NIT-Administrative-Systems / northwestern-laravel-starter / 24744346865

100%

push

github

Admin overview widgets, indexed name search, XSS fix (#125)

* fix(security): escape user name in impersonation global alert

A delegated admin with `CreateUsers` permission could plant HTML/JavaScript
in a user's `first_name` / `last_name`; when a separate admin with
`ManageImpersonation` later impersonated that user, the name was rendered
unescaped through the shared `{!! $activeAlert['message'] !!}` sink in
northwestern-laravel-ui's global-alert view, executing in the impersonator's
session. Wrap the interpolated identity string with `e()` before it reaches
the heredoc.

* perf(user): index full_name with a pg_trgm GIN on a stored generated column

Name searches ran a per-row string concatenation with no index, forcing a
sequential scan under ILIKE '%term%'. Add a PostgreSQL stored generated
`full_name` column (`TRIM(COALESCE(first_name,'') || ' ' || COALESCE(last_name,''))`)
plus a `pg_trgm` GIN index on it, and route `UserBuilder::searchByName`
through the indexed column.

- Migration is Postgres-only; other drivers continue to use the accessor
  and the portable CONCAT_WS fallback, so downstream projects keep working.
- `User::fullName` accessor now mirrors the DB expression and prefers the
  stored value when present, keeping PHP and SQL representations identical
  across read paths and engines.
- `searchByName` takes the indexed fast path when the term has no comma;
  comma-format "Last, First" queries fall back to the compound OR so the
  existing behavior is preserved.
- Dropped `full_name` from `$appends` now that it is a real column (the
  accessor still handles unpersisted instances).

On 50k synthetic users, unanchored ILIKE on `full_name` drops from a
~54ms seq scan to a ~1ms bitmap-index scan.

* feat(admin): redesign Overview page with operational widgets

Replaces the stacked four-section right column and heavy status banner with
a denser, more scannable layout:

- Slim status ribbon in place of the full-height banner; failure/warnin... (continued)

11 of 11 new or added lines in 1 file covered. (100.0%)

2408 of 2408 relevant lines covered (100.0%)

7.44 hits per line