dc6ea080c4
BLOCKERs: - Remove direct AppUserRepository/CommentRepository access from CommentService and NotificationService — replaced with UserService.findAllById() and UserService (fixes layering contract from CLAUDE.md) - Switch Optional<JavaMailSender> constructor injection — removes @Autowired(required=false) field and ReflectionTestUtils hack in tests - Add @RequirePermission(READ_ALL) to UserSearchController — prevents user enumeration without read access Data bug: - Promote actorName from @Transient to persisted VARCHAR column (V18 migration) - Set actorName in notifyReply and notifyMentions from comment.getAuthorName() Architecture: - Add @RequirePermission(READ_ALL) to NotificationController - Introduce NotificationDTO — controller returns DTO instead of Notification entity, eliminating lazy-load N+1 and AppUser field leakage - Change mentions FetchType to EAGER — fixes LazyInitializationException outside transaction - Add @Transactional(propagation=REQUIRES_NEW) to notifyReply/notifyMentions so a notification failure cannot roll back the parent comment - N+1 fix: replace per-ID findById loops with single findAllById bulk fetch - Move collectParticipantIds to CommentService; notifyReply accepts Set<UUID> directly Security: - Escape displayName before injecting into renderBody HTML span - Replace <a href="#"> with <span class="mention"> — no profile page to link to, and the anchor's scroll-to-top behaviour is harmful Tests added/fixed: - markRead_throwsNotFound, markAllRead_delegatesToRepository, countUnread_delegatesToRepository - markOneRead_returns401, @RequirePermission 403 coverage for both controllers - postComment/replyToComment_triggersNotifyMentions_whenMentionedUserIdsProvided - search_returnsAtMostTenResults now asserts $.length() <= 10 - XSS regression test for escaped displayName in mention.spec.ts Frontend minors: - relativeTime() uses Intl.RelativeTimeFormat (locale-aware, not German-hardcoded) - aria-label uses m.notification_unread() Paraglide key (de/en/es added) - <div role="button"> replaced with <button> (native Enter+Space handling) - onDestroy clears debounceTimer in MentionEditor - setTimeout(100) replaced with await tick() + requestAnimationFrame in CommentThread - Notification prefs form uses checkbox name attributes + formData.has() pattern Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
88 lines
2.7 KiB
Svelte
88 lines
2.7 KiB
Svelte
<script lang="ts">
|
|
import { enhance } from '$app/forms';
|
|
import { untrack } from 'svelte';
|
|
import { m } from '$lib/paraglide/messages.js';
|
|
import PersonalInfoForm from './PersonalInfoForm.svelte';
|
|
import PasswordChangeForm from './PasswordChangeForm.svelte';
|
|
|
|
let { data, form } = $props();
|
|
|
|
let notifyOnReply = $state(untrack(() => data.notificationPrefs?.notifyOnReply ?? false));
|
|
let notifyOnMention = $state(untrack(() => data.notificationPrefs?.notifyOnMention ?? false));
|
|
</script>
|
|
|
|
<div class="mx-auto max-w-7xl px-4 py-8 sm:px-6 lg:px-8">
|
|
<!-- Back link -->
|
|
<a
|
|
href="/"
|
|
class="group mb-4 inline-flex items-center text-xs font-bold tracking-widest text-ink-2 uppercase transition-colors hover:text-ink"
|
|
>
|
|
<svg
|
|
class="mr-2 h-4 w-4 transform transition-transform group-hover:-translate-x-1"
|
|
fill="none"
|
|
viewBox="0 0 24 24"
|
|
stroke="currentColor"
|
|
stroke-width="2"
|
|
>
|
|
<path stroke-linecap="round" stroke-linejoin="round" d="M15 19l-7-7 7-7" />
|
|
</svg>
|
|
{m.btn_back_to_overview()}
|
|
</a>
|
|
|
|
<h1 class="mb-6 font-serif text-3xl font-bold text-ink">{m.profile_heading()}</h1>
|
|
|
|
<div class="grid grid-cols-1 gap-6 md:grid-cols-2">
|
|
<PersonalInfoForm user={data.user} form={form} />
|
|
<PasswordChangeForm form={form} />
|
|
</div>
|
|
|
|
<!-- Notification preferences -->
|
|
<div class="mt-6 rounded-sm border border-line bg-surface p-6 shadow-sm">
|
|
<h2 class="mb-5 text-xs font-bold tracking-widest text-ink-3 uppercase">
|
|
{m.notification_prefs_heading()}
|
|
</h2>
|
|
|
|
{#if form?.prefsSuccess}
|
|
<div class="mb-5 rounded border border-green-200 bg-green-50 p-3 text-sm text-green-700">
|
|
{m.profile_saved()}
|
|
</div>
|
|
{/if}
|
|
{#if form?.prefsError}
|
|
<div class="mb-5 rounded border border-red-200 bg-red-50 p-3 text-sm text-red-700">
|
|
{form.prefsError}
|
|
</div>
|
|
{/if}
|
|
|
|
<form method="POST" action="?/updateNotificationPrefs" use:enhance>
|
|
<div class="space-y-4">
|
|
<label class="flex cursor-pointer items-start gap-3">
|
|
<input
|
|
type="checkbox"
|
|
name="notifyOnReply"
|
|
bind:checked={notifyOnReply}
|
|
class="mt-0.5 h-4 w-4 rounded border-line accent-primary"
|
|
/>
|
|
<span class="text-sm text-ink">{m.notification_pref_reply()}</span>
|
|
</label>
|
|
|
|
<label class="flex cursor-pointer items-start gap-3">
|
|
<input
|
|
type="checkbox"
|
|
name="notifyOnMention"
|
|
bind:checked={notifyOnMention}
|
|
class="mt-0.5 h-4 w-4 rounded border-line accent-primary"
|
|
/>
|
|
<span class="text-sm text-ink">{m.notification_pref_mention()}</span>
|
|
</label>
|
|
</div>
|
|
|
|
<button
|
|
type="submit"
|
|
class="mt-5 rounded-sm bg-primary px-5 py-2 font-sans text-xs font-bold tracking-widest text-primary-fg uppercase transition-opacity hover:opacity-80"
|
|
>
|
|
{m.btn_save()}
|
|
</button>
|
|
</form>
|
|
</div>
|
|
</div>
|