GitLab

Extract src/composables/useCrudList.js: owns list state + dialog state
machine + applySaved/applyDeleted + 5 toggle methods. Config:
{ list, create, update, deleteFn, idKey, mapRow?, loadErrorKey? }.

Decompose 4 master-data views into table + edit-dialog + delete-dialog
SFCs (11 new files), mirroring the StoryView pattern proven in
Candidate B. View shrinks to pure wiring of useCrudList + useFlashMessage
+ child SFCs.

Structural fixes (now composition-enforced, not patch-enforced):
- D5: applySaved merges backend response into local list, so audit
  fields (created_by, creation_date, last_updated_by, last_update_date)
  are visible immediately after save, no refresh required.
- D7: useCrudList owns deleteError; only *DeleteDialog.vue reads it.
  Cross-dialog delete-error bug fixed by composition.

Net change:
  SubjectView  763  →  85
  TermView     619  →  95
  StudentView 1312  → 115
  StoryView    173  →  85
  Total       2867  → 380  (-2487 lines)

Tests: useCrudList.spec.js covers fetch (success/error/auto-clear/
mapRow/non-array fallback), applySaved (create/update/audit-preservation/
no-id/null-undefined), applyDeleted, 5 toggle methods, clearDeleteError,
idKey+mapRow together. 23 new tests, 214 total passing.

Other quality wins: ~30 console.log calls in the 3 large views removed;
view-owned reference data (R2) keeps useCrudList agnostic of students/
subjects/terms.
Co-Authored-By: Claude <noreply@anthropic.com>

The router beforeEach guard was a 40-line inline function mixing auth
state checks, LAN bypass, and route resolution. Pulled the decision
logic into src/utils/authGuard.js — a pure function checkAuth(to,
authState) → {allowed, reason, redirect?} — that takes the auth store
as a plain object and returns a verdict. No Pinia, no vue-router, no
DOM imports. Trivially testable (21 spec covering LAN bypass,
already-authed-on-login, refresh-failed, etc.).

Router guard shrinks to 5 lines; AppLayout drops a redundant
router.push('/login') (auth.logout already navigates internally);
5 master-data views drop redundant onMounted initializeAuth() calls
(initializeAuth now runs once in main.js at boot).
Co-Authored-By: Claude <noreply@anthropic.com>