packages/frontend/src/app/spreadsheet/charts/chart-registry.ts (1)

138-152: LGTM — clean centralization of legend prop mapping.

The helper correctly narrows legendPosition to verticalAlign for top/bottom and align for left/right, leaving others undefined. The "none" case is defensively handled even though all current call sites guard with legendPosition !== "none".

Optional: since each renderer's Props.legendPosition duplicates the same string union, consider having them import and reuse the newly exported LegendPosition type to keep the union in a single place.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/frontend/src/app/spreadsheet/charts/chart-registry.ts` around lines
138 - 152, The code centralizes the legend-position union into the exported
LegendPosition type but renderers still duplicate the string union; update each
renderer Props that currently declares its own legendPosition union to import
and use the shared LegendPosition type (reference: LegendPosition and
getLegendProps, and chart renderer Prop declarations such as
Props.legendPosition or ChartRendererProps) so the union is maintained in one
place—replace local literal unions with the imported LegendPosition and run
type-checks to ensure no ABI changes.

packages/backend/src/api/v1/documents.controller.ts (1)

54-80: Potential optimization: fold the existence check into the write itself.

update and remove now issue two DB round-trips — a findUnique via getDocumentOrThrow purely to enforce workspace scoping, followed by updateDocument/deleteDocument keyed only by id. Because the subsequent write ignores workspaceId, the pre-check is load‑bearing for authorization, not just ergonomics, so it can't simply be dropped. You can collapse both concerns into a single query with updateMany/deleteMany using a compound where, treating a zero count as NotFoundException:

♻️ Sketch

// service
async updateDocumentScoped(where: Prisma.DocumentWhereInput, data: Prisma.DocumentUpdateInput) {
  const { count } = await this.prisma.document.updateMany({ where, data });
  if (!count) throw new NotFoundException('Document not found');
  // optionally re-fetch to return the updated row
  return this.prisma.document.findFirst({ where });
}

Non-blocking; only worth doing if these endpoints are hot. Otherwise the current shape is clear and consistent with the other controllers.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/backend/src/api/v1/documents.controller.ts` around lines 54 - 80,
Both update and remove perform two DB round-trips: getDocumentOrThrow
(findUnique) then updateDocument/deleteDocument keyed only by id; fold existence
+ workspace scoping into a single write by adding service methods that use
Prisma's updateMany/deleteMany with a compound where (id + workspaceId), e.g.
implement documentService.updateDocumentScoped and
documentService.deleteDocumentScoped that call updateMany/deleteMany, throw
NotFoundException when count === 0, and optionally re-fetch with findFirst if
the controller needs the updated row; then have the controller's update and
remove call these new scoped methods instead of getDocumentOrThrow followed by
updateDocument/deleteDocument.

packages/frontend/src/components/datasource-form-fields.tsx (3)

92-101: Missing autoComplete on the password input.

Without autoComplete="new-password" (or "current-password" depending on context), browsers may offer to autofill stored credentials into this connection-password field, or prompt to save the DB password as a site login. Since this component is shared by both create and edit flows, autoComplete="new-password" is the safer default and can be overridden per-call later if needed.

🛡️ Suggested change

           <Input
             id={`${idPrefix}-password`}
             type="password"
+            autoComplete="new-password"
             placeholder={passwordPlaceholder}
             value={password}
             onChange={(e) => onPasswordChange(e.target.value)}
           />

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/frontend/src/components/datasource-form-fields.tsx` around lines 92
- 101, The password Input in the datasource form (the Input element with id
built from idPrefix, props value={password}, onChange calling onPasswordChange,
and placeholder passwordPlaceholder) is missing an autoComplete attribute; add
autoComplete="new-password" to that Input component so browsers treat it as a
new/connection password by default (this is safe for both create/edit flows and
can be overridden by callers if needed).

---

63-71: Port input accepts any numeric string — consider min/max and non-integer guard.

type="number" allows negatives, decimals, and exponent notation (e.g. 1e5), all of which Number(port) will happily convert before sending to the backend. Since TCP ports are integers in [1, 65535], adding min={1} max={65535} step={1} (and optionally inputMode="numeric") would prevent obviously-invalid values reaching createWorkspaceDataSource / updateDataSource.

♻️ Suggested change

           <Input
             id={`${idPrefix}-port`}
             type="number"
+            min={1}
+            max={65535}
+            step={1}
+            inputMode="numeric"
             value={port}
             onChange={(e) => onPortChange(e.target.value)}
           />

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/frontend/src/components/datasource-form-fields.tsx` around lines 63
- 71, The Port input currently allows negatives, decimals and exponent notation;
update the Input element in datasource-form-fields (the Input with id
`${idPrefix}-port`) to include min={1} max={65535} step={1} and
inputMode="numeric" to constrain UI input, and add a non-integer/invalid-value
guard in the onPortChange handler (or the function that receives it) to
coerce/validate to an integer in range before passing to
createWorkspaceDataSource/updateDataSource (reject or clamp values outside
[1,65535] and strip decimals so only integers are sent).

---

5-22: Optional: collapse the 7 on*Change props into a single onChange(field, value) or a values/onValuesChange pair.

The props interface is already 17 fields wide and will grow linearly with every new datasource field. A single discriminated onChange callback (or values: {...} + onValuesChange: (patch) => void) would reduce the prop surface at both call sites and remove the parallel-array-style maintenance burden when adding fields. Not blocking — current shape is fine and explicit.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/frontend/src/components/datasource-form-fields.tsx` around lines 5 -
22, The props interface DataSourceFormFieldsProps is verbose due to seven
parallel on*Change callbacks; replace them with a single unified change API by
either adding onChange(field: string, value: string | boolean) and removing
onNameChange/onHostChange/onPortChange/onDatabaseChange/onUsernameChange/onPasswordChange/onSslEnabledChange,
or by switching to values: { name, host, port, database, username, password,
sslEnabled } plus onValuesChange(patch: Partial<typeof values>), then update the
component (where it currently calls the individual handlers) to call the new
onChange or onValuesChange and update all call sites to pass the consolidated
callback/values shape; keep idPrefix, passwordPlaceholder and other unrelated
props unchanged.

packages/frontend/src/components/datasource-dialog.tsx (1)

144-160: Consider passing an explicit passwordPlaceholder for the create dialog.

On the edit dialog the placeholder communicates "Leave blank to keep current", but here no placeholder is passed, so the password field renders with no hint at all. Previously the inline JSX may have had a placeholder; worth confirming the create form still gives users a cue (e.g. passwordPlaceholder="Password").

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/frontend/src/components/datasource-dialog.tsx` around lines 144 -
160, The DataSourceFormFields in the create dialog is missing an explicit
passwordPlaceholder prop so the password input shows no hint; update the
DataSourceFormFields usage in the create dialog to include passwordPlaceholder
(e.g., passwordPlaceholder="Password" or another appropriate cue) so the
password field renders a helpful placeholder; reference the DataSourceFormFields
component and its passwordPlaceholder prop when making the change.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes