Review of PR #465 (comment 24953), suggestion 1: an alias
(`const c = confirmAction; if (!c(...))`) called confirmAction out of reach
of the "awaited" rule, and window["confirm"](...), confirm?.(...) and
`const { confirm } = window` escaped the native-call rule. Any mention of
confirmAction other than the awaited call, its declaration, a plain named
import or `confirm: confirmAction` is now refused; the three native forms
are flagged. Samples added for each.
Refs #421
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On desktop, tauri-plugin-dialog 2.6.0 replaces window.confirm with an async
function: confirm(...) returned a Promise, always truthy, so every guard
`if (!confirm(...)) return;` let the action run before the user answered.
Deleting a secondary profile removed its database even on "Cancel".
- confirmAction() (src/services/confirmService.ts) calls the plugin's ask()
with a warning icon and buttons labelled in the app language
(common.confirm / common.cancel); a failed call resolves false and is
logged (fail closed). @tauri-apps/plugin-dialog 2.6.0 added, the crate's
version.
- The six sites await it: profile, category, adjustment, budget template and
Balance category deletions, and both confirmations of the license key
removal (performRemoveLicense takes an async confirm).
- native-dialog-guard.test.ts fails on any native confirm/alert in src/ and
on any confirmation not awaited (TypeScript does not flag `!promise`).
- Tests: confirmService, the deletion of a profile in ProfileFormModal, and
the license removal tests with an async confirm (test: reproduces #421:
six of them were red on the old code).
Refs #421
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
