Repository navigation
Fix: refuse a settings save before it writes anything - #39
Merged
Merged
Conversation
saveServer sent the config first and checked the password rules after, so a refused save had already stored the title, description, host IP, Docker settings, log level and language while reporting only the password problem. The Password Protection switch was left showing a state the server had rejected, with nothing to tell the two apart. Move both rules ahead of the first request as settingsSaveBlocker, so a refusal leaves the server exactly as it was, and name the confirm rule as clearsStoredPassword. The strength result is passed in rather than imported: admin-logic.js is imported by tests that do not map the served /js/ paths, and one import there breaks all of them. Read the security rows back from the server through syncAuthFromServer after a save, after a failure part way through the three writes, and after declining the password-clearing confirm, instead of inferring them from what was sent.
SandObserver
force-pushed
the
fix/atomic-settings-save
branch
from
August 12, 2026 02:09
37995ac to
37f4f0e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
settingsSaveBlockerandclearsStoredPasswordtoadmin-logic.js, with aBLOCKcode pair so the catalog keys stay literal at the call site.saveServer, so a refused save leaves the server untouched instead of storing the title, description, host IP, Docker settings, log level and language first.pwStrengthresult as an argument rather than importing it intoadmin-logic.js, which is imported by tests that do not register the/js/resolve hook./api/auth/checkhandling inloadSettingsintosyncAuthFromServer, and call it after a successful save, after a failure part way through the three writes, and after declining the password-clearing confirm._passwordSet, stored-password row and session-row updates from the save path, which now follow from the read-back.Testing
All green. Added 10 tests for the blocker's rule order and the confirm rule.
Checklist