chore(receitasapi-ui): aislop quality pass + hallmark integrity fix - #20
Merged
Conversation
aislop, scoped to receitasapi-ui/ (score 54 -> 100): - 18 mechanical fixes via aislop fix: trivial comments, leftover console.log/debug statements, unused imports (app-module.ts, favorites.service.ts), duplicate @angular imports merged into single statements (feedback/meal-plan/recipe components, recipe.service.ts). - recipe.component.ts: removed an unused `url` local and a complete() handler that only logged success. - local-store.service.ts: empty catch block in remove() now documents intent the same way the sibling set() method already does. - feedback.component.ts: submitRating()'s next/error handlers duplicated a 10-line block building the same review entry; extracted recordLocalRating(). - favorites.component.ts / ratings.component.ts: both reached around their service's private LocalStoreService field with `(service as any)` to hand-edit localStorage state. Added public updateFavoriteLocally()/updateRatingLocally() methods on the services instead of poking at private internals through a type-safety hole. hallmark audit, scoped to receitasapi-ui/ (read-only, then mechanical fixes only): - src/index.html loaded Bootstrap from a CDN with integrity="sha384-" -- an empty/truncated SRI hash. Checked the actual SRI spec before concluding anything: an unparseable hash token is dropped during parsing, and an empty parsed-metadata set makes the integrity check a no-op (bypassed, not blocking) -- so the stylesheet was loading fine, just with no real integrity protection. Downloaded bootstrap@5.3.2's CSS and computed the real sha384 hash to complete the attribute. - Emoji-as-nav-icon (navbar.component.html) is a named anti-pattern but reads as this app's actual voice, not an AI tell -- left alone, noted as a redesign-scope decision, not applied. - No missing :focus-visible, no italic headers, no invented metrics, no motion in the project (nothing to gate behind prefers-reduced-motion). stop-slop: audited root README.md, docs/casos-de-uso.md and docs/casos-de-teste.md (repo-wide per scope). No AI writing patterns found in the direct, tabular documentation style already in use; nothing changed. api/ (Spring Boot, SonarQube-managed) untouched, as scoped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Escopo: só
receitasapi-ui/.api/(Spring Boot + SonarQube) não foi tocado.O que mudou
aislop (score 54 → 100):
aislop fix: comentários triviais,console.log/debugesquecidos, imports não usados (app-module.ts,favorites.service.ts), imports duplicados de@angular/*mesclados numa única declaração (feedback/meal-plan/recipecomponents,recipe.service.ts).recipe.component.ts: removida variávelurlnão usada e um handlercomplete()que só tinha umconsole.log.local-store.service.ts: catch vazio emremove()agora documenta a intenção do mesmo jeito que oset()vizinho já fazia.feedback.component.ts:submitRating()duplicava um bloco de 10 linhas nos handlersnext/error(montar a mesma entrada de review) — extraírecordLocalRating().favorites.component.ts/ratings.component.ts: os dois contornavam o campo privadoLocalStoreServicedo respectivo service com(service as any)para editar o localStorage na mão. AdicioneiupdateFavoriteLocally()/updateRatingLocally()públicos nos services em vez de furar o encapsulamento comas any.Atenção — achado de segurança que mudei de ideia no meio da investigação
src/index.htmlcarregava o Bootstrap via CDN comintegrity="sha384-"— hash SRI vazio/truncado. Antes de escrever isso no relatório como "o navbar está quebrado em produção", conferi a spec de verdade (W3C SRI, via WebFetch): um token de hash que não parseia é descartado, e um conjunto de metadata vazio faz o browser pular a checagem de integridade (não bloqueia o recurso). Ou seja, o CSS carregava normalmente — só que a proteção de integridade nunca funcionou (era um no-op silencioso). Baixei obootstrap@5.3.2/dist/css/bootstrap.min.cssde verdade, calculei o hash sha384 real comopenssl dgst, e completei o atributo.hallmark audit (só leitura, depois só correções pontuais)
🍽️ 🔍 ☰ 🔑 ✍️emnavbar.component.html) é um anti-pattern nomeado pelo hallmark, mas lê como voz de marca real de um app pessoal, não como tell de IA — não removido, listado como decisão de redesign que cabe a você.outline:noneremovendo foco, sem cabeçalhos em itálico, sem métricas inventadas, sem nenhuma animação no projeto (nada para condicionar aprefers-reduced-motion).stop-slop
Auditado
README.mdraiz,docs/casos-de-uso.mdedocs/casos-de-teste.md(docs do repo inteiro, conforme escopo). Nenhum maneirismo de IA — documentação técnica direta e tabular. Nada alterado.Test plan
npx tsc --noEmit -p tsconfig.app.jsonlimponpx ng buildoknpm test -- --watch=false— 16 arquivos, 142 testes, passando