Lucas BergerandClaude Opus 4.8
c7955a46b9
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
60 lines
3.0 KiB
Markdown
60 lines
3.0 KiB
Markdown
---
|
|
phase: 20-admin-member-editor-form-declutter
|
|
fixed_at: 2026-06-18T14:45:00Z
|
|
source_review: 20-REVIEW.md
|
|
fix_scope: all
|
|
findings_in_scope: 11
|
|
fixed: 11
|
|
skipped: 0
|
|
iteration: 2
|
|
status: all_fixed
|
|
gates:
|
|
typecheck: pass
|
|
eslint: pass
|
|
prettier: pass
|
|
api_tests: 462/462
|
|
---
|
|
|
|
# Phase 20 — Code Review Fix Report
|
|
|
|
Auto-fix pass over the deep review (`20-REVIEW.md`, 2 critical / 6 warning / 3 info).
|
|
All 11 findings fixed and committed atomically; a deep re-review (iteration 2)
|
|
independently confirmed 0 critical / 0 warning remain.
|
|
|
|
> Note: this report was reconstructed by the orchestrator — the fixer agent applied
|
|
> and committed every fix but its `REVIEW-FIX.md` write did not persist. The commit
|
|
> hashes below are the source of truth.
|
|
|
|
## Fixes applied
|
|
|
|
| ID | Severity | Fix | Commit |
|
|
|----|----------|-----|--------|
|
|
| CR-01 | Critical | Last-admin guard made atomic — single conditional UPDATE / `affectedRows` check closes the TOCTOU window; 409 response shape unchanged | `7297733` |
|
|
| WR-06 | Warning | Empty `{}` PATCH body now rejected with a clean 400 via Zod refinement (was a Drizzle 503 on empty SET); new test added | `7297733` |
|
|
| CR-02 | Critical | `AdminPage` derives the editor's member from live query data and refetches/invalidates after a save — no stale-snapshot demotion overwrite | `ee04aee` |
|
|
| WR-01 | Warning | Toggle-only saves no longer re-send `displayName`, so admin-toggle saves don't 400 for OIDC-provisioned members with a null/empty stored name | `527d855` |
|
|
| WR-02 | Warning | 409 revert uses the actual prior toggle state instead of defaulting to `true` | `527d855` |
|
|
| WR-04 | Warning | `handleClose` closure fixed — Cancel after a per-section save no longer reverts to pre-save values | `527d855` |
|
|
| WR-03 | Warning | Phone bottom-sheet gains `maxHeight` + `overflowY: auto` so the action button is reachable on short phones | `2fd253e` |
|
|
| IN-03 | Info | Phone sheet adds `env(safe-area-inset-bottom)` padding (iOS home indicator) | `2fd253e` |
|
|
| WR-05 | Warning | Admin toggle gains `aria-describedby` linking to the last-admin error region | `d2e9862` |
|
|
| IN-01 | Info | Helper text shown when display name is empty | `400733f` |
|
|
| IN-02 | Info | `maxLength` added to display-name and username inputs | `182ba1d` |
|
|
|
|
(`41a4fae` — prettier formatting of the updated `admin.test.ts`.)
|
|
|
|
## Verification
|
|
|
|
- `pnpm -r typecheck` — pass (API + PWA)
|
|
- ESLint — 0 warnings
|
|
- Prettier — clean
|
|
- API integration tests — **462/462** (includes a new Test H asserting empty-body PATCH → 400)
|
|
|
|
## Introduced during fixes (caught by iteration-2 re-review)
|
|
|
|
- **IN-04 (Info, resolved):** The no-op profile-save path (`mutationFn` returns early on an
|
|
empty payload) triggered `onSuccess`, firing the "Profile saved." toast and refetching the
|
|
`['admin','members']` query even when nothing changed. Fixed in `5161bd3` — `mutationFn`
|
|
now returns a `changed` flag and `onSuccess` skips the toast/refetch when no write occurred.
|
|
Typecheck/eslint/prettier all pass.
|