feat(frontend): add schedule workflows - #131
Conversation
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
There was a problem hiding this comment.
I found four issues that should be addressed before this workflow is usable:
frontend/App.tsxstill renders onlyHomeScreen; the newSessionProvider,OverlayProvider,ScheduleProvider, andScheduleScreenare never composed, so the schedule workflow is not reachable from the shipped app.- The inline findings below cover native session initialization, location-only schedule visibility, and unsafe HTML construction for the native map.
Validation note: static review completed; the repository checkout does not contain installed frontend dependencies, so lint/typecheck/tests could not be run.
| // Expo Go and a custom Expo runtime expose the legacy module under this | ||
| // name. The lookup is static and Metro-visible; there is no hidden import | ||
| // or optional JS package that can silently disappear from a release bundle. | ||
| return requireOptionalNativeModule<ExpoFileSystemLike>('ExponentFileSystem'); |
There was a problem hiding this comment.
[P1] Add the native storage dependency or a concrete injected implementation. On native builds this calls requireOptionalNativeModule('ExponentFileSystem'), but frontend/package.json does not declare expo-file-system. createDeviceIdStore() will therefore throw, leaving SessionProvider without a device ID and preventing every native session/WebSocket connection from starting.
| timeSchedules.push(item); | ||
| } | ||
|
|
||
| const date = scheduleDate(item); |
There was a problem hiding this comment.
[P1] Preserve location-only schedules in a rendered collection. These schedules have start_time === null, so this continue excludes them from byDateKey; MonthView only renders schedulesOnDate(...), and locationSchedules is not consumed anywhere else. A valid location reminder will consequently disappear from the schedule UI and cannot be opened or edited.
There was a problem hiding this comment.
Fixed in 6afc271. MonthView now renders undated location reminders in a dedicated 地点提醒 section, with open and toggle actions, without assigning them a fake calendar date. Added a regression test. All 156 tests pass.
| <script> | ||
| (function () { | ||
| var bridge = window.ReactNativeWebView; | ||
| var center = ${centerJson}; |
There was a problem hiding this comment.
[P1] Escape serialized data before embedding it in the generated <script>. center can contain user-controlled address/name text, and JSON.stringify does not escape the < in a </script> sequence. A crafted saved location can terminate this script and execute arbitrary JavaScript inside the WebView; serialize with HTML-safe escaping (at least </>/&) before interpolation.
There was a problem hiding this comment.
Fixed in 6afc271. Initial location and center data now use HTML-safe inline-script serialization for <, >, &, U+2028, and U+2029. Added a malicious closing-script regression test. All 156 tests pass.
1 participant
Summary
Why
Schedule behavior now lives behind feature-owned application and data boundaries instead of being embedded in the legacy home screen. The UI can create, update, complete, delete, and resync schedules through the WebSocket transport.
Dependency
Validation
npm run check(32 suites, 154 tests)npx expo export --platform android --output-dir ../export-schedule