fix: address PR review — access control, validation, accessibility, thread safety

Author: datlechin

TablePro/ContentView.swift

@@ -355,14 +355,6 @@ struct ContentView: View {
         )
     }
 
-    private func sidebarTabBinding(for connectionId: UUID) -> Binding<SidebarTab> {
-        let state = SharedSidebarState.forConnection(connectionId)
-        return Binding(
-            get: { state.selectedSidebarTab },
-            set: { state.selectedSidebarTab = $0 }
-        )
-    }
-
     private func sidebarSearchPrompt(for connectionId: UUID) -> String {
         let state = SharedSidebarState.forConnection(connectionId)
         switch state.selectedSidebarTab {

TablePro/Core/SSH/LibSSH2Tunnel.swift

@@ -34,8 +34,7 @@ internal final class LibSSH2Tunnel: @unchecked Sendable {
     /// Keeps blocking work off the Swift cooperative thread pool.
     private static let relayQueue = DispatchQueue(
         label: "com.TablePro.ssh.relay",
-        qos: .utility,
-        attributes: .concurrent
+        qos: .utility
     )
 
     /// Callback invoked when the tunnel dies (keep-alive failure, etc.)
@@ -308,7 +307,10 @@ internal final class LibSSH2Tunnel: @unchecked Sendable {
             }
         }
 
-        relayTasks.withLock { $0.append(task) }
+        relayTasks.withLock { tasks in
+            tasks.removeAll { $0.isCancelled }
+            tasks.append(task)
+        }
     }
 
     /// Blocking relay loop — must only be called on `relayQueue`, never the cooperative pool.

TablePro/Core/Storage/SQLFavoriteManager.swift

@@ -7,7 +7,7 @@ import Foundation
 import os
 
 /// Manages SQL favorites with notifications and sync tracking
-final class SQLFavoriteManager {
+internal final class SQLFavoriteManager {
     static let shared = SQLFavoriteManager()
     private static let logger = Logger(subsystem: "com.TablePro", category: "SQLFavoriteManager")
 

TablePro/Core/Storage/SQLFavoriteStorage.swift

@@ -8,7 +8,7 @@ import os
 import SQLite3
 
 /// Thread-safe SQLite storage for SQL favorites with FTS5 full-text search
-final class SQLFavoriteStorage {
+internal final class SQLFavoriteStorage {
     static let shared = SQLFavoriteStorage()
     private static let logger = Logger(subsystem: "com.TablePro", category: "SQLFavoriteStorage")
 
@@ -564,9 +564,17 @@ final class SQLFavoriteStorage {
                     sqlite3_bind_null(moveFavStatement, 1)
                 }
                 sqlite3_bind_text(moveFavStatement, 2, idString, -1, SQLITE_TRANSIENT)
-                sqlite3_step(moveFavStatement)
+                let moveFavResult = sqlite3_step(moveFavStatement)
+                sqlite3_finalize(moveFavStatement)
+                if moveFavResult != SQLITE_DONE {
+                    if inTransaction { sqlite3_exec(self.db, "ROLLBACK;", nil, nil, nil) }
+                    return false
+                }
+            } else {
+                sqlite3_finalize(moveFavStatement)
+                if inTransaction { sqlite3_exec(self.db, "ROLLBACK;", nil, nil, nil) }
+                return false
             }
-            sqlite3_finalize(moveFavStatement)
 
             // Move child subfolders to the parent folder
             let moveSubfoldersSQL = "UPDATE folders SET parent_id = ? WHERE parent_id = ?;"
@@ -578,9 +586,17 @@ final class SQLFavoriteStorage {
                     sqlite3_bind_null(moveSubStatement, 1)
                 }
                 sqlite3_bind_text(moveSubStatement, 2, idString, -1, SQLITE_TRANSIENT)
-                sqlite3_step(moveSubStatement)
+                let moveSubResult = sqlite3_step(moveSubStatement)
+                sqlite3_finalize(moveSubStatement)
+                if moveSubResult != SQLITE_DONE {
+                    if inTransaction { sqlite3_exec(self.db, "ROLLBACK;", nil, nil, nil) }
+                    return false
+                }
+            } else {
+                sqlite3_finalize(moveSubStatement)
+                if inTransaction { sqlite3_exec(self.db, "ROLLBACK;", nil, nil, nil) }
+                return false
             }
-            sqlite3_finalize(moveSubStatement)
 
             // Delete the folder
             let deleteSQL = "DELETE FROM folders WHERE id = ?;"

TablePro/Models/Query/SQLFavorite.swift

@@ -6,7 +6,7 @@
 import Foundation
 
 /// A saved SQL query that can be quickly recalled and optionally expanded via keyword
-struct SQLFavorite: Identifiable, Codable, Hashable {
+internal struct SQLFavorite: Identifiable, Codable, Hashable {
     let id: UUID
     var name: String
     var query: String
@@ -25,17 +25,18 @@ struct SQLFavorite: Identifiable, Codable, Hashable {
         folderId: UUID? = nil,
         connectionId: UUID? = nil,
         sortOrder: Int = 0,
-        createdAt: Date = Date(),
-        updatedAt: Date = Date()
+        createdAt: Date? = nil,
+        updatedAt: Date? = nil
     ) {
+        let now = Date()
         self.id = id
         self.name = name
         self.query = query
         self.keyword = keyword
         self.folderId = folderId
         self.connectionId = connectionId
         self.sortOrder = sortOrder
-        self.createdAt = createdAt
-        self.updatedAt = updatedAt
+        self.createdAt = createdAt ?? now
+        self.updatedAt = updatedAt ?? now
     }
 }

TablePro/Models/Query/SQLFavoriteFolder.swift

@@ -6,7 +6,7 @@
 import Foundation
 
 /// A folder for organizing SQL favorites into a hierarchy
-struct SQLFavoriteFolder: Identifiable, Codable, Hashable {
+internal struct SQLFavoriteFolder: Identifiable, Codable, Hashable {
     let id: UUID
     var name: String
     var parentId: UUID?
@@ -21,15 +21,16 @@ struct SQLFavoriteFolder: Identifiable, Codable, Hashable {
         parentId: UUID? = nil,
         connectionId: UUID? = nil,
         sortOrder: Int = 0,
-        createdAt: Date = Date(),
-        updatedAt: Date = Date()
+        createdAt: Date? = nil,
+        updatedAt: Date? = nil
     ) {
+        let now = Date()
         self.id = id
         self.name = name
         self.parentId = parentId
         self.connectionId = connectionId
         self.sortOrder = sortOrder
-        self.createdAt = createdAt
-        self.updatedAt = updatedAt
+        self.createdAt = createdAt ?? now
+        self.updatedAt = updatedAt ?? now
     }
 }

TablePro/Models/UI/SharedSidebarState.swift

@@ -9,7 +9,7 @@
 import Foundation
 
 /// Which sidebar tab is active
-enum SidebarTab: String, CaseIterable {
+internal enum SidebarTab: String, CaseIterable {
     case tables
     case favorites
 }

TablePro/Resources/Localizable.xcstrings

@@ -6034,6 +6034,9 @@
     },
     "Delete Folder" : {
 
+    },
+    "Delete Folder?" : {
+
     },
     "Delete Foreign Key" : {
       "extractionState" : "stale",
@@ -8387,6 +8390,9 @@
     },
     "Focus Border" : {
 
+    },
+    "Folder name" : {
+
     },
     "Font" : {
       "extractionState" : "stale",
@@ -10016,6 +10022,9 @@
     },
     "Keyword:" : {
 
+    },
+    "keyword: %@" : {
+
     },
     "Language:" : {
       "localizations" : {
@@ -10808,6 +10817,9 @@
           }
         }
       }
+    },
+    "Move to" : {
+
     },
     "Move Up" : {
       "extractionState" : "stale",
@@ -14928,6 +14940,9 @@
           }
         }
       }
+    },
+    "Root Level" : {
+
     },
     "Row %lld" : {
       "localizations" : {
@@ -16067,6 +16082,9 @@
     },
     "Settings:" : {
 
+    },
+    "Shadows the SQL keyword '%@'" : {
+
     },
     "Share anonymous usage data" : {
       "localizations" : {
@@ -17735,6 +17753,9 @@
           }
         }
       }
+    },
+    "The folder \"%@\" will be deleted. Items inside will be moved to the parent level." : {
+
     },
     "The following %lld queries may permanently modify or delete data. This action cannot be undone.\n\n%@" : {
       "localizations" : {
@@ -19468,9 +19489,6 @@
           }
         }
       }
-    },
-    "Warning: this shadows the SQL keyword '%@'" : {
-
     },
     "Website" : {
       "localizations" : {
@@ -19553,6 +19571,9 @@
           }
         }
       }
+    },
+    "When enabled, this favorite is visible in all connections" : {
+
     },
     "When TablePro starts:" : {
       "localizations" : {

TablePro/ViewModels/FavoritesSidebarViewModel.swift

@@ -7,7 +7,7 @@ import Foundation
 import Observation
 
 /// Tree node for displaying favorites and folders in a hierarchy
-enum FavoriteTreeItem: Identifiable, Hashable {
+internal enum FavoriteTreeItem: Identifiable, Hashable {
     case folder(SQLFavoriteFolder, children: [FavoriteTreeItem])
     case favorite(SQLFavorite)
 
@@ -21,7 +21,7 @@ enum FavoriteTreeItem: Identifiable, Hashable {
 
 /// ViewModel for the favorites sidebar section
 @MainActor @Observable
-final class FavoritesSidebarViewModel {
+internal final class FavoritesSidebarViewModel {
     // MARK: - State
 
     var treeItems: [FavoriteTreeItem] = []
@@ -86,7 +86,7 @@ final class FavoritesSidebarViewModel {
 
         let levelFolders = folders
             .filter { $0.parentId == parentId }
-            .sorted { $0.sortOrder < $1.sortOrder }
+            .sorted { $0.sortOrder != $1.sortOrder ? $0.sortOrder < $1.sortOrder : $0.name.localizedStandardCompare($1.name) == .orderedAscending }
 
         for folder in levelFolders {
             let children = buildTree(folders: folders, favorites: favorites, parentId: folder.id)
@@ -95,7 +95,7 @@ final class FavoritesSidebarViewModel {
 
         let levelFavorites = favorites
             .filter { $0.folderId == parentId }
-            .sorted { $0.sortOrder < $1.sortOrder }
+            .sorted { $0.sortOrder != $1.sortOrder ? $0.sortOrder < $1.sortOrder : $0.name.localizedStandardCompare($1.name) == .orderedAscending }
 
         for fav in levelFavorites {
             items.append(.favorite(fav))

TablePro/Views/Components/ConflictResolutionView.swift

@@ -140,7 +140,7 @@ struct ConflictResolutionView: View {
             }
         case .favorite, .favoriteFolder:
             if let name = record["name"] as? String {
-                fieldRow(label: "Name", value: name)
+                fieldRow(label: String(localized: "Name"), value: name)
             }
         }
     }