From 0fa90d58cbdd9fd94669ef896e9af9c81512bfc7 Mon Sep 17 00:00:00 2001
From: Marcel <marcel@familienarchiv>
Date: Thu, 7 May 2026 09:25:55 +0200
Subject: [PATCH] cleanup(legibility): convert TODOs to issue refs; justify
 naming violators
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CLEANUP-2 (#413): convert two actionable TODOs to issue-referenced stubs
- +layout.server.ts:29 → TODO(#453) for dedicated admin stats endpoint
- ChronikRow.svelte: TODO(#454) for commentPreview; keep SECURITY line
  as standalone comment (XSS guard stays co-located with the risk)

CLEANUP-3 (#414): add one-line justification comments to both naming
violators — SecurityUtils and GlobalExceptionHandler are both justified
by framework convention; no rename needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../exception/GlobalExceptionHandler.java             |  1 +
 .../familienarchiv/security/SecurityUtils.java        |  1 +
 frontend/src/lib/activity/ChronikRow.svelte           | 11 ++---------
 frontend/src/routes/admin/+layout.server.ts           |  3 +--
 4 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/backend/src/main/java/org/raddatz/familienarchiv/exception/GlobalExceptionHandler.java b/backend/src/main/java/org/raddatz/familienarchiv/exception/GlobalExceptionHandler.java
index 7aecf88f..e99acfdd 100644
--- a/backend/src/main/java/org/raddatz/familienarchiv/exception/GlobalExceptionHandler.java
+++ b/backend/src/main/java/org/raddatz/familienarchiv/exception/GlobalExceptionHandler.java
@@ -15,6 +15,7 @@ import org.springframework.web.server.ResponseStatusException;
 
 import lombok.extern.slf4j.Slf4j;
 
+// "Handler" is Spring's @RestControllerAdvice naming convention — not a generic suffix.
 @RestControllerAdvice
 @Slf4j
 public class GlobalExceptionHandler {
diff --git a/backend/src/main/java/org/raddatz/familienarchiv/security/SecurityUtils.java b/backend/src/main/java/org/raddatz/familienarchiv/security/SecurityUtils.java
index 9a3a729d..035c0b9b 100644
--- a/backend/src/main/java/org/raddatz/familienarchiv/security/SecurityUtils.java
+++ b/backend/src/main/java/org/raddatz/familienarchiv/security/SecurityUtils.java
@@ -7,6 +7,7 @@ import org.springframework.security.core.Authentication;
 
 import java.util.UUID;
 
+// Cross-cutting auth helper; no domain home — "Utils" is the correct suffix here.
 public final class SecurityUtils {
 
     private SecurityUtils() {}
diff --git a/frontend/src/lib/activity/ChronikRow.svelte b/frontend/src/lib/activity/ChronikRow.svelte
index a324066e..91651de6 100644
--- a/frontend/src/lib/activity/ChronikRow.svelte
+++ b/frontend/src/lib/activity/ChronikRow.svelte
@@ -159,15 +159,8 @@ const rowHref: string = $derived(
 		</p>
 
 		{#if variant === 'comment'}
-			<!--
-				TODO: the backend does not yet expose a comment body preview on
-				ActivityFeedItemDTO. Render an ellipsis placeholder until it does —
-				duplicating the document title here looks like the comment is
-				quoting itself (Leonie, PR #288 review).
-				SECURITY: once item.commentPreview lands, render via {text}, never
-				{@html}. The backend must truncate and strip tags server-side (Nora,
-				issue #285 comment #3552).
-			-->
+			<!-- TODO(#454): add commentPreview to ActivityFeedItemDTO, then render here -->
+			<!-- SECURITY: render via {text} not {@html} when commentPreview arrives — XSS risk (#285) -->
 			<p
 				data-testid="chronik-comment-preview"
 				class="mt-1 line-clamp-1 font-serif text-sm text-ink-2 italic sm:line-clamp-2"
diff --git a/frontend/src/routes/admin/+layout.server.ts b/frontend/src/routes/admin/+layout.server.ts
index d4a9e6ff..b148bba2 100644
--- a/frontend/src/routes/admin/+layout.server.ts
+++ b/frontend/src/routes/admin/+layout.server.ts
@@ -26,8 +26,7 @@ export async function load({ fetch, locals }) {
 	const api = createApiClient(fetch);
 	const canManageUsers = hasPerm(user, 'ADMIN_USER');
 
-	// TODO: replace with a dedicated /api/admin/stats endpoint that returns counts only,
-	// so the System page does not load full entity lists it does not render.
+	// TODO(#453): replace with dedicated /api/admin/stats endpoint returning counts only
 	const [usersResult, groupsResult, tagsResult] = await Promise.all([
 		api.GET('/api/users'),
 		api.GET('/api/groups'),