mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 13:36:48 +00:00
jubnl
e62f463296
TripsRepository.findForViewer/listForUser/activeTrip each hand-wrote the identical trip-access boolean (t.user_id = ? OR m.user_id IS NOT NULL) through the Kysely expression builder. Task 7's security review (M1) evaluated a shared helper and set it aside for time, falling back to the TRIPREPO-041 cross-method parity test as a regression guard instead. Extracted the boolean into one generic helper, tripAccessExpr (_shared/trip-access.ts), following the reservation-visibility.ts publicReservationExpr precedent: fully generic over <DB, TB> since the predicate has no correlated subquery, so it composes across TripSelectKyselyDB and ActiveTripKyselyDB without needing a narrower fixed-alias shape. The LEFT JOIN itself stays hand-written at each call site — tripSelectQuery's own docstring already explains why a shared join helper can't be typed across these differently-joined outer queries. feeds.service.ts and memories-access.service.ts no longer duplicate this predicate at all (Task 2's facade-inline sweep already converted both onto TripsRepository.findAccessible/getFeedTokenIfReachable/ listReachableActiveTrips, which read through the canonical MikroORM QueryBuilder form, accessibleTripsQuery) — the remaining duplication this task closes is the three Kysely copies inside this file. TRIPREPO-041 (64/64 in the file) stays green as the unification's own regression guard.