The degree-to-radian ratio computed via native Math.PI/180 instead of
the Decimal PI already defined for evaluator's own trig — moved PI to
types.ts so both can import it without a cycle.
addUnit() overwrote unitsById unconditionally while its own addPhrase
calls are first-wins, so an extension reusing an existing id silently
corrupted the id->Unit table for anything using that id as a
baseUnitId afterwards. Throw instead.
PRIORITY only disambiguated USD vs TTD's "доллар". "Manat", "FC",
"Som" and "Kwacha" are each shared verbatim between two currencies
(AZN/TMT, CDF/KMF, KGS/UZS, MWK/ZMW) and fell to alphabetical code
order, so e.g. "100 Manat" always silently priced as AZN even when
TMT was meant. Drop the bare alias from the smaller-economy side;
its fuller name still works.
registerCoreVocab() registers "min" as the aggregate function name
before registerUnits() registers it as the minute abbreviation, and
first-registration-wins means the unit phrase never lands. "5 min"
silently became either plain "5" or got overwritten by a MIN of the
preceding block. Disambiguate right after tokenizing: "min"/"мин"
immediately after a number can only mean minutes.
tokenize() and parseLine() ran outside the try/catch, and the parser
has no recursion-depth guard for nested parens. A pathologically
nested line overflowed the stack with an uncaught RangeError, killing
the whole document instead of nulling just that line — the exact
thing evaluateDocument is supposed to prevent.
save_documents debounces 400ms; migrateDataDir used to fire without
waiting for it, so a save still in flight to the old folder could
land after migrate had already moved documents.json away, silently
recreating it in the abandoned folder and stranding the last edit.
load_documents, save_documents, run_backups, backup_deleted_sheet,
open_backups_folder and data_dir_has_documents all took a `dir` param
straight from the frontend and used it unchecked — any IPC caller
(a buggy extension, compromised webview content) could point Rust at
an arbitrary path, and migrate_data_dir's old_dir was the worst of it:
combined with strategy="move" it deletes documents.json and everything
under backups/ at whatever path it's handed.
Add DataDirGate: a path only counts as authorized if it was proven
user-chosen, either just now via the native folder picker or because
it's the data-dir.txt this file itself wrote after a previous
successful commit. save_file/load_file refuse to touch that filename
so the frontend can't forge its own authorization. docs_dir() now
returns Result and every command above goes through it.
migrate_data_dir authorizes the target before copying but only writes
data-dir.txt once every file has actually landed, so a migration that
dies partway leaves the app still pointing at a folder that works.
read_text_file (drag&drop) capped sheets at 1MB with an extension
whitelist; get_launch_file and the single-instance file-open handler
only checked the extension. Route both through read_sheet_file so a
file association or second launch gets the same cap.
rates.json, market.json and rates-<date>.json reads/writes ran
straight on the tokio worker calling the Tauri command, blocking the
shared async runtime for the duration. Wrap them in
tauri::async_runtime::spawn_blocking via read_file_async/write_atomic_async.
fetch_historical_rates and fetch_historical_rates_batch each built the
same USD-anchored, uppercased rate map inline. Extract parse_rate_map
and cover it with tests.
write_image_file hand-rolled the same temp+rename dance write_atomic
already did for text, just for bytes. Split write_atomic into a
write_atomic_bytes core and have both callers use it.
fs::write left the one safety-net copy of a deleted sheet exposed to
mid-write corruption; use the existing temp+rename helper like every
other user-data write.
