shahondin1624/Mitgliederverwaltung
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 16 Wiki Activity

feat: Abfrage-Builder NOT + visual brackets + full field coverage (#194) #195

Merged
shahondin1624 merged 1 commits from feature/issue-194-query-builder-not-brackets-fields into main 2026-04-17 20:17:09 +02:00
Conversation 0 Commits 1 Files Changed 6
+1297 -163
shahondin1624 commented 2026-04-17 20:17:03 +02:00
Owner
Copy Link
Copy Source

Summary

Implements #194. Extends the visual Abfrage-Builder with three tightly-related capabilities in one go.

NOT operator

  • not: true flag supported on both group and leaf nodes in the AST
  • Per-leaf ¬ toggle and per-group "NICHT" toggle in the UI
  • Nested negation works (NOT (A AND NOT B))
  • Fully backwards compatible — legacy ASTs without not unchanged

Explicit brackets (UX)

  • Visual ( ) rendered around nested groups
  • "Klammer auflösen" button lifts children into the parent when logic is compatible and group is not negated
  • Removed hard depth < 3 nesting cap; backend validation (max 10) remains

Full field coverage

New member columns: notizen, zusatz_notizen, einwilligung_datum, juleica_nummer, juleica_ablaufdatum

Encrypted: allergien — full operators, server-side decrypt-and-filter in PHP for content operators; pure-SQL null/empty check for is_empty/is_not_empty. Audit log records field + operator + user but never the value.

Related entities (EXISTS subqueries): telefon, email, familie_name, beitrag_bezahlt_jahr, beitrag_offen_jahr, beitrag_betrag, lager_teilnahme, lager_name, verletzung_vorhanden

Fields now expose a group property used by the frontend to render an optgroup-style grouped dropdown.

Security

  • Allergien plaintext never leaves the backend; decryption happens only inside QueryService::executeWithAllergienFilter()
  • Audit log entry masks the value (user, field, op, negated only)
  • All new fields added to the FIELD_MAP whitelist; no dynamic SQL

Test plan

  • Unit tests pass: 1118/1118
  • Integration + DatabasePortability: 13/13
  • Webpack production build clean
  • Version bumped in appinfo/info.xml, webpack.config.js, src/main.js (0.2.7 → 0.2.8)
  • Legacy saved-query AST (no not keys) still round-trips correctly

🤖 Generated with Claude Code

## Summary Implements #194. Extends the visual Abfrage-Builder with three tightly-related capabilities in one go. ### NOT operator - `not: true` flag supported on both group and leaf nodes in the AST - Per-leaf `¬` toggle and per-group "NICHT" toggle in the UI - Nested negation works (`NOT (A AND NOT B)`) - Fully backwards compatible — legacy ASTs without `not` unchanged ### Explicit brackets (UX) - Visual `(` `)` rendered around nested groups - "Klammer auflösen" button lifts children into the parent when logic is compatible and group is not negated - Removed hard `depth < 3` nesting cap; backend validation (max 10) remains ### Full field coverage **New member columns:** `notizen`, `zusatz_notizen`, `einwilligung_datum`, `juleica_nummer`, `juleica_ablaufdatum` **Encrypted:** `allergien` — full operators, server-side decrypt-and-filter in PHP for content operators; pure-SQL null/empty check for `is_empty`/`is_not_empty`. Audit log records field + operator + user but **never** the value. **Related entities (EXISTS subqueries):** `telefon`, `email`, `familie_name`, `beitrag_bezahlt_jahr`, `beitrag_offen_jahr`, `beitrag_betrag`, `lager_teilnahme`, `lager_name`, `verletzung_vorhanden` Fields now expose a `group` property used by the frontend to render an `optgroup`-style grouped dropdown. ### Security - Allergien plaintext never leaves the backend; decryption happens only inside `QueryService::executeWithAllergienFilter()` - Audit log entry masks the value (`user`, `field`, `op`, `negated` only) - All new fields added to the `FIELD_MAP` whitelist; no dynamic SQL ## Test plan - [x] Unit tests pass: 1118/1118 - [x] Integration + DatabasePortability: 13/13 - [x] Webpack production build clean - [x] Version bumped in `appinfo/info.xml`, `webpack.config.js`, `src/main.js` (0.2.7 → 0.2.8) - [x] Legacy saved-query AST (no `not` keys) still round-trips correctly 🤖 Generated with [Claude Code](https://claude.com/claude-code)
shahondin1624 added 1 commit 2026-04-17 20:17:03 +02:00
feat: extend Abfrage-Builder with NOT, visual brackets, and full field coverage (Closes #194)
Database Portability Tests / Unit Tests (PlatformHelper) (pull_request) Failing after 42s
Details
Database Portability Tests / Integration (mysql) (pull_request) Has been skipped
Details
Database Portability Tests / Integration (postgres) (pull_request) Has been skipped
Details
Database Portability Tests / Integration (sqlite) (pull_request) Has been skipped
Details
Database Portability Tests / Verify no MySQL-specific SQL (pull_request) Successful in 4s
Details
139f014c29 
Backend (QueryService):
- AST supports optional `not: true` flag on groups and leaves, translated
  to SQL `NOT (...)` wrappers; existing queries without `not` unchanged
- New member fields: notizen, zusatz_notizen, einwilligung_datum,
  juleica_nummer, juleica_ablaufdatum
- New related-entity fields via EXISTS subqueries: telefon, email,
  familie_name, beitrag_bezahlt_jahr, beitrag_offen_jahr, beitrag_betrag,
  lager_teilnahme, lager_name, verletzung_vorhanden
- Allergien (verschlüsselt): server-side decrypt-and-filter for content
  operators; pure SQL null/empty check for is_empty/is_not_empty; audit
  log records field+op+user but never the value
- Fields now carry a `group` label for grouped rendering in the UI
- Depth cap kept at 10 (Backend-Validierung) - no hard frontend limit

Frontend (QueryBuilder.vue):
- NICHT toggle on each leaf condition (¬ button) and on each group header
- Visual brackets `(` `)` rendered around nested groups
- "Klammer auflösen" button that lifts children into the parent when
  logic is compatible and the group isn't negated
- Fields dropdown grouped by category (Mitglied, Adresse, Kontakt,
  Familie, Beiträge, Lager, Gesundheit)
- Encrypted fields flagged with 🔒 badge
- Removed hard `depth < 3` nesting cap

Tests: 25 new QueryService tests covering NOT semantics, EXISTS joins,
allergien decrypt path, audit-log value masking, and backwards
compatibility with legacy ASTs. All 1118 unit + 13 integration tests pass.

Version bumped to 0.2.8 in all three locations.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
shahondin1624 merged commit fa702e30f3 into main 2026-04-17 20:17:09 +02:00
shahondin1624 deleted branch feature/issue-194-query-builder-not-brackets-fields 2026-04-17 20:17:09 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
backend
Backend / PHP work
 bug
Bug report
 database
Database migrations and schema
 documentation
Documentation
 enhancement
Enhancement or improvement
 epic
Epic / feature-group issues
 frontend
Frontend / Vue.js work
 integration
Nextcloud integrations (Calendar, Contacts, Files)
 priority:high
High priority
 priority:low
Low priority
 priority:medium
Medium priority
 security
Security-related work
 testing
Tests and test infrastructure
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
shahondin1624
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: shahondin1624/Mitgliederverwaltung#195
Delete Branch "feature/issue-194-query-builder-not-brackets-fields"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?