instead of listing+filtering client-side, closed the gap between the
documented 18 MB CSV limit and the ~17.17 MiB actually enforced, added
missing upper bounds on several free-text fields, filled in nine
missing German labels in the revision timeline, replaced a
key-order-fragile JSON.stringify equality check with a real field
comparison, made an implicit sort-order assumption in three
renumbering helpers explicit, cleared the sidebar's target selection
when it no longer resolves after a tree reload, and fixed
updateGlobalDevice to check-then-write instead of write-then-check.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
194 lines
5.8 KiB
TypeScript
194 lines
5.8 KiB
TypeScript
import type { SerializedProjectCommand } from "./project-command.model.js";
|
|
|
|
export const circuitDeviceRowUpdateCommandType =
|
|
"circuit-device-row.update" as const;
|
|
export const circuitDeviceRowUpdateCommandSchemaVersion = 1 as const;
|
|
|
|
export interface CircuitDeviceRowUpdateValues {
|
|
linkedProjectDeviceId: string | null;
|
|
sortOrder: number;
|
|
name: string;
|
|
displayName: string;
|
|
phaseType: string | null;
|
|
connectionKind: string | null;
|
|
costGroup: string | null;
|
|
category: string | null;
|
|
level: string | null;
|
|
roomId: string | null;
|
|
roomNumberSnapshot: string | null;
|
|
roomNameSnapshot: string | null;
|
|
quantity: number;
|
|
manualQuantity: number;
|
|
powerPerUnit: number;
|
|
simultaneityFactor: number;
|
|
cosPhi: number | null;
|
|
remark: string | null;
|
|
overriddenFields: string | null;
|
|
}
|
|
|
|
export type CircuitDeviceRowUpdateField = keyof CircuitDeviceRowUpdateValues;
|
|
export type CircuitDeviceRowUpdatePatch =
|
|
Partial<CircuitDeviceRowUpdateValues>;
|
|
|
|
export interface CircuitDeviceRowUpdateFieldChange<
|
|
TField extends CircuitDeviceRowUpdateField = CircuitDeviceRowUpdateField,
|
|
> {
|
|
field: TField;
|
|
value: CircuitDeviceRowUpdateValues[TField];
|
|
}
|
|
|
|
export interface CircuitDeviceRowUpdateCommandPayload {
|
|
rowId: string;
|
|
changes: CircuitDeviceRowUpdateFieldChange[];
|
|
}
|
|
|
|
export interface CircuitDeviceRowUpdateProjectCommand
|
|
extends SerializedProjectCommand<CircuitDeviceRowUpdateCommandPayload> {
|
|
schemaVersion: typeof circuitDeviceRowUpdateCommandSchemaVersion;
|
|
type: typeof circuitDeviceRowUpdateCommandType;
|
|
}
|
|
|
|
export function createCircuitDeviceRowUpdateProjectCommand(
|
|
rowId: string,
|
|
patch: CircuitDeviceRowUpdatePatch
|
|
): CircuitDeviceRowUpdateProjectCommand {
|
|
const normalizedPatch =
|
|
patch.quantity !== undefined && patch.manualQuantity === undefined
|
|
? { ...patch, manualQuantity: patch.quantity }
|
|
: patch;
|
|
if (
|
|
normalizedPatch.quantity !== undefined &&
|
|
normalizedPatch.manualQuantity !== undefined &&
|
|
normalizedPatch.manualQuantity > normalizedPatch.quantity
|
|
) {
|
|
throw new Error("manualQuantity must not exceed quantity.");
|
|
}
|
|
const changes = Object.entries(normalizedPatch).map(([field, value]) => ({
|
|
field: field as CircuitDeviceRowUpdateField,
|
|
value,
|
|
})) as CircuitDeviceRowUpdateFieldChange[];
|
|
const command: CircuitDeviceRowUpdateProjectCommand = {
|
|
schemaVersion: circuitDeviceRowUpdateCommandSchemaVersion,
|
|
type: circuitDeviceRowUpdateCommandType,
|
|
payload: { rowId, changes },
|
|
};
|
|
assertCircuitDeviceRowUpdateProjectCommand(command);
|
|
return command;
|
|
}
|
|
|
|
export function assertCircuitDeviceRowUpdateProjectCommand(
|
|
command: SerializedProjectCommand<unknown>
|
|
): asserts command is CircuitDeviceRowUpdateProjectCommand {
|
|
if (
|
|
command.schemaVersion !== circuitDeviceRowUpdateCommandSchemaVersion ||
|
|
command.type !== circuitDeviceRowUpdateCommandType
|
|
) {
|
|
throw new Error("Unsupported circuit device-row update command.");
|
|
}
|
|
if (!isPlainObject(command.payload)) {
|
|
throw new Error("Circuit device-row update payload must be an object.");
|
|
}
|
|
const rowId = command.payload.rowId;
|
|
const changes = command.payload.changes;
|
|
if (typeof rowId !== "string" || !rowId.trim()) {
|
|
throw new Error("Circuit device-row update command requires a row id.");
|
|
}
|
|
if (!Array.isArray(changes) || changes.length === 0) {
|
|
throw new Error(
|
|
"Circuit device-row update command requires at least one change."
|
|
);
|
|
}
|
|
|
|
const seenFields = new Set<string>();
|
|
for (const change of changes) {
|
|
if (!isPlainObject(change) || typeof change.field !== "string") {
|
|
throw new Error(
|
|
"Circuit device-row update command contains an invalid change."
|
|
);
|
|
}
|
|
if (
|
|
!isCircuitDeviceRowUpdateField(change.field) ||
|
|
seenFields.has(change.field)
|
|
) {
|
|
throw new Error(
|
|
"Circuit device-row update command contains an invalid or duplicate field."
|
|
);
|
|
}
|
|
assertCircuitDeviceRowUpdateFieldValue(change.field, change.value);
|
|
seenFields.add(change.field);
|
|
}
|
|
}
|
|
|
|
function assertCircuitDeviceRowUpdateFieldValue(
|
|
field: CircuitDeviceRowUpdateField,
|
|
value: unknown
|
|
) {
|
|
if (field === "name" || field === "displayName") {
|
|
if (typeof value !== "string" || !value.trim()) {
|
|
throw new Error(`${field} must be a non-empty string.`);
|
|
}
|
|
return;
|
|
}
|
|
if (field === "sortOrder") {
|
|
if (typeof value !== "number" || !Number.isFinite(value)) {
|
|
throw new Error("sortOrder must be a finite number.");
|
|
}
|
|
return;
|
|
}
|
|
if (
|
|
field === "quantity" ||
|
|
field === "manualQuantity" ||
|
|
field === "powerPerUnit" ||
|
|
field === "simultaneityFactor"
|
|
) {
|
|
if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
|
|
throw new Error(`${field} must be a non-negative finite number.`);
|
|
}
|
|
if (field === "simultaneityFactor" && value > 1) {
|
|
throw new Error("simultaneityFactor must not exceed 1.");
|
|
}
|
|
return;
|
|
}
|
|
if (field === "cosPhi") {
|
|
if (
|
|
value !== null &&
|
|
(typeof value !== "number" || !Number.isFinite(value) || value <= 0)
|
|
) {
|
|
throw new Error("cosPhi must be a positive finite number or null.");
|
|
}
|
|
return;
|
|
}
|
|
if (value !== null && typeof value !== "string") {
|
|
throw new Error(`${field} must be a string or null.`);
|
|
}
|
|
}
|
|
|
|
function isCircuitDeviceRowUpdateField(
|
|
value: string
|
|
): value is CircuitDeviceRowUpdateField {
|
|
return [
|
|
"linkedProjectDeviceId",
|
|
"sortOrder",
|
|
"name",
|
|
"displayName",
|
|
"phaseType",
|
|
"connectionKind",
|
|
"costGroup",
|
|
"category",
|
|
"level",
|
|
"roomId",
|
|
"roomNumberSnapshot",
|
|
"roomNameSnapshot",
|
|
"quantity",
|
|
"manualQuantity",
|
|
"powerPerUnit",
|
|
"simultaneityFactor",
|
|
"cosPhi",
|
|
"remark",
|
|
"overriddenFields",
|
|
].includes(value);
|
|
}
|
|
|
|
function isPlainObject(value: unknown): value is Record<string, unknown> {
|
|
return value !== null && typeof value === "object" && !Array.isArray(value);
|
|
}
|