[m-murphy]

Follow-up to #87: the medium and low findings from the code audit, plus a schema bug found while adding tests. One commit per fix; each fix has a regression test that fails without it (the activity refactor's test pins unchanged output instead). The last 10 commits address a review of this PR; see Review follow-ups.

API

• Errors: UNIQUE and FOREIGN KEY violations return 409 with a readable message instead of a 500 with raw SQLite text.
• Auth:
  • Login matches email before username, and usernames can't contain @.
  • Login and /auth/switch take as long to reject a missing account as a wrong password.
• CSV export:
  • Cells containing the chosen delimiter (;, tab) are quoted.
  • Data exports neutralize formula-like text cells (=, +, @, and - unless the whole cell is a number, so -131 is unchanged but -2 in SubjID gets a '). Import templates are unaffected.
• Derivation CSV:
  • Positions are normalized, and static wells checked, during validation.
  • A blank reduce_parent_quantity no longer overrides the shared setting.
  • Numbers that don't parse are row errors.
  • Paper rows check that the box or bag exists.
  • Headers are case-insensitive, and rows of only commas are skipped.
• Plate scanner CSV: quoted fields are parsed.
• Stats:
  • An unknown study returns empty stats, not whole-database totals.
  • The location filter includes static wells and papers.
  • No huge IN lists: a large location dropped from ~60 s to under 1 s on the production copy.
  • created_to includes the whole day (also in exports and the specimen list).
• Export:
  • A subject listed for several visits keeps every date, and subjects listed without a date are included.
  • Specimen IDs are chunked.
• Studies: summary and delete use subqueries, so studies past SQLite's ~65k parameter limit work.
• Search: % and _ in search text match literally.
• qPCR: target replacement is atomic and rejects duplicate names.
• Control definitions: PATCH can't change controlType, and checks name and composition uniqueness.
• Activity: /activity/recent is capped at 50 rows and built with three joined queries instead of up to seven per row.
• Sheets:
  • Paper moves resolve sheets by name plus an optional fromParentName / toParentName; an ambiguous target is reported.
  • Nothing resolves a sheet by name alone any more: /collections/check no longer accepts type sheet (no client sent it).
  • Migration 006: sheet names are unique per box (bags are exempt for legacy DBS data).
  • Moving a sheet into a box that already has one with that name returns 409.
• Locations: creating a root without parentId, or moving a root under a parent, no longer trips the storage-type CHECK. Moving a location to the root without a storage type is now a 400.
• Control batches: new POST /blood-controls/batches/create-many-with-specimens creates all of the wizard's densities in one transaction. A conflict returns 409, other failures 400.
• qPCR results tables (migration 007): qpcr_run, qpcr_well_result and qpcr_amplification_data were never created by initial_schema.sql, so results upload failed on fresh installs. They're created IF NOT EXISTS; existing databases are unchanged.
• Integrity script:
  • Opens the database read-only, so it no longer migrates backups; accepts --db=<path>.
  • Checks tag links (uses rowid) and qPCR wells.

Web

• Sessions:
  • A 401 from a data request signs the user out and redirects to login.
  • The query cache is cleared when the user changes.
• Cache refresh: saving settings refreshes every query, and qPCR well edits refresh the cached experiment.
• Stale responses: fixed races in qPCR well details and the Locations collection search.
• CSV parsing: bulk import, the import preview, and scanner CSVs use the contract's quote-aware parser.
• Dates: date-only values (collection, derivation, production dates) display on their own day in every time zone, and "today" defaults use the local date. Web tests run in America/Los_Angeles so this stays caught.
• Container edit: clearing a comment is saved.
• Add Specimens to Collection:
  • A scanner's Enter no longer submits.
  • Partly filled rows are reported.
  • Per-row server errors are shown.
• Control batch wizard: uses the atomic multi-batch endpoint and shows the server's error.
• URL filters: /specimens and /studies keep search and filters in the URL, so Clear Filters works and Back undoes a sort or filter change (search typing replaces the entry).
• Other:
  • Backspace no longer navigates away while the Add Container modal is open.
  • Large qPCR result uploads are base64-encoded in chunks.

Review follow-ups

• CSV formula neutralization spares only whole numbers; -1+cmd|'/C calc'!A0 was exported unescaped.
• Sheets can't be resolved by name alone (see Sheets).
• The remaining date-only displays use local calendar dates.
• Back undoes /studies sort and filter changes.
• The batch wizard keeps conflicts as 409, and its messages say "control batch" (CONTEXT.md).
• Regression tests for the qPCR well and Locations search races, the integrity script's tag/qPCR checks, and settings userId validation.
• CollectionSpecimenEntry.test.tsx follows the web test README.
• Shared helpers replace duplicated code: parseCsv(..., { skipBlankRows }), shiftCalendarDate, the composition finder's excludeId, and a named study specimen subquery.
• .gitignore no longer hides new files in packages/api/src/scripts.

Deploy notes

• Migrations 006 and 007 run at startup; both applied cleanly to a copy of the production database.
• Migration 006 aborts startup if any box holds two sheets with the same name (the app then won't start until the duplicates are renamed or the backup is restored). The production copy has none. To check a database before deploying:

  SELECT box_id, name, COUNT(*) FROM sheet WHERE box_id IS NOT NULL GROUP BY box_id, name HAVING COUNT(*) > 1;

  Take a backup first either way.
• API behaviour changes:
  • 409 instead of 500 for constraint conflicts.
  • Usernames with @ are rejected (none exist today).
  • created_to is inclusive of the whole day.
  • Activity limit is capped at 50.
  • Sheet mappings accept fromParentName / toParentName.
  • New 400s: moving a location to the root without a storage type; PUT /settings/:key with a userId that isn't a positive integer or null; /collections/check with type sheet.
  • Saving settings marks every cached query stale (settings feed many unrelated queries).

Test plan

• bun run ci:verify
• Web: 909/909
• Contract: 84/84
• API: 1043/1043
• Migrations 006 and 007 on a copy of the production database
• No lint errors on changed lines

🤖 Generated with Claude Code