feat(commitments): multi-instalment stepper + edit form#240
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Sorry @thierryvm, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
github-actions
Bot
added
status:review-needed
thierryvm
added a commit
that referenced
this pull request
Jul 24, 2026
…ypass, SSRF, DoS) (#241) ## Motivation Le check CI `Security audit` (`npm audit --audit-level=high`) est passé rouge sur toutes les PR — **9 advisories HIGH Next.js** publiées, affectant la plage `16.0.0 – 16.2.10` (on est en 16.2.6) : - **GHSA-6gpp-xcg3-4w24** — contournement middleware/proxy (App Router + Turbopack) → **touche directement notre auth `proxy.ts`** - SSRF dans les Server Actions (custom servers + rewrites) - DoS Server Actions + DoS Image Optimization via SVG - Cache confusion (bodies de requête) - Divulgation non authentifiée d'endpoints Server Function **Dérive environnementale** — aucun changement de code de notre côté ; `main` est également affecté. ## Fix Bump **next 16.2.6 → 16.2.11** (patch — 16.2.11 est hors plage vulnérable). Aucun changement de code applicatif. ## Evidence - `npm audit --audit-level=high` → **0 high** (reste 1 low esbuild, sous le seuil) - `npm run typecheck` ✅ · `npm run build` ✅ (next 16.2.11 compile) · **1606 tests** verts - Patch de version dans le même minor (16.2.x) → risque de régression minimal, vérifié empiriquement ## Débloque Merge en amont → #240 (stepper engagements) et toutes les futures PR retrouvent un `Security audit` vert. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by Sourcery Build: - Mettre à jour la dépendance Next de la version 16.2.6 à 16.2.11 afin d’intégrer les correctifs de sécurité en amont sans modifier le code de l’application. <details> <summary>Original summary in English</summary> ## Summary by Sourcery Build: - Bump next dependency from 16.2.6 to 16.2.11 to incorporate upstream security fixes without changing application code. </details>
@Thierry: an échéancier (e.g. 11 × 220 €) could only tick the CURRENT month and had no way to edit. Now: - InstallmentStepper « X / N payées » with − / + : + marks the earliest unpaid scheduled instalment, − un-marks the latest paid one, reusing the existing single-period toggle action. Buttons disabled at bounds + while pending, so a double-click can't cancel a payment. useOptimistic reducer switched to explicit {key, paid} intent (idempotent under stale reads) — keeps the #234 rollback. - Edit via the pencil: reuses the form (single formMode source + resetForm), wired to the existing updateCommitmentAction. Guard blocks reducing installmentsTotal below what's already ticked (no silent ledger orphaning). - Row controls moved from cramped absolute corners into a flow flex row. - i18n: +10 keys × 5 locales, −2 dead. plan-reviewer APPROVED. 1616 tests.
thierryvm
force-pushed
the
feat/commitments-edit-stepper
branch
from
July 24, 2026 14:14
a19624b to
5d2b851
Compare
thierryvm
added a commit
that referenced
this pull request
Jul 24, 2026
## Motivation Follow-up du `dashboard-ux-auditor` sur #240 (**P1**). Cliquer le crayon d'un engagement en bas d'une longue liste ouvrait le formulaire d'édition **tout en haut de la page** — hors écran, sans aucun changement visible pour un utilisateur sighted, et sans repère pour clavier/lecteur d'écran (pattern ARIA APG Disclosure : déplacer le focus vers le contenu révélé). ## Fix `useEffect` sur `formMode`/`editingId` : focus du champ libellé (`preventScroll`) + `scrollIntoView` smooth du formulaire. Bonus P3 : opacity disabled du stepper 40 → 50 (cohérence token). ## Evidence - `typecheck` ✅ · 27 tests commitments (dont un nouveau : le crayon déplace le focus dans le form) - `scrollIntoView` gardé (`?.`) pour jsdom. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation (@Thierry)
Sur
/app/commitments, un échéancier (ex. 11 × 220 €) ne pouvait valider que le mois courant (bouton ✓ gateddueThisPeriod) et aucune édition n'était possible. On doit pouvoir valider les 11 versements + corriger un engagement.Ce que fait la PR
InstallmentStepper, extrait) :+coche la plus ancienne échéance non payée,−décoche la plus récente payée — réutilise l'action toggle mono-période existante. Boutons désactivés aux bornes et pendant une mutation → un double-clic ne peut pas annuler un paiement (reduceruseOptimisticpassé en intent explicite{key, paid}, idempotent sur lecture périmée ; contrat rollback feat(commitments): Engagements page — CRUD, remaining balance, progress, ticks (épic PR-2) #234 préservé).formMode+resetForm), branché sur l'updateCommitmentActiondéjà existant. Garde : impossible de réduireinstallmentsTotalsous le nombre déjà coché (pas d'orphelin ledger silencieux).absolutecramés vers une rangéeflexen flux, mobile-first, cibles 44px (size-11 md:size-9).Process
plan-reviewer: ✅ APPROVED (6 renforcements intégrés : race double-clic, garde reduction, migration des 6 tests toggle, discipline reset form bi-mode, DoD, hygiène branche). Backend (update/toggle actions) non modifié — réutilisé.Evidence
typecheck✅ ·lint0 erreur · 1616 tests (+6 stepper, +4 net commitments, 6 tests toggle réécrits sur le stepper dont le contrat rollback)dashboard-ux-auditor+i18n-auditorlancés.🤖 Generated with Claude Code