f3367e09de
Three independent code reviews + a security audit produced ~200 findings.
This commit lands the high-impact subset. Tests pass (53), typecheck
clean, eslint clean (3 minor exhaustive-deps warnings left).
REPO HYGIENE
- Add .editorconfig, .prettierrc.json, .prettierignore.
- Add ESLint flat config (.eslintrc.cjs) — correctness-focused, no style
rules (Prettier owns formatting).
- Add `format` / `format:check` / `lint` npm scripts.
- Add CHANGELOG.md (Keep a Changelog format, back-filled to 0.1.x).
- Reformat all source via Prettier so future diffs stay small.
DATA SAFETY (src/main/store.ts)
- Atomic write (tmp + rename) with retry on transient EBUSY/EPERM —
was non-atomic writeFileSync, vulnerable to truncation on power loss.
- On corrupt JSON, rename to `app-state.json.corrupt-<ts>` instead of
silently overwriting the user's exercises/history with defaults.
- Validate parsed shape before merging — reject arrays/scalars where
objects expected; per-field array checks.
- Strip `id` from incoming patches in updateExercise/updateChallenge —
a runtime caller (IPC) could otherwise smuggle id changes through.
- clearHistory now refuses an unbounded wipe (no beforeTs => no-op);
callers must pass an explicit boundary.
- unref() the debounce timer so it doesn't keep the event loop alive.
SECURITY (src/main/*)
- gsi-server: hard 256 KB body cap (was unbounded — local OOM vector),
reject any Origin/Sec-Fetch-Site header (blocks browser CSRF from
visited pages), require application/json Content-Type, generic 400
on parse error (no error string echo to client), closeAllConnections
+ async close on stop.
- dota2: validate auth.token from payload with timingSafeEqual against
the per-install token — was unauthenticated, any local process could
forge match-end events. Narrow object shape before spread-merge to
avoid throws on hostile payloads like {player:"x"}. Reset latest /
prevState after match_end so the next match starts clean.
- ipc: gate `dev:simulateMatchEnd` registration behind `!app.isPackaged`
so it does not exist in shipped builds.
- preload: gate the matching `simulateMatchEnd` export behind
`import.meta.env.MODE !== 'production'` so the bundler dead-code-
eliminates it from the production preload bundle.
- windows: shell.openExternal allowlist (http/https/mailto only) — was
forwarding any URL, including file:/javascript:/custom URI handlers
(some Windows handlers have been RCE vectors). will-navigate blocks
navigation to anywhere except file:// or the dev URL.
CORRECTNESS (src/main/* + src/shared/*)
- shared/types.ts isQuietAt: fix wrap-around + day-of-week filter.
With from=22:00 to=07:00 days=[Mon..Fri], the window started THE
PREVIOUS DAY when we're in the AM half — old code checked today's
day-of-week and got the wrong answer Sat 02:00 and Mon 01:00. Now
the filter is evaluated against the window's START day. Also reject
malformed HH:MM strings instead of producing NaN.
- scheduler: call broadcastState() after firing exercises so the
renderer's Dashboard/Exercises pages don't show stale nextFireAt
until the next state-changing IPC. Guard powerMonitor listeners
against double-registration on dev hot-reload.
- dota2: fix `launchOptionStatus = steamRunning ? 'queued' : 'queued'`
tautology — both branches now correctly read 'queued'.
- steam-launch-options: replace `require('node:fs')` inside atomicWrite
with the top-level import; retry on transient EBUSY/EPERM.
CORRECTNESS (src/renderer/*)
- lib/history.ts: replace `today.getTime() - i * MS_DAY` arithmetic
with `setDate(date - i)` calendar arithmetic in dailyRepsRange and
currentStreak — DST transitions shift epoch math by ±1h and cause
dayKey() to emit duplicate or missing days at the boundary.
- lib/icon.tsx: restrict name lookup to ICON_CHOICES set — an arbitrary
string from a corrupted state file could otherwise resolve to
unrelated Lucide exports and crash the renderer.
- lib/format.ts: guard formatCountdown against NaN/Infinity.
- i18n/index.ts: replace regex-based interpolation with split/join so
variable values containing regex metacharacters interpolate
literally; warn in dev on missing keys; clamp pluralRu(-N) via abs.
- ReminderApp: keyboard shortcuts moved INTO ExerciseReminder so Enter
respects the stepper's `adjusted` flag (was always passing planned
reps). Stepper capped at 5× planned. Don't hijack Space when a
button is focused. `key={exercise.id+nextFireAt}` forces a fresh
component for back-to-back reminders so stepper state resets. Match
summary view gets Esc-to-close. Functional setMode in onMarkDone
avoids races against stale `mode.done`.
- UpdaterCard: guard against NaN/Infinity in download-progress events
(electron-updater fires early events with undefined fields).
- Games: gate DevPanel behind `import.meta.env.DEV` in addition to the
main-side IPC gate, and narrow the `simulateMatchEnd` access.
- Add aria-labels for the +/- stepper buttons (i18n keys added).
TESTS
- +2 quiet-hours tests covering wrap-around + day-filter combo and
malformed HH:MM fallback. Total 53 passing.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
104 lines
3.4 KiB
TypeScript
104 lines
3.4 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { isQuietAt, type QuietHours } from './types'
|
|
|
|
function at(iso: string): Date {
|
|
return new Date(iso)
|
|
}
|
|
|
|
const ALL_DAYS = [0, 1, 2, 3, 4, 5, 6]
|
|
|
|
describe('isQuietAt', () => {
|
|
it('returns false when disabled', () => {
|
|
const qh: QuietHours = {
|
|
enabled: false,
|
|
from: '00:00',
|
|
to: '23:59',
|
|
days: ALL_DAYS
|
|
}
|
|
expect(isQuietAt(qh, at('2026-05-17T12:00:00'))).toBe(false)
|
|
})
|
|
|
|
it('same-day window: inside is quiet, outside is not', () => {
|
|
const qh: QuietHours = {
|
|
enabled: true,
|
|
from: '13:00',
|
|
to: '14:00',
|
|
days: ALL_DAYS
|
|
}
|
|
expect(isQuietAt(qh, at('2026-05-17T13:30:00'))).toBe(true)
|
|
expect(isQuietAt(qh, at('2026-05-17T12:59:00'))).toBe(false)
|
|
expect(isQuietAt(qh, at('2026-05-17T14:00:00'))).toBe(false) // exclusive end
|
|
})
|
|
|
|
it('wrap-around window 22:00 → 08:00', () => {
|
|
const qh: QuietHours = {
|
|
enabled: true,
|
|
from: '22:00',
|
|
to: '08:00',
|
|
days: ALL_DAYS
|
|
}
|
|
expect(isQuietAt(qh, at('2026-05-17T23:00:00'))).toBe(true)
|
|
expect(isQuietAt(qh, at('2026-05-17T02:00:00'))).toBe(true)
|
|
expect(isQuietAt(qh, at('2026-05-17T07:59:00'))).toBe(true)
|
|
expect(isQuietAt(qh, at('2026-05-17T08:00:00'))).toBe(false)
|
|
expect(isQuietAt(qh, at('2026-05-17T15:00:00'))).toBe(false)
|
|
expect(isQuietAt(qh, at('2026-05-17T21:59:00'))).toBe(false)
|
|
})
|
|
|
|
it('day filtering: window inactive on excluded days', () => {
|
|
const qh: QuietHours = {
|
|
enabled: true,
|
|
from: '13:00',
|
|
to: '14:00',
|
|
days: [1, 2, 3, 4, 5] // weekdays only
|
|
}
|
|
// 2026-05-17 is Sunday (day 0)
|
|
expect(isQuietAt(qh, at('2026-05-17T13:30:00'))).toBe(false)
|
|
// 2026-05-18 is Monday (day 1)
|
|
expect(isQuietAt(qh, at('2026-05-18T13:30:00'))).toBe(true)
|
|
})
|
|
|
|
it('wrap-around + day filter: window day matters, not current day', () => {
|
|
// from=22:00, to=07:00, days=[Mon..Fri].
|
|
const qh: QuietHours = {
|
|
enabled: true,
|
|
from: '22:00',
|
|
to: '07:00',
|
|
days: [1, 2, 3, 4, 5]
|
|
}
|
|
// Friday 23:00 -> window starts today, Friday in filter -> quiet
|
|
expect(isQuietAt(qh, at('2026-05-15T23:00:00'))).toBe(true)
|
|
// Saturday 02:00 -> window started Friday 22:00, Friday in filter -> quiet
|
|
expect(isQuietAt(qh, at('2026-05-16T02:00:00'))).toBe(true)
|
|
// Saturday 23:00 -> would start today, Saturday not in filter -> noisy
|
|
expect(isQuietAt(qh, at('2026-05-16T23:00:00'))).toBe(false)
|
|
// Sunday 02:00 -> started Saturday, Saturday not in filter -> noisy
|
|
expect(isQuietAt(qh, at('2026-05-17T02:00:00'))).toBe(false)
|
|
// Monday 01:00 -> would have started Sunday, Sunday not in filter -> noisy
|
|
expect(isQuietAt(qh, at('2026-05-18T01:00:00'))).toBe(false)
|
|
// Monday 23:00 -> starts today, Monday in filter -> quiet
|
|
expect(isQuietAt(qh, at('2026-05-18T23:00:00'))).toBe(true)
|
|
})
|
|
|
|
it('malformed from/to falls back to non-quiet', () => {
|
|
const qh: QuietHours = {
|
|
enabled: true,
|
|
from: 'bogus',
|
|
to: '08:00',
|
|
days: ALL_DAYS
|
|
}
|
|
expect(isQuietAt(qh, at('2026-05-17T05:00:00'))).toBe(false)
|
|
})
|
|
|
|
it('zero-length window (from === to) is never quiet', () => {
|
|
const qh: QuietHours = {
|
|
enabled: true,
|
|
from: '12:00',
|
|
to: '12:00',
|
|
days: ALL_DAYS
|
|
}
|
|
expect(isQuietAt(qh, at('2026-05-17T12:00:00'))).toBe(false)
|
|
expect(isQuietAt(qh, at('2026-05-17T12:00:01'))).toBe(false)
|
|
})
|
|
})
|