fix(security): security audit (#35) * feat(table): add row grouping feature (#32) - Add RowGroupingAggregation, RowGroupingConfig, OnRowGroupExpandInfo types - Add rowGrouping, rowGroupingConfig, onRowGroupExpand props to DataTableProps - Add enableRowGroupingControls to TableConfig (default: true) - Add expandAllGroups/collapseAllGroups/isRowGroupingActive to TableContext - Wire getGroupedRowModel + GroupingState into DataTable - Render collapsible group-header rows with chevron + label + badge - Support multi-level grouping with depth-based indentation on child rows - Support per-column aggregation functions (sum/mean/min/max etc.) - Support custom group cell renderer via renderGroupCell - Add Expand All / Collapse All toolbar buttons (gated by enableRowGroupingControls) - Add GroupRowChevron + GroupRowBadge components to expand-icon.tsx - Add row grouping CSS classes to styles.css (depth-accent borders, badge, chevron anim) - Fix: getRowCanExpand now always returns true for group rows (was blocking TanStack expand) - Fix: expanded state init now correctly respects rowGroupingConfig.defaultExpanded - Fix: renderGroupCell returning null now falls back to default label (was rendering nothing) - Fix: placeholder cells in group rows render empty (was null, broke column grid) - Fix: Fragment keys namespaced to prevent group/leaf row ID collision - Fix: keyboard handler (Space/Enter) works on group rows + unmasked implicit role=row bug - Fix: isRowGroupingActive reads grouping state (not prop) to stay accurate after setGrouping - Fix: group label uses meta.label ?? id.replace(/_/g,' ') instead of raw column ID - Fix: Object.keys(true) guard in onRowGroupExpand effect when expanded=true (expand-all) - Fix: row model pipeline order documented (Core->Filter->Group->Sort->Page) - Fix: manualPagination+grouping dev warning to prevent silent group-splitting across pages - Add row grouping aggregationFns performance note to RowGroupingConfig JSDoc - Fix: export-utils createElementNS fix (prevents spy infinite recursion in tests) - Add employees-grouping demo page (3 examples: dept, dept+team, custom renderer) - Re-export RowGroupingAggregation, RowGroupingConfig, OnRowGroupExpandInfo from index.ts BREAKING CHANGE: none — all new props are optional, all existing props/methods intact Tests: 81 passed / 0 failed (5 suites) * feat(table): add imperative TableGroupingAPI via groupingRef (#32) Adds advanced depth-level grouping control matching simple-table's v2.1 API surface, built on top of TanStack's row model. - Add TableGroupingAPI interface to types.ts (expandDepth, collapseDepth, toggleDepth, etc.) - Add groupingRef prop to DataTableProps to expose imperative handle - Add depth-level helpers (expandDepth, collapseDepth, toggleDepth, getExpandedDepths, setExpandedDepths) to data-table.tsx - Add property/depth lookup helpers (getGroupingProperty, getGroupingDepth) - Expose all new helpers on TableContext for declarative usage - Update TableCraft employees-grouping demo with ProgrammaticDemo showcasing the new API - Fix: remove process.env check in use-table-data effect (resolves TS2591 process not found) - Docs: add TableGroupingAPI to index.ts exports * fix(table): row grouping review fixes (#32) - Swap toolbar Expand/Collapse icons (ChevronsUpDown for expand, ChevronsDownUp for collapse) — they were inverted - Gate the rowGrouping+pagination warning on NODE_ENV via globalThis so it stays out of production logs (and stops requiring @types/node) - Stop expandDepth from collapsing other depths when expanded === true: return prev unchanged in the boolean case instead of resetting to {} Co-Authored-By: Claude Sonnet 4.6 * fix(table): stabilize groupingRef handle across renders (#32) The imperative handle effect ran without a dependency array and cleaned up by nulling the ref. With the empty deps the effect/cleanup pair fired every render, so any consumer reading `ref.current` between renders could see `null` for a tick. - Add a real dep array listing every closure the handle captures - Drop the cleanup that nulls the ref; parent owns the ref's lifecycle Co-Authored-By: Claude Sonnet 4.6 * fix(table): mitigate CSV formula injection and drop aria-selected on group rows CSV injection: cell values whose first character is `=`, `+`, `-`, `@`, `\t`, or `\r` are interpreted as formulas by Excel, Google Sheets, and LibreOffice when an exported file is opened. Prefix such values with a single quote so spreadsheet apps treat them as plain text. Headers come from column metadata and are not user-controlled, so they are left unchanged. aria-selected: row-grouping rows are never selectable, so reporting `aria-selected="false"` on them was misleading to assistive tech. Omit the attribute on group rows. Tests: 82 passing (added one for the CSV sanitizer). Co-Authored-By: Claude Sonnet 4.6 * feat(table): add endToolbarContent/endToolbarPlacement for right-side injection Mirrors the existing startToolbarContent/startToolbarPlacement API so consumers can inject custom content anywhere in the right toolbar cluster without shifting any built-in controls. Slots (EndToolbarPlacement): before-grouping → first on the right (after legacy customToolbarContent) after-grouping / before-export → between grouping controls and export after-export / before-view → between export and view-options after-view / before-settings → between view-options and settings (default) after-settings → last (rightmost) Like startToolbarContent, accepts a ReactNode or a function that receives ToolbarContext (selection, search, dateRange state). Co-Authored-By: Claude Sonnet 4.6 * feat(demo): add Toolbar Placement demo page in vite-web-example Adds /toolbar-placement route showcasing all endToolbarContent slots: - before-export: context-aware Archive/Restore bulk-action buttons that appear only when rows are selected (reads ctx.totalSelected + selectedIds) - after-settings: static Import CSV button in the last/rightmost slot - before-view: custom category filter chips driving a customFilters on the adapter — no search input or URL state - after-view (default): Delete button disabled when nothing is selected All four examples use the existing products endpoint from hono-example — no new seed data or API routes required. Also includes a slot-map reference strip at the top of the page so developers can quickly see the full right-cluster order. Co-Authored-By: Claude Sonnet 4.6 * feat(demo): split toolbar demos into Start Slots / End Slots pages - Add /toolbar-start page: 3 compact examples for startToolbarContent - before-search: New Product button - after-search: category chips that drive customFilters - after-date: Sync button with spinner state - Rewrite /toolbar-placement (end slots): same 4 examples, drastically less description text — one-liner label + badge per section - Nav: change flat "Toolbar" link to a group dropdown with "Start Slots" and "End Slots" No new API routes or seed data needed. Co-Authored-By: Claude Sonnet 4.6 * feat(demo): add Archived toggle next to search on Products page Uses startToolbarPlacement="after-search" + startToolbarContent to place an Archive toggle button immediately after the search input. When active it drives customFilters={isArchived: eq true} on the adapter so only archived products are fetched. Co-Authored-By: Claude Sonnet 4.6 * feat(table): add lazy-tree support — getSubRows, onRowExpand, keepPreviousData - Add `getSubRows` prop so TanStack renders hierarchical data with depth indentation and a chevron on the first data cell of expandable rows - Add `onRowExpand` callback (fires on expand/collapse of non-grouped rows) for lazy-loading children on first expand - Add `keepPreviousData` config flag to skip skeleton flash when the adapter is recreated to push fresh tree data - Add `flattenTree` helper so export and selection count traverse all loaded child nodes, not just top-level adapter rows - Stop propagation on system-column (select/expand/actions) clicks so checking a checkbox no longer toggles row expansion - Clear `rowSelection` on page change, page-size change, and search change to prevent stale cross-page selection accumulation Co-Authored-By: Claude Sonnet 4.6 * feat(hono): add retail tree DB schema, REST API, and seed script - Add retailRegions / retailStores / retailProducts tables with Drizzle ORM - GET /api/manual/retail/tree — paginated regions (tree mode) or full-text deep search across all three levels with breadcrumb field (search mode) - GET /api/manual/retail/tree/:id/children — lazy-loads stores for a region or products for a store, both with sort support - seed-retail.ts seeds 60 regions, 139 stores, 417 products (6+ pages at default page size of 10) - Add seed:retail script to package.json Co-Authored-By: Claude Sonnet 4.6 * feat(web): add server-side lazy tree example (Regions → Stores → Products) - New /row-grouping/server page using DataTable with server-side search, sort, pagination, and on-demand child loading via onRowExpand - mergeChildren recursively reattaches cached children so multi-level expansion works correctly after adapter version bumps - Breadcrumb subtitle shown in Name cell for flat deep-search results - Restructure /row-grouping into a layout with Basic (static) and Server tabs - Add explicit column definitions to EmployeesGroupingPage so group rows render the value directly without the stale column-label prefix Co-Authored-By: Claude Sonnet 4.6 * chore: ignore graphify-out dir and update bun lockfile Co-Authored-By: Claude Sonnet 4.6 * feat(table): add useTreeAdapter hook — lazy server-side tree in one call Encapsulates all lazy-tree boilerplate (childrenRef, version re-memo, mergeChildren walk, loading placeholder, expand handler, per-node abort, dedupe, depth-cap cycle guard, unmount cleanup) into a single reusable hook so pages only declare what's unique to their data. server.tsx drops from 226 → 154 lines with no functional change. Co-Authored-By: Claude Sonnet 4.6 * refactor(hono): simplify retail tree route with engine utilities - Use engine's parseRequest for validated page/pageSize/search parsing - Consolidate 3 sort maps into a single SORT namespace - Extract order() helper (sort-column lookup + direction in one call) - Extract pageMeta() to eliminate repeated meta object construction - Extract parseParams() to centralise URL extraction across both endpoints Co-Authored-By: Claude Sonnet 4.6 * fix(hono): remove as const from SORT map to avoid IDE type inference issue Co-Authored-By: Claude Sonnet 4.6 * Update README.md * chore: update lockfile with redis optional peers * fix(web): satisfy eslint react-hooks and react-refresh rules - Move `cn` helper from LiquidCard.tsx into lib/utils.ts (shadcn convention) so LiquidCard only exports a component, satisfying react-refresh. - Drop the synchronous handleMouseMove() call from the Presentation mount effect — the controls already default to visible, so just schedule the auto-hide timer to avoid cascading renders (react-hooks/set-state-in-effect). --------- Co-authored-by: Claude Sonnet 4.6 Co-authored-by: jacksonnkasi

i can't believe 👀 #32

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions