LibreKAT/Ocideck

Watch

Fork 0

fix: laat de FilePicker-poort per aanroep kijken in plaats van per bestand #535

Merged

brenno merged 1 commit from fix/filepicker-per-aanroep into main

2026-07-22 11:14:53 +00:00

brenno commented

2026-07-22 11:14:51 +00:00

Owner

Summary

Corrects the gate I shipped in #527. It cleared a whole file as soon as a platform flag appeared anywhere in it, which is wrong in both directions — and both errors were sitting in the baseline I wrote.

Progress on #528; the remaining gaps are recorded against #526.

What was wrong

Too lenient. image_service.dart gates pickImageDetailed properly with kIsWeb and has pickVideo and pickAudio sitting ungated right beside it. The file mentioned the flag, so the file looked clean. Those two are real, previously unrecorded defects: on web they read a blob: URL out of .path and feed it to media validation and project import.

Too strict. file_service.dart and image_service.dart were baselined as debt while the rule did not even recognise kIsWeb — the most direct form of the gate, and the one this codebase actually uses.

And a third, found while fixing the first two: the forward window that looks for withData: true reached into the next method, so file_service.pickMarkdownFile was cleared by a withData: true eleven lines below it, in a different function.

What it does now

Per call site. The backward window stops at the previous method header; the forward window stops at the next one. kIsWeb counts as a gate.

The baseline goes 7 → 8

That is the rule getting truer, not the code getting worse. It now carries line numbers and separates two genuinely different situations:

Gated at the caller (5 files). Correct today — the button that opens the dialog sits behind the flag — but the file cannot prove it, which is exactly the fragility. settings_dialog.dart newly appears here: its two getDirectoryPath calls are gated in settings_dialog_storage.dart, while the logo picker on line 612 is gated in-method since #506.
Real open gaps (3 files, 4 call sites). pickVideo, pickAudio, pickPackageFile, and the carousel's _browse.

Verification, three directions

a method with if (kIsWeb) return null; before the call — clean;
the same method without it — fails;
a gate in the previous method — still fails. That is the whole point of the change, and it is the case the old rule got wrong.

Not fixed here, deliberately

The four open call sites need a UX decision I cannot verify without running the app: hiding the carousel on web would remove what may be the only image-insert route there, and pickImageDetailed already has a working bytes path that the carousel could use instead. Choosing between "hide it" and "make it work" is worth doing with eyes on the running app rather than from a grep. Recorded on #526.

Gates

make check, make check-secrets and make sast all green.

## Summary Corrects the gate I shipped in #527. It cleared a whole file as soon as a platform flag appeared *anywhere* in it, which is wrong in both directions — and both errors were sitting in the baseline I wrote. Progress on #528; the remaining gaps are recorded against #526. ## What was wrong **Too lenient.** `image_service.dart` gates `pickImageDetailed` properly with `kIsWeb` and has `pickVideo` and `pickAudio` sitting ungated right beside it. The file mentioned the flag, so the file looked clean. Those two are real, previously unrecorded defects: on web they read a `blob:` URL out of `.path` and feed it to media validation and project import. **Too strict.** `file_service.dart` and `image_service.dart` were baselined as debt while the rule did not even recognise `kIsWeb` — the most direct form of the gate, and the one this codebase actually uses. **And a third, found while fixing the first two:** the forward window that looks for `withData: true` reached into the *next* method, so `file_service.pickMarkdownFile` was cleared by a `withData: true` eleven lines below it, in a different function. ## What it does now Per call site. The backward window stops at the previous method header; the forward window stops at the next one. `kIsWeb` counts as a gate. ## The baseline goes 7 → 8 That is the rule getting truer, not the code getting worse. It now carries line numbers and separates two genuinely different situations: - **Gated at the caller (5 files).** Correct today — the button that opens the dialog sits behind the flag — but the file cannot prove it, which is exactly the fragility. `settings_dialog.dart` newly appears here: its two `getDirectoryPath` calls are gated in `settings_dialog_storage.dart`, while the logo picker on line 612 is gated in-method since #506. - **Real open gaps (3 files, 4 call sites).** `pickVideo`, `pickAudio`, `pickPackageFile`, and the carousel's `_browse`. ## Verification, three directions - a method with `if (kIsWeb) return null;` before the call — **clean**; - the same method without it — **fails**; - a gate in the **previous** method — **still fails**. That is the whole point of the change, and it is the case the old rule got wrong. ## Not fixed here, deliberately The four open call sites need a UX decision I cannot verify without running the app: hiding the carousel on web would remove what may be the only image-insert route there, and `pickImageDetailed` already has a working bytes path that the carousel could use instead. Choosing between "hide it" and "make it work" is worth doing with eyes on the running app rather than from a grep. Recorded on #526. ## Gates `make check`, `make check-secrets` and `make sast` all green.

brenno added 1 commit

2026-07-22 11:14:51 +00:00

fix(poort): laat de FilePicker-regel per aanroep kijken, niet per bestand

CI / Gate (Linux) · Format · Analyze · Coverage (pull_request) Has been cancelled

Details

CI / Test (macos-latest) (pull_request) Has been cancelled

Details

CI / Test (windows-latest) (pull_request) Has been cancelled

Details

CI / Web hardening (pull_request) Has been cancelled

Details

CI / Docs links (pull_request) Has been cancelled

Details

CI / Supply-chain (Trivy · advisory) (pull_request) Has been cancelled

Details

CI / Gate (Linux) · Format · Analyze · Coverage (push) Has been cancelled

Details

CI / Test (macos-latest) (push) Has been cancelled

Details

CI / Test (windows-latest) (push) Has been cancelled

Details

CI / Web hardening (push) Has been cancelled

Details

CI / Docs links (push) Has been cancelled

Details

CI / Supply-chain (Trivy · advisory) (push) Has been cancelled

Details

d7b17a7824

De regel uit #505 keurde een heel bestand goed zodra er érgens een
platformvlag in stond. Dat is te grof in twee richtingen, en beide fouten
stonden in de basislijn die ik zelf heb aangelegd.

Te mild: image_service poort pickImageDetailed keurig met kIsWeb en laat
pickVideo en pickAudio er pal naast ongepoort staan — het bestand leek
schoon. Te streng: file_service en image_service stonden in de basislijn
terwijl de regel kIsWeb niet eens herkende, de meest directe vorm van de
poort.

Nu kijkt de regel per aanroep, met een venster dat terugloopt tot de
vorige methodekop. Ook het vooruitkijkvenster knipt daar: een
withData: true uit de vólgende methode pleitte file_service.
pickMarkdownFile ten onrechte vrij.

De basislijn gaat van 7 naar 8 en dat is winst, geen verlies: hij noemt nu
regelnummers, scheidt "gepoort bij de aanroeper" van "echt gat", en de
vier openstaande gaten (pickVideo, pickAudio, pickPackageFile, de
carrousel) staan er met issue erbij.

Getoetst: een gepoorte methode is schoon; dezelfde methode zonder poort
valt; en een poort in de vórige methode telt niet mee.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

brenno merged commit e1fa93da19 into main

2026-07-22 11:14:53 +00:00

brenno referenced this pull request from a commit

2026-07-22 11:14:53 +00:00

Merge pull request 'fix: laat de FilePicker-poort per aanroep kijken in plaats van per bestand' (#535) from fix/filepicker-per-aanroep into main

brenno deleted branch fix/filepicker-per-aanroep

2026-07-22 11:14:53 +00:00

brenno referenced this pull request

2026-07-22 11:15:10 +00:00

[Bug] Image carousel picker reads a blob: path on web, and its callers are ungated #526