Fix AD-fallback name collisions, silent error paths, and frontend duplication - #10
Merged
Conversation
…ntend helpers - ad_users.rs: disambiguate synthesized SAMs on collision (host suffix) instead of silently dropping a second user with the same display name; update the existing test and add coverage for real-SAM dedup vs. synthesized collision. - commands.rs/config.rs/assignments.rs: log (eprintln!) previously silent AD-fetch, config.json and assignments.json failures so operators can diagnose stale/empty data instead of it failing invisibly. - Frontend: extract PALETTE/hashColor/fmtDe (triplicated across mock.js, view-model.js, app-panels.js) into a single shared.js, loaded first and consumed via window.HVShared (browser) / require (Node tests). - CI: gate the release build on the dependency-audit job passing, and add npm audit alongside the existing cargo audit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Behebt Findings aus einer vollständigen Code-Review (Rust-Backend, JS-Frontend, CI). Kein Sicherheitsfund – Injection-Schutz, CSP, Capabilities und Path-Traversal-Schutz waren bereits sauber. Fokus liegt auf Datenintegrität, Diagnostizierbarkeit und Code-Duplikation.
fallback_users_from_devices(ad_users.rs) hat zwei unterschiedliche Personen mit identischem Anzeigenamen (z.B. zwei "Jürgen Müller" in verschiedenen Abteilungen) stillschweigend zu einem Eintrag zusammengeführt, da der synthetisierte SAM kollidierte. Kollisionen werden jetzt per Host-Suffix disambiguiert, sodass beide Nutzer sichtbar bleiben.config.json(store/config.rs) und kaputteassignments.json(store/assignments.rs) wurden bisher komplett verschluckt und lautlos durch Defaults/Cache ersetzt. Jetzt werden diese Fehler geloggt (eprintln!), das Fallback-Verhalten selbst bleibt unverändert.PALETTE/hashColor(dreifach) undfmtDe(zweifach) waren übermock.js,view-model.js,app-panels.jsverstreut kopiert. Neueshared.js(als erstes Script geladen,window.HVSharedim Browser /module.exportsin Node) konsolidiert beide Helfer.build-Job hing nicht vomaudit-Job ab – ein Dependency-Sicherheitsfund hätte den Release-Build nicht blockiert. Jetztneeds: [..., audit]. Zusätzlichnpm auditim Frontend-Job (bisher nurcargo audit).Ein ursprünglich vermuteter Host-Case-Mismatch bei
set_assignment/known_hostswurde geprüft und als falsch positiv verworfen: Hostnamen werden bereits bei der Aufnahme (master_csv.rs, inventory.rs) konsequent uppercased, das Invariant hält.Test plan
cargo test --all(33 Tests, inkl. neuem/angepasstem Test für die SAM-Disambiguierung)cargo clippy --all-targets -- -D warningscargo fmt --all -- --checknpm run check(Node-Syntax inkl.shared.js)npm test(Parity-Tests)shared.js-Konsolidierung🤖 Generated with Claude Code