Scott.Idem/OSIT-AE-App-Svelte
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(todo): document download button ID resolution bug and file.clear() scope issue

Browse Source 
Both found during 2026-04-22 late-night review of Manage Files upload/download flow.
Downloads confirmed working despite wrong ID (backend silently accepts event_file_id
at hosted_file endpoint). Needs proper fix before backend tightens validation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Scott Idem
2026-04-22 02:23:08 -04:00
parent 29c5a9fa82
commit f8e34b10b8
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
documentation/TODO__Agents.md
View File

@@ -253,6 +253,36 @@ Firefox unaffected. Production unaffected (public IPs only).
Linode → `deploy.sh`. Deferred until Gitea usage is more established.
### [Files] Download button — wrong ID used in `handle_click()` (2026-04-22)
`ae_comp__hosted_files_download_button.svelte` resolves `file_id` for the download call as
`hosted_file_obj?.id || hosted_file_obj?.hosted_file_id || hosted_file_id`. When called from
Manage Files with an `event_file_obj`, `hosted_file_obj.id` = `event_file_id` (set by
`_process_generic_props` via the `_random` strip logic), so the chain stops at the wrong value.
The download call goes to `/v3/action/hosted_file/{event_file_id}/download` instead of using the
correct `hosted_file_id`. May work if the backend accepts event_file_id at that endpoint —
needs live verification.
**Status (2026-04-22):** Tested — downloads ARE working despite the wrong ID. The backend
V3 action endpoint appears to silently accept `event_file_id` at the `hosted_file` download
path (or maps between the two). Working by accident, not by design. Needs proper fix before
it breaks — if the backend ever tightens that endpoint, all Manage Files downloads will 404.
**Fix:** In `handle_click()` and both `$effect` blocks and the `content` snippet, replace:
```ts
const file_id = hosted_file_obj?.id || hosted_file_obj?.hosted_file_id || hosted_file_id;
```
with:
```ts
const file_id = hosted_file_obj?.hosted_file_id ?? hosted_file_id;
```
The direct-download `<a>` path is unaffected (already uses `event_file_id` → correct endpoint).
### [Files] `db_events.file.clear()` on upload clears all cached files (2026-04-22)
In `ae_comp__event_files_upload.svelte` line 114, `db_events.file.clear()` wipes the entire
`file` Dexie table, not just files for the current session/presenter. Normally harmless (the
reload right after repopulates), but if multiple sessions' file lists are open simultaneously
they'd briefly flash empty. Low priority — only noticeable in multi-panel workflows.
### [General]
- **Input Field Audit:** Several input fields are missing `name`/`id` attributes or `data-testid`. Known examples: badge override fields in `ae_comp__badge_obj_view.svelte`; template name input in `ae_comp__badge_template_form.svelte`. Matters for: accessibility, autofill, label associations, and test targeting. (For tests, use `getByLabel()` rather than `input[value*=...]` which only checks the HTML attribute, not the Svelte-bound DOM property.)