ryan/lunarfront-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix security and quality issues from code review

Browse Source 
Critical: Add company scoping to line item update/delete and note
delete via ownership verification through ticket join. Add companyId
validation to signed URL file serving. High: Paginate notes list
endpoint with search and sort support. Fix blob URL memory leaks in
AuthImage components with proper cleanup on unmount. Improve photo
upload error handling — count failures and show specific error count
instead of silently clearing form.
This commit is contained in:
Ryan Moon
2026-03-29 12:16:17 -05:00
parent 21ef7e7059
commit 72d0ff0a33
7 changed files with 89 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
packages/backend/api-tests/suites/repairs.ts
View File

@@ -296,14 +296,16 @@ suite('Repairs', { tags: ['repairs'] }, (t) => {
t.assert.equal(res.data.visibility, 'customer')
})
t.test('lists notes for a ticket in chronological order', { tags: ['notes', 'read'] }, async () => {
t.test('lists notes for a ticket with pagination', { tags: ['notes', 'read'] }, async () => {
const ticket = await t.api.post('/v1/repair-tickets', { customerName: 'List Notes', problemDescription: 'Test' })
await t.api.post(`/v1/repair-tickets/${ticket.data.id}/notes`, { content: 'First note' })
await t.api.post(`/v1/repair-tickets/${ticket.data.id}/notes`, { content: 'Second note' })
const res = await t.api.get(`/v1/repair-tickets/${ticket.data.id}/notes`)
const res = await t.api.get(`/v1/repair-tickets/${ticket.data.id}/notes`, { limit: 100 })
t.assert.status(res, 200)
t.assert.equal(res.data.data.length, 2)
t.assert.ok(res.data.pagination)
t.assert.equal(res.data.pagination.total, 2)
t.assert.equal(res.data.data[0].content, 'First note')
t.assert.equal(res.data.data[1].content, 'Second note')
})
@@ -323,7 +325,7 @@ suite('Repairs', { tags: ['repairs'] }, (t) => {
const res = await t.api.del(`/v1/repair-notes/${note.data.id}`)
t.assert.status(res, 200)
const list = await t.api.get(`/v1/repair-tickets/${ticket.data.id}/notes`)
const list = await t.api.get(`/v1/repair-tickets/${ticket.data.id}/notes`, { limit: 100 })
t.assert.equal(list.data.data.length, 0)
})