68 lines
4.4 KiB
Markdown
68 lines
4.4 KiB
Markdown
Scripts / computed fields
|
|
|
|
- Empty sources break the client-side evaluator. Opening an empty scripted table fails the whole load (Invalid
|
|
decimal ''), and on a new entry the computed field shows "Computed value unavailable" until the source is filled.
|
|
Design question: should empty be treated as "not ready — don't evaluate yet" instead of an error? And should the
|
|
client evaluate at all, or let the server compute on save?
|
|
|
|
- Text-column scripts are broken server-side (post_table_data.rs): the script check parse_decimal_exacts both values
|
|
regardless of column type, so even a matching text value fails. The web UI happily lets you create a script on a
|
|
text column. Design question: make the comparison type-aware, or forbid scripts on non-numeric columns at
|
|
creation?
|
|
|
|
- The "Computed values changed; review and save again" loop. When the client's computed value differs from the
|
|
server's, save loops forever with 0 rows persisted. The permission cause is fixed, but the loop still exists
|
|
whenever client and server disagree (rounding, currency, multi-step scripts). Design question: should the client
|
|
just adopt the server's computed value instead of requiring a manual confirm?
|
|
|
|
Authorization / security
|
|
|
|
- Logout doesn't revoke the JWT. A logged-out token still works for 24 h. The client also has no logout UI at all
|
|
(the function exists but is dead code), and there's a user_sessions table that nothing seems to use. Design
|
|
question: server-side session revocation (deny list or the sessions table) vs. short-lived access tokens + refresh
|
|
tokens.
|
|
|
|
- HydrateScriptDependencies can leak cross-table values (mentioned last turn): access is checked on the requested
|
|
table, not on the tables a script reads. A role with access to A but not B could pull B's rows through A's script.
|
|
Design question: authorize each dependency table, or scope scripts so they can only read tables the caller can
|
|
read?
|
|
|
|
- Import validation errors come back as HTTP 502. User-data failures ("value is required", bad decimal) are client
|
|
errors masquerading as server outages. Design question: map gRPC status → HTTP status (InvalidArgument/
|
|
FailedPrecondition → 4xx, internal → 502).
|
|
|
|
Data safety / integrity
|
|
|
|
- Posted tables can never be deleted. "Deleting tables is not allowed after data has been posted"; journal FKs are
|
|
NO ACTION so even raw SQL fails. A mistaken table is permanent. Design question: is that intended protection, or
|
|
should there be an archive-then-delete flow (the "Archive first / Update anyway" guard already exists for rows)?
|
|
|
|
- SetColumnPresentation trusts id/alias pairings. A hand-crafted POST with swapped aliases silently renames columns
|
|
across each other — export, catalog, and validation all follow the wrong names. Design question: reject any alias
|
|
that is currently another column's name in the same request.
|
|
|
|
UX / correctness
|
|
|
|
- Save errors surface inconsistently. Ctrl+S shows a full-chain dialog; Home (save_and_next_entry) only sets the
|
|
status bar with the top context. And the save-failed dialog itself truncates long messages, cutting off the actual
|
|
reason. Design question: always show the full chain in a wrapping dialog.
|
|
|
|
- "Referenced data is in use" is worded as a failure. It's a guard offering Archive/Update/Cancel, but the dialog
|
|
says the update "failed" with a FailedPrecondition code. Design question: reword as a choice, not an error.
|
|
|
|
- Link fields display :id but accept bare ids. Typing what you see (:2) fails validation. Minor, but confusing.
|
|
- Client caches table structure/validation and never refreshes on save — server-side changes don't reach an open
|
|
client until the table is reopened. table_definitions has a row_revision column, so a revision check is feasible.
|
|
Design question: refresh-on-revision-change vs. "reopen to reload".
|
|
|
|
- Analytics leaks a DataFusion planner error on SELECT count(*) (zero-column projection). Internals in the UI; a
|
|
special-case fix.
|
|
|
|
- New-profile form offers USD but the server rejects it (EUR-only books). Restrict the option or support it.
|
|
|
|
Environment / tooling
|
|
|
|
- Your client config blocks startup: form_navigation.toml has row = "first_editable", which the current binary
|
|
rejects. The default template in the source writes first_editable, so either the source template and the enum
|
|
drifted, or the file came from a different build. Worth a quick look — a fresh user could hit this.
|