Change evidence report
PR 1900 keeps CRM numeric controls as editable strings until their form boundary, so deletion no longer paints zero back into the field. Required, optional, integer, decimal, minimum and maximum contracts remain field-specific. The final candidate also rejects a blank visit-pack credit count, fractional guest passes, fractional stock, blank required sort values and newly entered non-HTTP(S) product image URLs while preserving unchanged legacy image values.
9d8fdc955b1bf705f129ec5ac981fca02f88d911…956789388190002261d0bdb40c90f03fd85e65d6Reviewer brief
The original browser captures reproduce the duration snapback and candidate blank/error states. The rebased candidate preserves those fixes and adds submit-time validation for visit-pack credits, guest passes, product stock, required sort order and product image URLs. Focused component suites total 38 passing tests and CRM typecheck passes.
The duration and stock screenshots were captured from exact pre-rebase revisions 6049e37fc and 707767a4f. The final rebase did not change those pictured controls, but the final validation corrections were added afterward and are evidenced by current-head component tests and source excerpts rather than recaptured screenshots. No production data was used.
Claim map
Each material changed behavior or state maps to direct evidence or an explicit gap.
| Behavior or claim | Evidence | Status |
|---|---|---|
| Clearing a required numeric field preserves an empty editing value | Current-head ClassFormDialog interaction test asserts input.value is empty; matched screenshots show the old zero value versus candidate validation, whose visible 60 is placeholder text | Covered |
| Required blanks and invalid optional values use field-specific React validation | Duration and stock captures plus current-head requestSubmit tests | Covered |
| Visit-pack credits remain positive decimals and guest passes remain whole numbers from 0 through 100 | MembershipPlanFormDialog current-head tests cover blank credits and fractional guest passes; source excerpt shows submit guards | Covered |
| Product stock and sort order reject fractional or blank input without coercion | ProductFormDialog current-head interaction tests distinguish blank, zero, fraction and required blank | Covered |
| New product image URLs accept only HTTP(S), while unchanged legacy values remain editable | ProductFormDialog current-head tests cover a malformed value, javascript: and an unchanged legacy path; the shared isHttpUrl guard rejects other non-HTTP(S) schemes; issue #1915 tracks server-side enforcement | Covered |
| Class, hook and membership numeric boundaries preserve typed editing until submit | Current-head Class 11, Membership 14, Product 6 and Hook 7 test suites | Covered |
Observed change
Evidence is grouped by the reviewer question each item addresses.
Sessions, booking fields
ScreenshotThe same local Serenity session form at 1280 by 900 CSS pixels. The merge-base eagerly coerces the cleared string to zero. In the candidate the DOM value remains empty, the browser displays the field placeholder 60, and submit renders the form-owned required error.
Products
ScreenshotThe Product form carries noValidate, so submitting negative stock reaches React validation and keeps the dialog open.
Validation contract
TableEach value class is retained as editable text, then validated and converted once at submit.
| Case | Expected contract | Evidence |
|---|---|---|
| Required blank numeric | Keep blank and refuse submit with a field message | Duration capture; Class, Membership and Product tests |
| Optional blank numeric | Submit null rather than zero | Product interaction test |
| Explicit zero | Remain legitimate where the field allows zero | Stock capture and Product tests |
| Positive decimal credits | Preserve up to two decimals and reject blank or non-positive | Membership tests and source guard |
| Whole-number fields | Reject fractions instead of truncating | Class, Membership and Product tests |
| Guest passes | Accept only whole numbers from 0 through 100 | Membership tests and source guard |
| Product image URL | Accept HTTP(S), refuse unsafe new schemes, preserve an unchanged legacy value | Product URL validation tests |
Membership plan validation
CodeVisit packs require a positive decimal credit count with at most two decimal places. Recurring-plan guest passes remain optional but must be a whole number from 0 through 100.
const visitCountValue = visitCount.trim();
const visitCountError = !isCreditPack
? null
: visitCountValue === ""
? "Enter a credit count."
: !CREDIT_COUNT_PATTERN.test(visitCountValue) ||
Number(visitCountValue) <= 0
? "Credit count must be a positive number with up to two decimal places."
: null;
const guestPassesValue = guestPassesPerMonth.trim();
const parsedGuestPasses =
guestPassesValue === "" ? null : Number(guestPassesValue);
const guestPassesError =
!isCreditPack &&
parsedGuestPasses !== null &&
(!Number.isInteger(parsedGuestPasses) ||
parsedGuestPasses < 0 ||
parsedGuestPasses > 100)
? "Guest passes must be a whole number between 0 and 100."
: null;Product validation
CodeNew image values require HTTP(S). Numeric stock and sort values remain text until the form validates whole-number and blank constraints.
const nameError = name.trim() ? null : "Enter a product name.";
const priceError = validatePriceInput(price);
const categoryError = categoryId ? null : "Select a category.";
const trimmedImageUrl = imageUrl.trim();
const keepsLegacyImageUrl = !!product && trimmedImageUrl === product.imageUrl;
const imageUrlError =
trimmedImageUrl === "" || keepsLegacyImageUrl || isHttpUrl(trimmedImageUrl)
? null
: "Enter a valid http(s) URL.";
const parsedStockQuantity =
stockQuantity.trim() === "" ? null : Number(stockQuantity.trim());
const stockQuantityError =
parsedStockQuantity === null
? null
: !Number.isFinite(parsedStockQuantity) ||
!Number.isInteger(parsedStockQuantity)
? "Stock must be a whole number."
: parsedStockQuantity < 0
? "Stock cannot be negative."
: null;
const parsedSortOrder = Number(sortOrder.trim());
const sortOrderError =
sortOrder.trim() === ""
? "Enter a sort order."
: !Number.isFinite(parsedSortOrder) || !Number.isInteger(parsedSortOrder)
? "Sort order must be a whole number."
: null;Confidence
11 passed, 0 failed, 64 assertions
14 passed, 0 failed, 51 assertions, including blank credit count and fractional guest passes
6 passed, 0 failed, 29 assertions, including stock/sort coercion and image URL safety
7 passed, 0 failed, 26 assertions
bun run --filter @sauna-crm/crm typecheck exited successfully on the rebased candidate
Existing captures cover unchanged duration and stock states at the cited pre-rebase revisions; final validation additions are covered by current DOM interaction tests, not new screenshots
Limits
Product image URL enforcement is not yet an API invariant The CRM refuses unsafe new values and rendering uses the shared safe-URL helper, but another client can still submit one. Issue #1915 tracks server-side enforcement.
Some visual evidence predates the final rebase The pictured duration and stock behavior is unchanged, and current-head interaction tests defend the final DOM contract. No screenshot is presented as proof of the later image URL, credit-count or guest-pass corrections.