- Ya
- 28 Agosti 2026, 05:57 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 48650e2
Four findings from spec/code review, addressed: 1. CRITICAL - nothing gated the shell's Save button on step validity, so a member could blank the organization's name (or enter a partial hex on Colors) and have it written with no server-side guard either. Added STEP_VALIDATORS/isStepValid in orgSettingsSave.ts (same generic-dispatch pattern as STEP_SAVERS, reusing **************** rather than new rules) and wired page.tsx's Save button to it. Extracted validateName out of validateBasics in validation.ts so Identity enforces the exact same rule the create wizard did, not a duplicate. Skip remains unconditionally available. Fixed ColorsStep's stale comment that still claimed a validation gate existed. 2. IMPORTANT - the compliance saver sent isAlcohol/isTobacco/isFirearms (and ageReqTypeMember/TeamMember) unconditionally, which 403s an organization whose stored values have already drifted from its applied model, even on fields the member never saw a control for (this is a documented production incident per OrganizationController.java's own comment). ComplianceStep now carries getComplianceStepUi's show*/memberPick/teamPick verdict alongside its values; the saver sends each field only when its own control was actually shown, matching LabelManager.tsx's existing compliance save precedent exactly. 3. IMPORTANT - the colors saver sent only the base hex, leaving colorLight/Lighter/Dark/Darker stale against the new base (and dropping colorDark/colorDarker from the generated CSS entirely, since **************** omits them when either is blank). PATCH .../colors has no server-side derivation fallback - that only exists on create (fillDerivedColorVariants). Added a client-side mirror of ColorVariants.java's lighten/darken math so every save sends an internally consistent five-value palette. 4. Minor - StepRail.tsx had MUI sx and Tailwind className on the same elements; moved both to className.