style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
@@ -14,20 +14,20 @@ autonomous: true
|
||||
requirements: []
|
||||
must_haves:
|
||||
truths:
|
||||
- "Every first-run ESLint violation across both apps is resolved so `pnpm lint` exits 0 (D-13-05: fix all violations now; phase not done until green)"
|
||||
- "Fixes ADDRESS the violation, never mask it: no blanket eslint-disable; no `void promise` used to silence a floating promise that should be awaited; every eslint-disable-next-line carries a justifying inline comment explaining why the rule is wrong HERE (D-13-06)"
|
||||
- "Floating-promise findings on the push/outbox/reminder broker paths are reviewed as candidate bugs (real await missing?) BEFORE any `void` is applied; legitimate fire-and-forget setInterval ticks may use `void runX().catch(...)` only with that intent documented (D-13-06)"
|
||||
- "ical.js no-unsafe-* findings in broker sync/expand are handled with targeted eslint-disable-next-line + a justification comment mirroring the EventForm.tsx:271-275 idiom (external-library weak-typing limitation, not a bug) (D-13-06)"
|
||||
- 'Every first-run ESLint violation across both apps is resolved so `pnpm lint` exits 0 (D-13-05: fix all violations now; phase not done until green)'
|
||||
- 'Fixes ADDRESS the violation, never mask it: no blanket eslint-disable; no `void promise` used to silence a floating promise that should be awaited; every eslint-disable-next-line carries a justifying inline comment explaining why the rule is wrong HERE (D-13-06)'
|
||||
- 'Floating-promise findings on the push/outbox/reminder broker paths are reviewed as candidate bugs (real await missing?) BEFORE any `void` is applied; legitimate fire-and-forget setInterval ticks may use `void runX().catch(...)` only with that intent documented (D-13-06)'
|
||||
- 'ical.js no-unsafe-* findings in broker sync/expand are handled with targeted eslint-disable-next-line + a justification comment mirroring the EventForm.tsx:271-275 idiom (external-library weak-typing limitation, not a bug) (D-13-06)'
|
||||
artifacts:
|
||||
- path: "apps/api/src/broker/sync.ts"
|
||||
provides: "ical.js unsafe-access findings resolved (narrowed or justified-suppressed)"
|
||||
- path: "apps/pwa/src/components/EventForm.tsx"
|
||||
provides: "no-explicit-any on the occurrence.recurrence cast handled via the pre-existing justified suppression"
|
||||
- path: 'apps/api/src/broker/sync.ts'
|
||||
provides: 'ical.js unsafe-access findings resolved (narrowed or justified-suppressed)'
|
||||
- path: 'apps/pwa/src/components/EventForm.tsx'
|
||||
provides: 'no-explicit-any on the occurrence.recurrence cast handled via the pre-existing justified suppression'
|
||||
key_links:
|
||||
- from: "pnpm lint (root)"
|
||||
to: "apps/api + apps/pwa lint scripts"
|
||||
via: "exit code 0 after fixes"
|
||||
pattern: "pnpm -r --if-present lint"
|
||||
- from: 'pnpm lint (root)'
|
||||
to: 'apps/api + apps/pwa lint scripts'
|
||||
via: 'exit code 0 after fixes'
|
||||
pattern: 'pnpm -r --if-present lint'
|
||||
---
|
||||
|
||||
<objective>
|
||||
@@ -52,6 +52,7 @@ Output: lint-clean source across apps/api and apps/pwa. `pnpm lint` exits 0.
|
||||
@.planning/phases/13-real-lint-gate-eslint/13-01-SUMMARY.md
|
||||
|
||||
# The hot-spot source files (per RESEARCH First-Run Violations + PATTERNS):
|
||||
|
||||
@apps/api/src/broker/sync.ts
|
||||
@apps/api/src/broker/expand.ts
|
||||
@apps/api/src/broker/outboxWorker.ts
|
||||
@@ -92,6 +93,7 @@ Read 13-01-SUMMARY.md FIRST. It contains the per-rule violation inventory `pnpm
|
||||
apps/api/tests/**: these are linted with non-type-aware rules (disableTypeChecked override from Plan 01). Fix any no-unused-vars / syntactic violations there too. Three test files already carry `eslint-disable-next-line @typescript-eslint/ban-ts-comment` — leave those (already justified by intent of the @ts-expect-error usage; add a one-line justification comment if absent).
|
||||
|
||||
Do NOT run Prettier and do NOT reformat. Keep edits surgical — only touch lines that resolve a violation.
|
||||
|
||||
</action>
|
||||
<verify>
|
||||
<automated>cd /home/luc/Projects/familysync && pnpm --filter @familysync/api lint; test $? -eq 0 && echo API_LINT_GREEN</automated>
|
||||
@@ -121,6 +123,7 @@ Read 13-01-SUMMARY.md FIRST. It contains the per-rule violation inventory `pnpm
|
||||
apps/pwa/e2e/**: covered by tsconfig.e2e.json (type-aware). Fix no-unused-vars / no-floating-promises in specs (Playwright actions are awaited; a missing await on a locator action is a real flake bug — fix it, don't void it).
|
||||
|
||||
Do NOT run Prettier and do NOT reformat. Surgical edits only.
|
||||
|
||||
</action>
|
||||
<verify>
|
||||
<automated>cd /home/luc/Projects/familysync && pnpm --filter @familysync/pwa lint; test $? -eq 0 && echo PWA_LINT_GREEN</automated>
|
||||
@@ -146,20 +149,22 @@ Read 13-01-SUMMARY.md FIRST. It contains the per-rule violation inventory `pnpm
|
||||
</tasks>
|
||||
|
||||
<threat_model>
|
||||
|
||||
## Trust Boundaries
|
||||
|
||||
| Boundary | Description |
|
||||
|----------|-------------|
|
||||
| external library (ical.js) → broker code | Untyped `any` values cross into sync/expand; unsafe access is the lint signal |
|
||||
| Boundary | Description |
|
||||
| ----------------------------------------------------------- | ------------------------------------------------------------------------------ |
|
||||
| external library (ical.js) → broker code | Untyped `any` values cross into sync/expand; unsafe access is the lint signal |
|
||||
| async dispatch (push/outbox/reminder) → unhandled rejection | A floating/misused promise here can silently swallow a security-relevant error |
|
||||
|
||||
## STRIDE Threat Register
|
||||
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
|-----------|----------|-----------|-------------|-----------------|
|
||||
| T-13-02 | Tampering | masking a real bug with eslint-disable / `void` | mitigate | D-13-06 enforced per-task: no blanket disables; every suppression carries a justification comment; floating promises on push/outbox/reminder paths are reviewed for a missing-await bug BEFORE any `void`. Reviewer checks the diff for un-justified disables. |
|
||||
| T-13-03 | Information Disclosure | floating promise swallowing errors (broker dispatch) | mitigate | `no-floating-promises` (type-aware) surfaces every unhandled promise; each is either awaited/`.catch()`-handled (real fix) or documented fire-and-forget — never silently voided. |
|
||||
| T-13-04 | Tampering | no-unsafe-* on ical.js-derived data | accept | ical.js is a trusted Mozilla-maintained library with weak types; values are validated at the call site. Suppressions are targeted + justified, not blanket. |
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
| --------- | ---------------------- | ---------------------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| T-13-02 | Tampering | masking a real bug with eslint-disable / `void` | mitigate | D-13-06 enforced per-task: no blanket disables; every suppression carries a justification comment; floating promises on push/outbox/reminder paths are reviewed for a missing-await bug BEFORE any `void`. Reviewer checks the diff for un-justified disables. |
|
||||
| T-13-03 | Information Disclosure | floating promise swallowing errors (broker dispatch) | mitigate | `no-floating-promises` (type-aware) surfaces every unhandled promise; each is either awaited/`.catch()`-handled (real fix) or documented fire-and-forget — never silently voided. |
|
||||
| T-13-04 | Tampering | no-unsafe-\* on ical.js-derived data | accept | ical.js is a trusted Mozilla-maintained library with weak types; values are validated at the call site. Suppressions are targeted + justified, not blanket. |
|
||||
|
||||
</threat_model>
|
||||
|
||||
<verification>
|
||||
@@ -169,11 +174,12 @@ Read 13-01-SUMMARY.md FIRST. It contains the per-rule violation inventory `pnpm
|
||||
</verification>
|
||||
|
||||
<success_criteria>
|
||||
|
||||
- `pnpm lint` exits 0 across both apps (D-13-05).
|
||||
- All fixes address violations, none mask them (D-13-06): justified suppressions only, real bugs genuinely fixed.
|
||||
- typecheck + tests still green.
|
||||
- No Prettier reformatting in this plan (reserved for Plan 03, D-13-08).
|
||||
</success_criteria>
|
||||
</success_criteria>
|
||||
|
||||
<output>
|
||||
Create `.planning/phases/13-real-lint-gate-eslint/13-02-SUMMARY.md` when done. Record: per-rule counts fixed; every eslint-disable-next-line added (file:line + the rule + the one-line justification); any real bug found-and-fixed on the async dispatch paths (if a missing await was discovered, call it out — it is a genuine bug catch and the whole point of D-13-01's type-aware choice).
|
||||
|
||||
Reference in New Issue
Block a user