fix(idaa): harden identity linkage in BB post and comment edit handlers

Three targeted fixes following code review of the Novi UUID linkage commit:

1. ae_idaa_comp__post_obj_id_edit.svelte — Add localStorage scavenge fallback
   in handle_submit_form() for external_person_id / full_name / email.
   WHY: The form input falls back to $idaa_loc.novi_uuid at render time only.
   On a race-condition mount where the store was null, the input captures an
   empty string.  Without this, a subsequent PATCH on a legacy post (no
   external_person_id) would overwrite the field with an empty string, permanently
   breaking the Novi linkage for that record.  The scavenge re-checks the live
   store and then localStorage before submitting.

2. ae_idaa_comp__post_options.svelte — Fix double alert() on creation failure.
   WHY: The .catch() handler alerted the user and reset 'creating'.  The
   .finally() block then ran unconditionally and fired a second alert when
   final_id was null (which it always is on failure).  User saw two dialogs.
   Fixed by removing the duplicate alert from .finally() — it now only resets
   the 'creating' flag, which .catch() may have already done (harmless reset).

3. ae_idaa_comp__post_comment_obj_id_edit.svelte — Remove 'log_lvl = 1' mutation.
   WHY: log_lvl is a $bindable prop.  Assigning to it inside handle_submit_form()
   unconditionally mutated the parent binding on every single form submission,
   overriding the caller's logging preference.  This was debug code accidentally
   left in.  Removed; the existing 'if (log_lvl)' guard is sufficient.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Scott Idem
2026-04-07 22:23:33 -04:00
parent f2765d6a5e
commit 8d30e01ad4
3 changed files with 28 additions and 5 deletions

View File

@@ -131,7 +131,6 @@ async function handle_submit_form(event: any) {
post_comment_do['group'] = post_comment_form.group ?? null;
post_comment_do['enable'] = post_comment_form.enable ?? true;
log_lvl = 1;
if (log_lvl) {
console.log('Final Payload (post_comment_do):', post_comment_do);
}

View File

@@ -131,9 +131,33 @@ async function handle_submit_form(event: any) {
post_do['anonymous'] = post_di.anonymous;
post_do['external_person_id'] = post_di.external_person_id;
post_do['full_name'] = post_di.full_name;
post_do['email'] = post_di.email;
// Robust scavenging: the form input falls back to $idaa_loc.novi_uuid at render
// time, but if the store was null during that render (race condition on mount) the
// input would have captured an empty string. Re-check the store and then
// localStorage so legacy posts without an external_person_id never overwrite with ''.
let identity_person_id: string | null = post_di.external_person_id || null;
let identity_full_name: string | null = post_di.full_name || null;
let identity_email: string | null = post_di.email || null;
if (!identity_person_id) {
identity_person_id = $idaa_loc.novi_uuid ?? null;
identity_full_name = identity_full_name || $idaa_loc.novi_full_name || null;
identity_email = identity_email || $idaa_loc.novi_email || null;
}
if (!identity_person_id && typeof localStorage !== 'undefined') {
try {
const ls_val = localStorage.getItem('ae_idaa_loc');
if (ls_val) {
const ls_json = JSON.parse(ls_val);
identity_person_id = ls_json.novi_uuid ?? null;
identity_full_name = identity_full_name || ls_json.novi_full_name || null;
identity_email = identity_email || ls_json.novi_email || null;
}
} catch (e) { /* ignore */ }
}
post_do['external_person_id'] = identity_person_id;
post_do['full_name'] = identity_full_name;
post_do['email'] = identity_email;
post_do['notify'] = post_di.notify;
post_do['hide'] = post_di.hide;

View File

@@ -248,8 +248,8 @@ let creating = $state(false); // true while create API call is in-flight
);
goto(`/idaa/bb/${final_id}`);
} else {
// .catch() already alerted the user — just reset the flag.
creating = false;
alert('Failed to create new post.');
}
});
}}