ユーザー編集機能の仮実装

[newt239]

• 簡易的なユーザー編集機能の実装
• 保護者氏名に全角スペースを挿入

手元で検証できないため一旦デプロイ

[Copilot]

Pull Request Overview

This PR implements a provisional user editing feature and introduces a utility function for formatting parent names with full‐width spaces.

• Adds new formatting functions in util/format.ts.
• Introduces a user edit page with a PUT API endpoint for updating user information.
• Updates user list and CSV export components along with minor code style improvements in other pages.

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
util/format.ts	Added phone number and parent name formatting utilities
util/db.ts	Improved error logging with template literals
pages/users/[id].tsx	Introduced a new user edit page with user update functionality
pages/users.tsx	Updated list page to use newly provided formatting utilities
pages/serverinfo.tsx	Added a lint-ignore comment and refined error handling
pages/list.tsx	Removed duplicate formatting functions and added an edit link
pages/index.tsx	Added a card linking to the user details page
pages/api/user.ts	Added PUT endpoint for updating user data with a raw SQL query
components/users/DownloadCSV.tsx	Updated type imports and improved consistency in comparisons

Comments suppressed due to low confidence (2)

pages/users/[id].tsx:96

• The query directly interpolates the id value into the SQL without quotes or parameterization, which may allow SQL injection. Consider using parameterized queries or ensuring the id is safely escaped, e.g., by wrapping it in quotes if appropriate.

const rows = await queryDb(`SELECT * FROM users WHERE id = UUID_TO_BIN(${id})`);

pages/api/user.ts:35

• Interpolating user input directly into the SQL UPDATE query risks SQL injection, and string fields are not wrapped in quotes. Using a parameterized query or proper escaping for each field would improve security and reliability.

await queryDb(`UPDATE users SET first_name = ${firstName}, last_name = ${lastName}, phone_number = ${phoneNumber} WHERE id = ${id}`);