From f8e34b10b88b32bb70afc67547f14c6ffd03a5a8 Mon Sep 17 00:00:00 2001 From: Scott Idem Date: Wed, 22 Apr 2026 02:23:08 -0400 Subject: [PATCH] docs(todo): document download button ID resolution bug and file.clear() scope issue Both found during 2026-04-22 late-night review of Manage Files upload/download flow. Downloads confirmed working despite wrong ID (backend silently accepts event_file_id at hosted_file endpoint). Needs proper fix before backend tightens validation. Co-Authored-By: Claude Sonnet 4.6 --- documentation/TODO__Agents.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/documentation/TODO__Agents.md b/documentation/TODO__Agents.md index bbcb1ef7..5913274d 100644 --- a/documentation/TODO__Agents.md +++ b/documentation/TODO__Agents.md @@ -253,6 +253,36 @@ Firefox unaffected. Production unaffected (public IPs only). Linode → `deploy.sh`. Deferred until Gitea usage is more established. +### [Files] Download button — wrong ID used in `handle_click()` (2026-04-22) +`ae_comp__hosted_files_download_button.svelte` resolves `file_id` for the download call as +`hosted_file_obj?.id || hosted_file_obj?.hosted_file_id || hosted_file_id`. When called from +Manage Files with an `event_file_obj`, `hosted_file_obj.id` = `event_file_id` (set by +`_process_generic_props` via the `_random` strip logic), so the chain stops at the wrong value. +The download call goes to `/v3/action/hosted_file/{event_file_id}/download` instead of using the +correct `hosted_file_id`. May work if the backend accepts event_file_id at that endpoint — +needs live verification. + +**Status (2026-04-22):** Tested — downloads ARE working despite the wrong ID. The backend +V3 action endpoint appears to silently accept `event_file_id` at the `hosted_file` download +path (or maps between the two). Working by accident, not by design. Needs proper fix before +it breaks — if the backend ever tightens that endpoint, all Manage Files downloads will 404. + +**Fix:** In `handle_click()` and both `$effect` blocks and the `content` snippet, replace: +```ts +const file_id = hosted_file_obj?.id || hosted_file_obj?.hosted_file_id || hosted_file_id; +``` +with: +```ts +const file_id = hosted_file_obj?.hosted_file_id ?? hosted_file_id; +``` +The direct-download `` path is unaffected (already uses `event_file_id` → correct endpoint). + +### [Files] `db_events.file.clear()` on upload clears all cached files (2026-04-22) +In `ae_comp__event_files_upload.svelte` line 114, `db_events.file.clear()` wipes the entire +`file` Dexie table, not just files for the current session/presenter. Normally harmless (the +reload right after repopulates), but if multiple sessions' file lists are open simultaneously +they'd briefly flash empty. Low priority — only noticeable in multi-panel workflows. + ### [General] - **Input Field Audit:** Several input fields are missing `name`/`id` attributes or `data-testid`. Known examples: badge override fields in `ae_comp__badge_obj_view.svelte`; template name input in `ae_comp__badge_template_form.svelte`. Matters for: accessibility, autofill, label associations, and test targeting. (For tests, use `getByLabel()` rather than `input[value*=...]` which only checks the HTML attribute, not the Svelte-bound DOM property.)