Fix medium and low-severity bugs from the code audit

.gitignore

@@ -73,6 +73,7 @@ packages/e2e/sampledb_e2e.sqlite
 scripts/
 !packages/api/scripts/
 !packages/api/scripts/seed-table-view-config.ts
+!packages/api/src/scripts/
 !packages/docs/scripts/
 
 test-csvs/

packages/api/initial_schema.sql

@@ -259,6 +259,7 @@ CREATE TABLE IF NOT EXISTS sheet (
          (box_id IS NULL AND bag_id IS NOT NULL) OR
          (box_id IS NULL AND bag_id IS NULL))
 );--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS sheet_box_name_idx ON sheet(box_id, name) WHERE box_id IS NOT NULL;--> statement-breakpoint
 CREATE TABLE IF NOT EXISTS paper (
   id INTEGER PRIMARY KEY REFERENCES storage_container(id),
   sheet_id INTEGER NOT NULL REFERENCES sheet(id),
@@ -283,7 +284,7 @@ CREATE TABLE IF NOT EXISTS storage_type (
 CREATE TABLE IF NOT EXISTS schema_version (
   version INTEGER NOT NULL
 );--> statement-breakpoint
-INSERT INTO schema_version (version) VALUES (5);--> statement-breakpoint
+INSERT INTO schema_version (version) VALUES (7);--> statement-breakpoint
 CREATE TABLE IF NOT EXISTS settings (
   key TEXT NOT NULL,
   user_id INTEGER REFERENCES users(id),
@@ -383,5 +384,42 @@ CREATE TABLE IF NOT EXISTS qpcr_experiment_well (
   UNIQUE (qpcr_experiment_id, well_position)
 );--> statement-breakpoint
 CREATE INDEX IF NOT EXISTS qpcr_experiment_well_experiment_idx ON qpcr_experiment_well(qpcr_experiment_id);--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS qpcr_run (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  qpcr_experiment_id INTEGER NOT NULL REFERENCES qpcr_experiment(id) ON DELETE CASCADE,
+  instrument_type TEXT NOT NULL,
+  run_started_at TEXT,
+  run_ended_at TEXT,
+  experiment_name TEXT,
+  file_name TEXT,
+  created TEXT NOT NULL DEFAULT current_timestamp,
+  slope REAL,
+  y_intercept REAL,
+  r_squared REAL,
+  efficiency REAL
+);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS qpcr_run_experiment_idx ON qpcr_run(qpcr_experiment_id);--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS qpcr_well_result (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  qpcr_run_id INTEGER NOT NULL REFERENCES qpcr_run(id) ON DELETE CASCADE,
+  well_position TEXT NOT NULL,
+  target_name TEXT,
+  sample_barcode TEXT,
+  task TEXT,
+  cq REAL,
+  quantity REAL,
+  standard_quantity REAL,
+  amp_status TEXT,
+  UNIQUE (qpcr_run_id, well_position, target_name)
+);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS qpcr_well_result_run_idx ON qpcr_well_result(qpcr_run_id);--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS qpcr_amplification_data (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  qpcr_well_result_id INTEGER NOT NULL REFERENCES qpcr_well_result(id) ON DELETE CASCADE,
+  cycle INTEGER NOT NULL,
+  rn REAL,
+  delta_rn REAL
+);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS qpcr_amplification_data_well_result_idx ON qpcr_amplification_data(qpcr_well_result_id);--> statement-breakpoint
 CREATE INDEX IF NOT EXISTS qpcr_experiment_well_specimen_idx ON qpcr_experiment_well(specimen_id);--> statement-breakpoint
 PRAGMA foreign_keys=ON;

packages/api/src/bun-sqlite.d.ts

@@ -1,6 +1,7 @@
 declare module 'bun:sqlite' {
   export class Database {
-    constructor(path: string | ':memory:')
+    constructor(path: string | ':memory:', options?: { readonly?: boolean; create?: boolean; readwrite?: boolean; strict?: boolean })
+    readonly filename: string
     exec(sql: string): void
     prepare(sql: string): Statement
     query(sql: string): Statement

packages/api/src/db/__tests__/client.test.ts

@@ -33,6 +33,7 @@ describe('Database Client', () => {
     db.exec(`CREATE TABLE cryovial_tube (id INTEGER PRIMARY KEY, collection_id INTEGER NOT NULL, barcode TEXT, position TEXT)`)
     db.exec(`CREATE TABLE static_well (id INTEGER PRIMARY KEY, collection_id INTEGER NOT NULL, position TEXT)`)
     db.exec(`CREATE TABLE study_subject (id INTEGER PRIMARY KEY, study_id INTEGER NOT NULL, name TEXT NOT NULL)`)
+    db.exec(`CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT NOT NULL, box_id INTEGER, bag_id INTEGER)`)
     // Intentionally omit paper — migration 003 preflight creates legacy stub
     // Intentionally do NOT create error_logs
     const before = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='error_logs'").get()

packages/api/src/db/__tests__/schema-evolution.test.ts

@@ -36,6 +36,12 @@ function createTablesForLaterMigrations(sqlite: Database): void {
     study_id INTEGER NOT NULL,
     name TEXT NOT NULL
   )`)
+  sqlite.exec(`CREATE TABLE IF NOT EXISTS sheet (
+    id INTEGER PRIMARY KEY,
+    name TEXT NOT NULL,
+    box_id INTEGER,
+    bag_id INTEGER
+  )`)
 }
 
 describe('schema evolution', () => {
@@ -98,7 +104,7 @@ describe('schema evolution', () => {
       'CREATE TABLE settings (key TEXT, user_id INTEGER, value TEXT, PRIMARY KEY (key, user_id))',
     )
     sqlite.exec('CREATE TABLE storage_container (id INTEGER PRIMARY KEY)')
-    sqlite.exec('CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT)')
+    sqlite.exec('CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT, box_id INTEGER, bag_id INTEGER)')
     sqlite.exec(`CREATE TABLE paper (
       id INTEGER PRIMARY KEY REFERENCES storage_container(id),
       sheet_id INTEGER NOT NULL REFERENCES sheet(id),
@@ -123,7 +129,7 @@ describe('schema evolution', () => {
     sqlite.exec('INSERT INTO schema_version (version) VALUES (1)')
     sqlite.exec('CREATE TABLE study (id INTEGER PRIMARY KEY)')
     sqlite.exec('CREATE TABLE storage_container (id INTEGER PRIMARY KEY)')
-    sqlite.exec('CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT)')
+    sqlite.exec('CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT, box_id INTEGER, bag_id INTEGER)')
     sqlite.exec(`CREATE TABLE paper (
       id INTEGER PRIMARY KEY REFERENCES storage_container(id),
       sheet_id INTEGER NOT NULL REFERENCES sheet(id),
@@ -141,7 +147,7 @@ describe('schema evolution', () => {
     sqlite.exec('CREATE TABLE schema_version (version INTEGER NOT NULL)')
     sqlite.exec('INSERT INTO schema_version (version) VALUES (2)')
     sqlite.exec(`CREATE TABLE storage_container (id INTEGER PRIMARY KEY)`)
-    sqlite.exec(`CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT)`)
+    sqlite.exec(`CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT, box_id INTEGER, bag_id INTEGER)`)
     sqlite.exec(`CREATE TABLE paper (
       id INTEGER PRIMARY KEY REFERENCES storage_container(id),
       sheet_id INTEGER NOT NULL REFERENCES sheet(id),
@@ -181,7 +187,7 @@ describe('schema evolution', () => {
     sqlite.exec('CREATE TABLE schema_version (version INTEGER NOT NULL)')
     sqlite.exec('INSERT INTO schema_version (version) VALUES (2)')
     sqlite.exec(`CREATE TABLE storage_container (id INTEGER PRIMARY KEY)`)
-    sqlite.exec(`CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT)`)
+    sqlite.exec(`CREATE TABLE sheet (id INTEGER PRIMARY KEY, name TEXT, box_id INTEGER, bag_id INTEGER)`)
     sqlite.exec(`CREATE TABLE paper (
       id INTEGER PRIMARY KEY REFERENCES storage_container(id),
       sheet_id INTEGER NOT NULL REFERENCES sheet(id),
@@ -260,6 +266,33 @@ describe('schema evolution', () => {
     sqlite.close()
   })
 
+  it('migration 006 makes sheet names unique per box but not per bag', () => {
+    const sqlite = new Database(testDbPath)
+    sqlite.exec('CREATE TABLE schema_version (version INTEGER NOT NULL)')
+    sqlite.exec('INSERT INTO schema_version (version) VALUES (5)')
+    createTablesForLaterMigrations(sqlite)
+    sqlite.exec(`INSERT INTO sheet (id, name, box_id, bag_id) VALUES (1, 'S1', 1, NULL), (2, 'S1', NULL, 7), (3, 'S1', NULL, 7)`)
+
+    evolveOperationalSchema(sqlite)
+
+    expect(getRecordedSchemaVersion(sqlite)).toBe(CURRENT_SCHEMA_VERSION)
+    expect(() => sqlite.exec(`INSERT INTO sheet (id, name, box_id) VALUES (4, 'S1', 1)`)).toThrow(/UNIQUE/)
+    sqlite.exec(`INSERT INTO sheet (id, name, bag_id) VALUES (5, 'S1', 7)`)
+    sqlite.close()
+  })
+
+  it('migration 006 aborts when a box has two sheets with the same name', () => {
+    const sqlite = new Database(testDbPath)
+    sqlite.exec('CREATE TABLE schema_version (version INTEGER NOT NULL)')
+    sqlite.exec('INSERT INTO schema_version (version) VALUES (5)')
+    createTablesForLaterMigrations(sqlite)
+    sqlite.exec(`INSERT INTO sheet (id, name, box_id) VALUES (1, 'S1', 1), (2, 'S1', 1)`)
+
+    expect(() => evolveOperationalSchema(sqlite)).toThrow(/Rename one of them first/)
+    expect(getRecordedSchemaVersion(sqlite)).toBe(5)
+    sqlite.close()
+  })
+
   it('fail-hard: invalid migration leaves schema_version unchanged', () => {
     const sqlite = new Database(testDbPath)
     sqlite.exec('CREATE TABLE schema_version (version INTEGER NOT NULL)')

packages/api/src/db/migrations/006_box_sheet_name_unique.sql

@@ -0,0 +1,15 @@
+-- Migration 006: sheet names are unique within a box. Bags are exempt: legacy DBS bags hold
+-- many single-paper sheets that share one name. (UNIQUE(name, box_id, bag_id) never fired
+-- because one of box_id / bag_id is always NULL.)
+CREATE TEMP TABLE IF NOT EXISTS __migration_006_guard (id INTEGER PRIMARY KEY);--> statement-breakpoint
+CREATE TRIGGER __migration_006_guard_tr BEFORE INSERT ON __migration_006_guard
+BEGIN
+  SELECT RAISE(ABORT, 'Cannot add unique sheet name index: a box has two sheets with the same name. Rename one of them first.')
+  WHERE EXISTS (
+    SELECT 1 FROM sheet WHERE box_id IS NOT NULL GROUP BY box_id, name HAVING COUNT(*) > 1
+  );
+END;--> statement-breakpoint
+INSERT INTO __migration_006_guard DEFAULT VALUES;--> statement-breakpoint
+DROP TRIGGER __migration_006_guard_tr;--> statement-breakpoint
+DROP TABLE __migration_006_guard;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS sheet_box_name_idx ON sheet(box_id, name) WHERE box_id IS NOT NULL;

packages/api/src/db/migrations/007_qpcr_result_tables.sql

@@ -0,0 +1,40 @@
+-- Migration 007: qPCR result tables. They exist in databases created before the SQL snapshot
+-- (matching definitions below) but initial_schema.sql never created them, so result uploads failed
+-- on fresh installs. IF NOT EXISTS leaves existing databases unchanged.
+CREATE TABLE IF NOT EXISTS qpcr_run (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  qpcr_experiment_id INTEGER NOT NULL REFERENCES qpcr_experiment(id) ON DELETE CASCADE,
+  instrument_type TEXT NOT NULL,
+  run_started_at TEXT,
+  run_ended_at TEXT,
+  experiment_name TEXT,
+  file_name TEXT,
+  created TEXT NOT NULL DEFAULT current_timestamp,
+  slope REAL,
+  y_intercept REAL,
+  r_squared REAL,
+  efficiency REAL
+);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS qpcr_run_experiment_idx ON qpcr_run(qpcr_experiment_id);--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS qpcr_well_result (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  qpcr_run_id INTEGER NOT NULL REFERENCES qpcr_run(id) ON DELETE CASCADE,
+  well_position TEXT NOT NULL,
+  target_name TEXT,
+  sample_barcode TEXT,
+  task TEXT,
+  cq REAL,
+  quantity REAL,
+  standard_quantity REAL,
+  amp_status TEXT,
+  UNIQUE (qpcr_run_id, well_position, target_name)
+);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS qpcr_well_result_run_idx ON qpcr_well_result(qpcr_run_id);--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS qpcr_amplification_data (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  qpcr_well_result_id INTEGER NOT NULL REFERENCES qpcr_well_result(id) ON DELETE CASCADE,
+  cycle INTEGER NOT NULL,
+  rn REAL,
+  delta_rn REAL
+);--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS qpcr_amplification_data_well_result_idx ON qpcr_amplification_data(qpcr_well_result_id);

packages/api/src/db/open.ts

@@ -80,6 +80,13 @@ function resolveDatabaseFilePath(relativeOrAbsolute: string): string {
   return isAbsolute(relativeOrAbsolute) ? relativeOrAbsolute : resolve(getMonorepoRoot(), relativeOrAbsolute)
 }
 
+/** Path openOperationalDatabase would use: explicit path, then DATABASE_PATH, then the dev default. */
+export function resolveOperationalDatabasePath(dbPath?: string): string {
+  if (dbPath) return resolveDatabaseFilePath(dbPath)
+  if (process.env.DATABASE_PATH) return resolveDatabaseFilePath(process.env.DATABASE_PATH)
+  return resolve(getMonorepoRoot(), 'sampledb_dev.sqlite')
+}
+
 export type OperationalDatabase = ReturnType<typeof drizzle<typeof schema>>
 
 /**
@@ -89,15 +96,7 @@ export function openOperationalDatabase(dbPath?: string): {
   db: OperationalDatabase
   sqlite: SQLiteDatabase
 } {
-  let resolvedPath: string
-
-  if (dbPath) {
-    resolvedPath = resolveDatabaseFilePath(dbPath)
-  } else if (process.env.DATABASE_PATH) {
-    resolvedPath = resolveDatabaseFilePath(process.env.DATABASE_PATH)
-  } else {
-    resolvedPath = resolve(getMonorepoRoot(), 'sampledb_dev.sqlite')
-  }
+  const resolvedPath = resolveOperationalDatabasePath(dbPath)
 
   if (process.env.NODE_ENV !== 'production') {
     console.log(`📁 Monorepo root: ${getMonorepoRoot()}`)

packages/api/src/db/schema-evolution.ts

@@ -7,7 +7,7 @@ import { listNumberedMigrations, runSqlMigration } from './migration-runner'
 const PAPER_SUBLABEL_MIGRATION_VERSION = 3
 
 /** Canonical schema level; bump when adding numbered deltas under migrations/. */
-export const CURRENT_SCHEMA_VERSION = 5
+export const CURRENT_SCHEMA_VERSION = 7
 
 const SCHEMA_VERSION_TABLE = 'schema_version'
 const LEGACY_BASELINE_VERSION = 1

packages/api/src/db/schema.ts

@@ -356,7 +356,8 @@ export const sheet = sqliteTable('sheet', {
     (${t.boxId} IS NULL AND ${t.bagId} IS NOT NULL) OR
     (${t.boxId} IS NULL AND ${t.bagId} IS NULL)
   `),
-  unq: unique().on(t.name, t.boxId, t.bagId)
+  unq: unique().on(t.name, t.boxId, t.bagId),
+  boxNameUniq: uniqueIndex('sheet_box_name_idx').on(t.boxId, t.name).where(sql`${t.boxId} IS NOT NULL`),
 }))
 
 export const paper = sqliteTable('paper', {

packages/api/src/lib/__tests__/container-move.test.ts

@@ -17,7 +17,7 @@ import {
   type ContainerInfo,
 } from '../container-move'
 import { storageContainer } from '../../db/schema'
-import { micronixTube, staticWell } from '../../db/schema'
+import { micronixTube, staticWell, box, sheet, paper } from '../../db/schema'
 import type { Database } from '../../db/client'
 import { utcNow } from '../datetime'
 
@@ -560,4 +560,39 @@ describe('container-move', () => {
       expect(info?.currentCollectionName).toBe(plate.name)
     })
   })
+
+  describe('paper moves between same-named sheets', () => {
+    it('moves papers from Sheet-1 of one box to Sheet-1 of another using parent names', async () => {
+      const storageType = await createTestStorageType(testDb, { name: 'Freezer' })
+      const location = await createTestLocation(testDb, { name: 'Loc', storageTypeId: String(storageType.id) })
+      const specimenType = await createTestSpecimenType(testDb, { name: 'Blood' })
+      const specimen = await createTestSpecimen(testDb, specimenType.id)
+      const unit = await createTestUnit(testDb, { symbol: 'uL', name: 'microliter', category: 'volume' })
+      const now = utcNow()
+      const [boxA] = await testDb.insert(box).values({ name: 'BA', locationId: location.id, created: now, lastUpdated: now }).returning()
+      const [boxB] = await testDb.insert(box).values({ name: 'BB', locationId: location.id, created: now, lastUpdated: now }).returning()
+      const [sheetA] = await testDb.insert(sheet).values({ name: 'Sheet-1', boxId: boxA.id }).returning()
+      const [sheetB] = await testDb.insert(sheet).values({ name: 'Sheet-1', boxId: boxB.id }).returning()
+      const [container] = await testDb
+        .insert(storageContainer)
+        .values({ specimenId: specimen.id, unitId: unit.id, totalQuantity: 1, remainingQuantity: 1, created: now, lastUpdated: now })
+        .returning()
+      await testDb.insert(paper).values({ id: container!.id, sheetId: sheetB.id })
+
+      const ambiguous = await executeMoves(testDb, {
+        mappings: [{ fromCollectionName: 'Sheet-1', toCollectionName: 'Sheet-1' }],
+        moves: [{ identifier: { type: 'container_id', containerId: container!.id }, targetPosition: '' }],
+      })
+      expect(ambiguous.success).toBe(false)
+      expect(ambiguous.errors?.[0].error).toMatch(/set toParentName/)
+
+      const result = await executeMoves(testDb, {
+        mappings: [{ fromCollectionName: 'Sheet-1', fromParentName: 'BB', toCollectionName: 'Sheet-1', toParentName: 'BA' }],
+        moves: [{ identifier: { type: 'container_id', containerId: container!.id }, targetPosition: '' }],
+      })
+      expect(result.success).toBe(true)
+      const [moved] = await testDb.select().from(paper).all()
+      expect(moved.sheetId).toBe(sheetA.id)
+    })
+  })
 })

packages/api/src/lib/__tests__/datetime.test.ts

@@ -0,0 +1,18 @@
+import { describe, it, expect } from 'vitest'
+import { shiftCalendarDate } from '../datetime'
+
+describe('shiftCalendarDate', () => {
+  it('rolls over months and years', () => {
+    expect(shiftCalendarDate('2024-01-31', 1)).toBe('2024-02-01')
+    expect(shiftCalendarDate('2024-03-01', -1)).toBe('2024-02-29')
+    expect(shiftCalendarDate('2023-12-31', 1)).toBe('2024-01-01')
+  })
+
+  it('reads the date part of a timestamp', () => {
+    expect(shiftCalendarDate('2024-05-26 22:28:26', 0)).toBe('2024-05-26')
+  })
+
+  it('returns null for text that does not start with a date', () => {
+    expect(shiftCalendarDate('1/5/2024', 1)).toBeNull()
+  })
+})