fix: address CodeRabbit review comments on PR #321

- Add missing `query` import from `$api/rumble` in amendment.ts,
  operativeClauseVote.ts, and resolutionPaper.ts (build failures)
- Guard `window.location.reload()` with `browser` check in client.ts (SSR crash)
- Fix GraphQL injection in sendBeacon by using variables instead of
  string interpolation in both participant and chair paper pages
- Replace weak 6-char share code with nanoid helper per repo conventions
- Fix final vote guard to only accept VOTING_PHASE (was also accepting
  AMENDMENT_PHASE, allowing voting phase to be skipped)
- Add paper phase check to adoptByConsensus and acceptAmendment to prevent
  amendment application after paper leaves AMENDMENT_PHASE
- Fix ALTER_POSITION off-by-one: align with "insert after" convention
  used by ADD, and allow targetPosition of -1 for beginning
- Fix restored amendments reset to SUBMITTED instead of PENDING so they
  remain visible and actionable after revert
- Fix subscription cleanup in participant papers list (websocket leak)
- Fix i18n: "Stimmung" -> "Abstimmung" in de.json, "notes" -> "votes"
  and "two-thrids" -> "two-thirds" in en.json

https://claude.ai/code/session_013PjiR7TYfuzeoqmy6zRPT9

Author: claude

messages/de.json

@@ -364,7 +364,7 @@
 	"publicComment": "Öffentlich",
 	"publish": "Veröffentlichen",
 	"publishChanges": "Änderungen Veröffentlichen",
-	"recordVoteFromVoting": "Stimmung erfassen",
+	"recordVoteFromVoting": "Abstimmung erfassen",
 	"redeemShareCode": "Freigabecode einlösen",
 	"redo": "Wiederholen",
 	"regionalGroup_africa": "Afrika",
@@ -563,7 +563,7 @@
 	"unassigned": "Nicht zugewiesen",
 	"underline": "Unterstrichen",
 	"undo": "Rückgängig",
-	"undoVote": "Stimmung rückgängig",
+	"undoVote": "Abstimmung rückgängig",
 	"unknown": "unbekannt",
 	"unrecognizedCodes": "Nicht erkannte Codes:",
 	"until": "bis {time} Uhr",

messages/en.json

@@ -488,7 +488,7 @@
 	"short_sleek_snake_hint": "Committee",
 	"showOfHandsVoting": "Vote by Show of Hands",
 	"simpleMajority": "Simple",
-	"simpleMajorityTooltip": "Needed notes for simple majority",
+	"simpleMajorityTooltip": "Needed votes for simple majority",
 	"speaker": "Speaker",
 	"speakersList": "General Speakers' List",
 	"speakersListNamePlaceholder": "New name...",
@@ -556,7 +556,7 @@
 	"topCandidate": "Top Candidate",
 	"totalCountriesPresent": "Count of Present Countries",
 	"twoThirdsMajority": "Two-thirds",
-	"twoThirdsMajorityTooltip": "Needed votes for two-thrids majority",
+	"twoThirdsMajorityTooltip": "Needed votes for two-thirds majority",
 	"typeOfVoting": "Type of Vote",
 	"unActor": "UN Actor",
 	"unActors": "UN Actors",

src/api/handlers/amendment.ts

@@ -1,5 +1,5 @@
 import { db, schema } from '$api/db/db';
-import { abilityBuilder, enum_, schemaBuilder, pubsub as rumblePubsub } from '$api/rumble';
+import { abilityBuilder, enum_, query, schemaBuilder, pubsub as rumblePubsub } from '$api/rumble';
 import { basics } from './basics';
 import { isGlobalAdmin } from '$api/services/isAdminEmail';
 import { assertFindFirstExists, assertFirstEntryExists } from '@m1212e/rumble';
@@ -193,19 +193,28 @@ async function applyAmendmentToResolution(
 		case 'ALTER_POSITION': {
 			// Resolve current index from stable clause ID
 			const sourceIdx = findClauseIndex(resolution.operative, amendment.targetClauseId!);
-			const destIdx = amendment.targetPosition!;
-			if (destIdx < 0 || destIdx > resolution.operative.length) {
+			const targetPosition = amendment.targetPosition!;
+			// targetPosition follows the "insert after" convention: -1 means beginning
+			if (targetPosition < -1 || targetPosition >= resolution.operative.length) {
 				throw new GraphQLError('Destination index out of range');
 			}
 			const [clause] = resolution.operative.splice(sourceIdx, 1);
 			// After removing from source, the target index might shift
-			const adjustedDest = destIdx > sourceIdx ? destIdx - 1 : destIdx;
-			resolution.operative.splice(adjustedDest, 0, clause);
+			const adjustedTargetPosition =
+				targetPosition >= sourceIdx ? targetPosition - 1 : targetPosition;
+			resolution.operative.splice(adjustedTargetPosition + 1, 0, clause);
 			// Adjust other pending amendments' targetPosition for the structural shift
 			// First: source removal shifts indices down
 			await adjustPendingPositions(tx, paper.id, amendment.id, 'decrement', sourceIdx, 'gt');
 			// Then: destination insertion shifts indices up
-			await adjustPendingPositions(tx, paper.id, amendment.id, 'increment', adjustedDest, 'gte');
+			await adjustPendingPositions(
+				tx,
+				paper.id,
+				amendment.id,
+				'increment',
+				adjustedTargetPosition + 1,
+				'gte'
+			);
 			break;
 		}
 	}
@@ -562,6 +571,10 @@ schemaBuilder.mutationFields((t) => ({
 				.findFirst({ where: { id: amendment.paperId } })
 				.then(assertFindFirstExists);
 
+			if (paper.status !== 'AMENDMENT_PHASE') {
+				throw new GraphQLError('Paper must be in AMENDMENT_PHASE to adopt amendments');
+			}
+
 			await assertCommitteeChairOrAdmin(ctx, paper.committeeId);
 
 			await db.transaction(async (tx) => {
@@ -606,6 +619,10 @@ schemaBuilder.mutationFields((t) => ({
 				.findFirst({ where: { id: amendment.paperId } })
 				.then(assertFindFirstExists);
 
+			if (paper.status !== 'AMENDMENT_PHASE') {
+				throw new GraphQLError('Paper must be in AMENDMENT_PHASE to accept amendments');
+			}
+
 			await assertCommitteeChairOrAdmin(ctx, paper.committeeId);
 
 			await db.transaction(async (tx) => {

src/api/handlers/operativeClauseVote.ts

@@ -1,5 +1,5 @@
 import { db, schema } from '$api/db/db';
-import { abilityBuilder, enum_, schemaBuilder, pubsub as rumblePubsub } from '$api/rumble';
+import { abilityBuilder, enum_, query, schemaBuilder, pubsub as rumblePubsub } from '$api/rumble';
 import { basics } from './basics';
 import { isGlobalAdmin } from '$api/services/isAdminEmail';
 import { assertCommitteeChairOrAdmin } from './resolutionPaper';

src/api/handlers/paperShareCode.ts

@@ -5,9 +5,9 @@ import { basics } from './basics';
 import { isGlobalAdmin } from '$api/services/isAdminEmail';
 import { assertFindFirstExists, assertFirstEntryExists } from '@m1212e/rumble';
 import { GraphQLError } from 'graphql';
-import { customAlphabet } from 'nanoid';
+import { nanoid } from '$lib/helpers/nanoid';
 
-const generateShareCode = customAlphabet('ABCDEFGHJKLMNPQRSTUVWXYZ23456789', 6);
+const generateShareCode = () => nanoid();
 
 const { arg, ref, pubsub, table } = basics('paperShareCode');
 const paperPubsub = rumblePubsub({ table: 'resolutionPaper' });

src/api/handlers/resolutionPaper.ts

@@ -1,5 +1,5 @@
 import { db, schema } from '$api/db/db';
-import { abilityBuilder, enum_, schemaBuilder, pubsub as rumblePubsub } from '$api/rumble';
+import { abilityBuilder, enum_, query, schemaBuilder, pubsub as rumblePubsub } from '$api/rumble';
 import { and, eq, isNull, count as drizzleCount, desc, inArray } from 'drizzle-orm';
 import { basics } from './basics';
 import { isGlobalAdmin } from '$api/services/isAdminEmail';
@@ -660,7 +660,7 @@ schemaBuilder.mutationFields((t) => ({
 				})
 				.then(assertFindFirstExists);
 
-			if (paper.status !== 'VOTING_PHASE' && paper.status !== 'AMENDMENT_PHASE') {
+			if (paper.status !== 'VOTING_PHASE') {
 				throw new GraphQLError('Paper must be in VOTING_PHASE to record final vote');
 			}
 
@@ -855,10 +855,10 @@ schemaBuilder.mutationFields((t) => ({
 								.set({ content: snapshot.content })
 								.where(eq(schema.resolutionPaper.id, args.paperId));
 						}
-						// Reset applied amendments back to PENDING
+						// Reset applied amendments back to SUBMITTED so they are visible and actionable
 						await tx
 							.update(schema.amendment)
-							.set({ status: 'PENDING' })
+							.set({ status: 'SUBMITTED' })
 							.where(
 								and(
 									eq(schema.amendment.paperId, args.paperId),

src/client.ts

@@ -3,6 +3,7 @@ import toast from 'svelte-french-toast';
 import { error } from '@sveltejs/kit';
 import { subscription } from '$houdini/plugins';
 import { createClient } from 'graphql-sse';
+import { browser } from '$app/environment';
 
 let redirecting = false;
 
@@ -11,7 +12,9 @@ const authRedirect: ClientPlugin = () => ({
 		if (!redirecting && value.errors?.some((e) => e.message === 'Must be logged in')) {
 			console.warn('[auth] Session expired, redirecting to login...');
 			redirecting = true;
-			window.location.reload();
+			if (browser) {
+				window.location.reload();
+			}
 		}
 		resolve(ctx);
 	}

src/routes/app/[conferenceId]/[committeeId]/(chairs)/resolutions/[paperId]/+page.svelte

@@ -152,7 +152,8 @@
 		// Best-effort lock release on tab close
 		const handleBeforeUnload = () => {
 			const body = JSON.stringify({
-				query: `mutation { releaseAllMyLocks(paperId: "${page.params.paperId}") }`
+				query: 'mutation ReleaseAllMyLocks($paperId: ID!) { releaseAllMyLocks(paperId: $paperId) }',
+				variables: { paperId: page.params.paperId }
 			});
 			navigator.sendBeacon('/api/graphql', new Blob([body], { type: 'application/json' }));
 		};

src/routes/app/[conferenceId]/participant/[committeeId]/papers/+page.svelte

@@ -4,7 +4,7 @@
 	import { goto } from '$app/navigation';
 	import type { PageData } from './$houdini';
 	import { graphql } from '$houdini';
-	import { onMount } from 'svelte';
+	import { onMount, onDestroy } from 'svelte';
 	import { ParticipantPapersSubscription } from './papersSubscription';
 	import { ParticipantCommitteeSubscription } from '../committeeSubscription';
 	import { generatePaperName } from '$lib/utils/paperNameGenerator';
@@ -53,11 +53,21 @@
 		)
 	);
 
+	let paperUnsubscribe: (() => void) | undefined;
+	let committeeUnsubscribe: (() => void) | undefined;
+
 	onMount(() => {
-		ParticipantPapersSubscription.listen({
+		paperUnsubscribe = ParticipantPapersSubscription.listen({
 			committeeId: page.params.committeeId!
 		});
-		ParticipantCommitteeSubscription.listen({ id: page.params.committeeId! });
+		committeeUnsubscribe = ParticipantCommitteeSubscription.listen({
+			id: page.params.committeeId!
+		});
+	});
+
+	onDestroy(() => {
+		paperUnsubscribe?.();
+		committeeUnsubscribe?.();
 	});
 
 	// Create paper mutation

src/routes/app/[conferenceId]/participant/[committeeId]/papers/[paperId]/+page.svelte

@@ -166,7 +166,9 @@
 		const handleBeforeUnload = () => {
 			if (canEdit) {
 				const body = JSON.stringify({
-					query: `mutation { releaseAllMyLocks(paperId: "${page.params.paperId}") }`
+					query:
+						'mutation ReleaseAllMyLocks($paperId: ID!) { releaseAllMyLocks(paperId: $paperId) }',
+					variables: { paperId: page.params.paperId }
 				});
 				navigator.sendBeacon('/api/graphql', new Blob([body], { type: 'application/json' }));
 			}