falkan/dickloads
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: simplify admin code — extract shared helpers, fix quality issues

Browse Source 
- Extract KEBAB_RE, SESSION_COOKIE, SESSION_MAX_AGE_MS, COOKIE_MAX_AGE,
  authRequest(), and sessionResponse() to auth.ts — eliminating 4 copies
  of the auth() wrapper and 3 copies of KEBAB_RE across admin API routes
- Remove timing side-channel: drop a.length !== b.length early-return
  before timingSafeEqual in verifySession (SHA-256 HMAC always 64 chars)
- Fix YOLO localStorage write-before-read race using initialization guard
- Fix admin layout /api/ bypass to return {} instead of {authenticated:true}
- Extract extractError() helper in admin page — removes 4 inline patterns
- Parallel Promise.all in admin loadData() — halves round-trip latency
- Parallel Promise.all in moveCheckedUnits() + surface per-request errors
- Hoist Big(inputValue) above .map() in converter — one alloc per recompute
- O(n) single-pass orderedResults using Map instead of O(n*groups) filters
- Fix expandedGroups.add() mutation — use Set assignment for consistency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Falkan
2026-03-17 14:04:33 -04:00
parent d1f51c141e
commit aeeae1e7ce
10 changed files with 144 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/routes/admin/+layout.server.ts
View File

@@ -1,6 +1,5 @@
import { redirect } from '@sveltejs/kit';
import { loadConfig } from '$lib/server/data';
import { requireAuth } from '$lib/server/auth';
import { authRequest } from '$lib/server/auth';
import type { LayoutServerLoad } from './$types';
export const load: LayoutServerLoad = ({ request, url }) => {
@@ -9,15 +8,12 @@ export const load: LayoutServerLoad = ({ request, url }) => {
return { authenticated: false };
}
// Skip auth check for API routes (they handle their own auth)
// API routes handle their own auth — layout data isn't consumed by +server.ts
if (url.pathname.includes('/api/')) {
return { authenticated: true };
return {};
}
const config = loadConfig();
const authed = requireAuth(request, config);
if (!authed) {
if (!authRequest(request)) {
throw redirect(302, '/admin/login');
}

51
src/routes/admin/+page.svelte
View File

@@ -24,23 +24,29 @@
// ── Load data on mount ───────────────────────────────────────────────────────
async function loadData() {
const res = await fetch('/admin/api/units');
const [res, gres] = await Promise.all([
fetch('/admin/api/units'),
fetch('/admin/api/groups')
]);
if (!res.ok) return;
const units: Unit[] = await res.json();
const gres = await fetch('/admin/api/groups');
const groups: Group[] = gres.ok ? await gres.json() : [];
unitsData = { units, groups };
// Initialize expanded state
for (const g of groups) {
expandedGroups.add(g.id);
}
// Expand all groups — use assignment for consistent reactive update
expandedGroups = new Set([...expandedGroups, ...groups.map((g) => g.id)]);
}
// Load on mount
// ── Load on mount ────────────────────────────────────────────────────────────
$effect(() => {
loadData();
});
/** Extract a server error message from a non-ok response. */
async function extractError(res: Response, fallback: string): Promise<string> {
const body = await res.json().catch(() => ({}));
return (body as Record<string, string>).error ?? fallback;
}
// ── Derived ──────────────────────────────────────────────────────────────────
let unitsByGroup = $derived.by(() => {
const map = new Map<string | null, Unit[]>();
@@ -113,8 +119,7 @@
});
}
if (!res.ok) {
const err = await res.json().catch(() => ({}));
formError = (err as Record<string, string>).error ?? 'Save failed';
formError = await extractError(res, 'Save failed');
return;
}
formSuccess = unitFormNew ? 'Unit created.' : 'Unit saved.';
@@ -135,8 +140,7 @@
try {
const res = await fetch(`/admin/api/units/${selectedItem.id}`, { method: 'DELETE' });
if (!res.ok) {
const err = await res.json().catch(() => ({}));
formError = (err as Record<string, string>).error ?? 'Delete failed';
formError = await extractError(res, 'Delete failed');
return;
}
selectedItem = null;
@@ -167,8 +171,7 @@
});
}
if (!res.ok) {
const err = await res.json().catch(() => ({}));
formError = (err as Record<string, string>).error ?? 'Save failed';
formError = await extractError(res, 'Save failed');
return;
}
formSuccess = groupFormNew ? 'Group created.' : 'Group saved.';
@@ -220,8 +223,7 @@
body: JSON.stringify(body)
});
if (!res.ok) {
const err = await res.json().catch(() => ({}));
formError = (err as Record<string, string>).error ?? 'Delete failed';
formError = await extractError(res, 'Delete failed');
return;
}
deleteGroupTarget = null;
@@ -236,12 +238,19 @@
// ── Multi-select move ────────────────────────────────────────────────────────
async function moveCheckedUnits() {
if (!moveTargetGroupId || checkedUnitIds.size === 0) return;
for (const unitId of checkedUnitIds) {
await fetch(`/admin/api/units/${unitId}`, {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ group: moveTargetGroupId })
});
formError = null;
const results = await Promise.all(
[...checkedUnitIds].map((unitId) =>
fetch(`/admin/api/units/${unitId}`, {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ group: moveTargetGroupId })
})
)
);
const failed = results.filter((r) => !r.ok);
if (failed.length) {
formError = `${failed.length} unit(s) failed to move`;
}
checkedUnitIds = new Set();
moveTargetGroupId = '';

21
src/routes/admin/api/auth/login/+server.ts
View File

@@ -1,11 +1,8 @@
import { json } from '@sveltejs/kit';
import { loadConfig } from '$lib/server/data';
import { verifyPassword, createSession } from '$lib/server/auth';
import { serialize } from 'cookie';
import { verifyPassword, createSession, sessionResponse, COOKIE_MAX_AGE } from '$lib/server/auth';
import type { RequestHandler } from './$types';
const COOKIE_MAX_AGE = 86400 * 7; // 7 days
export const POST: RequestHandler = async ({ request, url }) => {
const body = await request.json().catch(() => ({}));
const { password } = body as { password?: string };
@@ -33,19 +30,5 @@ export const POST: RequestHandler = async ({ request, url }) => {
}
const token = createSession(config.sessionSecret);
const sessionCookie = serialize('hu_session', token, {
httpOnly: true,
sameSite: 'strict',
secure: url.protocol === 'https:',
path: '/',
maxAge: COOKIE_MAX_AGE
});
return new Response(JSON.stringify({ ok: true }), {
status: 200,
headers: {
'Content-Type': 'application/json',
'Set-Cookie': sessionCookie
}
});
return sessionResponse(token, url.protocol === 'https:', COOKIE_MAX_AGE);
};

18
src/routes/admin/api/auth/logout/+server.ts
View File

@@ -1,20 +1,6 @@
import { json } from '@sveltejs/kit';
import { serialize } from 'cookie';
import { sessionResponse } from '$lib/server/auth';
import type { RequestHandler } from './$types';
export const POST: RequestHandler = ({ url }) => {
const clearCookie = serialize('hu_session', '', {
httpOnly: true,
sameSite: 'strict',
secure: url.protocol === 'https:',
path: '/',
maxAge: 0
});
return new Response(JSON.stringify({ ok: true }), {
status: 200,
headers: {
'Content-Type': 'application/json',
'Set-Cookie': clearCookie
}
});
return sessionResponse('', url.protocol === 'https:', 0);
};

14
src/routes/admin/api/groups/+server.ts
View File

@@ -1,23 +1,17 @@
import { json } from '@sveltejs/kit';
import { loadData, saveData, loadConfig } from '$lib/server/data';
import { requireAuth } from '$lib/server/auth';
import { loadData, saveData } from '$lib/server/data';
import { authRequest, KEBAB_RE } from '$lib/server/auth';
import type { RequestHandler } from './$types';
import type { Group } from '$lib/types';
function auth(request: Request) {
return requireAuth(request, loadConfig());
}
const KEBAB_RE = /^[a-z][a-z0-9-]*$/;
export const GET: RequestHandler = ({ request }) => {
if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
const data = loadData();
return json(data.groups);
};
export const POST: RequestHandler = async ({ request }) => {
if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
const body = await request.json().catch(() => null);
if (!body) return json({ error: 'Invalid JSON' }, { status: 400 });

25
src/routes/admin/api/groups/[id]/+server.ts
View File

@@ -1,15 +1,11 @@
import { json } from '@sveltejs/kit';
import { loadData, saveData, loadConfig } from '$lib/server/data';
import { requireAuth } from '$lib/server/auth';
import { loadData, saveData } from '$lib/server/data';
import { authRequest } from '$lib/server/auth';
import type { RequestHandler } from './$types';
import type { Group } from '$lib/types';
function auth(request: Request) {
return requireAuth(request, loadConfig());
}
export const PUT: RequestHandler = async ({ request, params }) => {
if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
const { id } = params;
const body = await request.json().catch(() => null);
@@ -35,11 +31,7 @@ export const PUT: RequestHandler = async ({ request, params }) => {
// Then set new base unit toBase = 1.0
for (const unit of data.units) {
if (unit.group === id) {
if (unit.id === newBaseId) {
unit.toBase = 1.0;
} else {
unit.toBase = unit.toBase / X;
}
unit.toBase = unit.id === newBaseId ? 1.0 : unit.toBase / X;
}
}
}
@@ -52,7 +44,7 @@ export const PUT: RequestHandler = async ({ request, params }) => {
};
export const DELETE: RequestHandler = async ({ request, params }) => {
if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
const { id } = params;
const body = await request.json().catch(() => ({}));
@@ -96,11 +88,10 @@ export const DELETE: RequestHandler = async ({ request, params }) => {
unit.group = targetGroupId;
}
}
} else if (action === 'orphan') {
} else {
// orphan
for (const unit of data.units) {
if (unit.group === id) {
unit.group = null;
}
if (unit.group === id) unit.group = null;
}
}

14
src/routes/admin/api/units/+server.ts
View File

@@ -1,23 +1,17 @@
import { json } from '@sveltejs/kit';
import { loadData, saveData, loadConfig } from '$lib/server/data';
import { requireAuth } from '$lib/server/auth';
import { loadData, saveData } from '$lib/server/data';
import { authRequest, KEBAB_RE } from '$lib/server/auth';
import type { RequestHandler } from './$types';
import type { Unit } from '$lib/types';
function auth(request: Request) {
return requireAuth(request, loadConfig());
}
const KEBAB_RE = /^[a-z][a-z0-9-]*$/;
export const GET: RequestHandler = ({ request }) => {
if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
const data = loadData();
return json(data.units);
};
export const POST: RequestHandler = async ({ request }) => {
if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
const body = await request.json().catch(() => null);
if (!body) return json({ error: 'Invalid JSON' }, { status: 400 });

14
src/routes/admin/api/units/[id]/+server.ts
View File

@@ -1,17 +1,11 @@
import { json } from '@sveltejs/kit';
import { loadData, saveData, loadConfig } from '$lib/server/data';
import { requireAuth } from '$lib/server/auth';
import { loadData, saveData } from '$lib/server/data';
import { authRequest, KEBAB_RE } from '$lib/server/auth';
import type { RequestHandler } from './$types';
import type { Unit } from '$lib/types';
function auth(request: Request) {
return requireAuth(request, loadConfig());
}
const KEBAB_RE = /^[a-z][a-z0-9-]*$/;
export const PUT: RequestHandler = async ({ request, params }) => {
if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
const { id } = params;
const body = await request.json().catch(() => null);
@@ -47,7 +41,7 @@ export const PUT: RequestHandler = async ({ request, params }) => {
};
export const DELETE: RequestHandler = ({ request, params }) => {
if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
const { id } = params;
const data = loadData();