Skip to content

Re-audit fixes: installed-pack default, page chunks, query service, FormRequests, vendor-named middleware - #137

Merged
imanimanyara merged 4 commits into
mainfrom
fix/reaudit-2026-11-05
Nov 5, 2026
Merged

imanimanyara merged 4 commits into
mainfrom
fix/reaudit-2026-11-05

Conversation

@imanimanyara

Copy link
Copy Markdown
Contributor

Summary

Re-audit 2026-11-05 work, with react-icon-browser vendored at 959b07c (built from a fresh clone).

  • Q42 / F-01. browserConfig passes the Inertia page's packages (core's registered packs) as defaults.packages; the vendored library carries no pack list. Red first: appConfig.test.ts.
  • F-12. Inertia pages load lazily; chunk names carry their hash because only the entry is versioned with ?v=; npm run clean removes them. Before: one 1,497,224 B file (428,454 gzip). After: 1,411,528 B (408,868 gzip) on first load plus the visited page's own chunk.
  • F-08. One query service, PackageDetails, returns a PackageDetailsData both package-detail actions render; IconTables names core's tables once.
  • F-09. Four FormRequests with toData() DTOs replace six inline rule sets; JSON callers keep the API's validation body. CreateCollection::rules() removed (forward only).
  • F-10. Collaborators injected instead of resolved with app().
  • F-11. Middleware aliases and groups are ichava-icon-browser.*, forward only. The ichava.admin Gate ability keeps its name.
  • F-18. check:config-drift (in CI) compares the shared files with js-ui-kernel.

HttpLayerConventionsTest guards F-08 to F-11 (red first: 5 failures). Locally: 404 Pest tests, PHPStan, Pint, typecheck, ESLint, 107 Vitest tests, build:prod.

- browserConfig passes the page's packages (core's registered packs) as
  defaults.packages (Q42).
- Inertia pages load lazily, chunk names carry their hash (F-12).
- check:config-drift compares eslint.base.js and the .dev/tools scripts
  with js-ui-kernel (F-18).
…ndor-named middleware

- F-08: PackageDetails + PackageDetailsData serve both controllers;
  IconTables names core's tables once.
- F-09: four FormRequests with toData() DTOs replace six inline rule sets.
- F-10: SecurityNonce, AuditLogger, HostUser, IconSnippets and the
  Translator are injected.
- F-11: middleware aliases and groups are ichava-icon-browser.*, forward
  only.
HttpLayerConventionsTest guards all four.
The library names no pack and opens on the installed ones (Q42), loads
its on-demand layers as chunks, and links the generator's docs for the
native exports. The page bundle splits per Inertia page.
Copilot AI balanced review requested due to automatic review settings November 5, 2026 11:52

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

…switch, morph alias

- Type-hint ChecksPackUpdates and DatabaseOperations.
- Register Blade components as ichava-icon-browser::*, never under core's
  short prefix; a test boots a host with it off.
- Read core's components.test_icons; drop test_component_enabled.
- The terms hierarchy reads Icon::getMorphClass(), not 'icon'.
- Document running migrations after an update.
@imanimanyara
imanimanyara merged commit d50127a into main Nov 5, 2026
15 checks passed
@imanimanyara
imanimanyara deleted the fix/reaudit-2026-11-05 branch November 6, 2026 00:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants