Julian Appel
b45dc5002d
Full-codebase review turned up five real correctness/security bugs and
a dozen smaller inconsistencies; all are fixed here with matching test
coverage:
- BMK uniqueness silently allowed German-umlaut duplicates ("Ä1" vs
"ä1") because the DB's normalized index only folds ASCII case. Added
a shared Unicode-aware pre-check used by every circuit/component
insert and rename path (one of which had no pre-check at all).
- CircuitDeviceRow.simultaneityFactor had no upper bound at the row
level (command model and snapshot/restore schema), unlike every
sibling entity, letting a bad value silently corrupt power totals.
- Grid cell editing silently misread German thousands-separator input
("1.500" parsed as 1.5); "." is now rejected outright with a clear
message instead of guessing.
- The editor's shared command runner (runCommand/applyHistory) had no
re-entrancy guard, so a double click/drop could fire the same
command twice and race a BMK collision or revision conflict. Added a
synchronous ref guard plus isSaving on the buttons that lacked it.
- GET .../next-identifier leaked circuit-numbering state for sections
in other projects (no ownership check, 400 instead of 404). Moved
under /projects/:projectId and scoped it.
Also: added the missing circuits.section_id / circuit_device_rows.
circuit_id indexes (migration 0006), gave FormModal a focus trap /
Escape-to-close / focus restore and rebuilt ProjectSettingsModal on
top of it instead of duplicated markup, removed dead code (3 orphaned
domain model files, an unused persistence helper, a wrapper only used
by its own test), pointed the project page at GET /projects/:id
instead of listing+filtering client-side, closed the gap between the
documented 18 MB CSV limit and the ~17.17 MiB actually enforced, added
missing upper bounds on several free-text fields, filled in nine
missing German labels in the revision timeline, replaced a
key-order-fragile JSON.stringify equality check with a real field
comparison, made an implicit sort-order assumption in three
renumbering helpers explicit, cleared the sidebar's target selection
when it no longer resolves after a tree reload, and fixed
updateGlobalDevice to check-then-write instead of write-then-check.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
79 lines
2.4 KiB
TypeScript
79 lines
2.4 KiB
TypeScript
import express from "express";
|
|
import { globalDeviceRouter } from "./routes/global-device.routes.js";
|
|
import { projectDeviceRouter } from "./routes/project-device.routes.js";
|
|
import { projectRouter } from "./routes/project.routes.js";
|
|
import { errorMiddleware } from "./middleware/error.middleware.js";
|
|
import { createLogger, toErrorMeta } from "../shared/logging/logger.js";
|
|
|
|
const logger = createLogger("api");
|
|
const app = express();
|
|
const port = Number(process.env.PORT || 3000);
|
|
const heartbeatIntervalMs = 5 * 60 * 1000;
|
|
|
|
app.use(express.json({ limit: "25mb" }));
|
|
|
|
app.use((req, res, next) => {
|
|
if (req.path === "/health") {
|
|
next();
|
|
return;
|
|
}
|
|
const startedAt = Date.now();
|
|
logger.debug("request started", { method: req.method, path: req.originalUrl });
|
|
res.on("finish", () => {
|
|
const meta = {
|
|
method: req.method,
|
|
path: req.originalUrl,
|
|
status: res.statusCode,
|
|
durationMs: Date.now() - startedAt,
|
|
};
|
|
if (res.statusCode >= 500) logger.error("request completed", meta);
|
|
else if (res.statusCode >= 400) logger.warn("request completed", meta);
|
|
else logger.info("request completed", meta);
|
|
});
|
|
res.on("close", () => {
|
|
if (!res.writableEnded) {
|
|
logger.warn("request aborted before response finished", {
|
|
method: req.method,
|
|
path: req.originalUrl,
|
|
durationMs: Date.now() - startedAt,
|
|
});
|
|
}
|
|
});
|
|
next();
|
|
});
|
|
|
|
app.get("/health", (_req, res) => {
|
|
res.json({ ok: true });
|
|
});
|
|
|
|
app.use("/api/projects", projectRouter);
|
|
app.use("/api/global-devices", globalDeviceRouter);
|
|
app.use("/api/project-devices", projectDeviceRouter);
|
|
|
|
app.use(errorMiddleware);
|
|
|
|
process.on("uncaughtException", (error) => {
|
|
logger.error("uncaught exception, exiting", toErrorMeta(error));
|
|
process.exit(1);
|
|
});
|
|
|
|
process.on("unhandledRejection", (reason) => {
|
|
logger.error("unhandled rejection, exiting", toErrorMeta(reason));
|
|
process.exit(1);
|
|
});
|
|
|
|
process.on("SIGTERM", () => logger.info("received SIGTERM"));
|
|
process.on("SIGINT", () => logger.info("received SIGINT"));
|
|
|
|
setInterval(() => {
|
|
const memory = process.memoryUsage();
|
|
logger.verbose("heartbeat", {
|
|
uptimeSeconds: Math.round(process.uptime()),
|
|
rssMb: Math.round(memory.rss / 1024 / 1024),
|
|
heapUsedMb: Math.round(memory.heapUsed / 1024 / 1024),
|
|
});
|
|
}, heartbeatIntervalMs).unref();
|
|
|
|
app.listen(port, () => {
|
|
logger.info("server started", { port });
|
|
});
|