From 4616798d34b7f1dc7094208ab2bf540532cc5f4d Mon Sep 17 00:00:00 2001
From: Till JS <tills95@gmail.com>
Date: Sun, 12 Apr 2026 20:57:46 +0200
Subject: [PATCH] fix(calc): use safe evaluate engine in ListView, add error
 logging

The workbench ListView was using Function() (effectively eval) with
aggressive sanitizing that stripped valid characters, causing every
calculation to fail with a generic "Fehler". Now uses the same safe
parser as the standard calculator page. Also adds console.error
logging and shows result before persisting to DB.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../web/src/lib/modules/calc/ListView.svelte  | 29 ++++++++-----------
 .../routes/(app)/calc/standard/+page.svelte   | 11 +++----
 2 files changed, 18 insertions(+), 22 deletions(-)

diff --git a/apps/mana/apps/web/src/lib/modules/calc/ListView.svelte b/apps/mana/apps/web/src/lib/modules/calc/ListView.svelte
index a4bce551d..556ed5de5 100644
--- a/apps/mana/apps/web/src/lib/modules/calc/ListView.svelte
+++ b/apps/mana/apps/web/src/lib/modules/calc/ListView.svelte
@@ -5,6 +5,7 @@
 <script lang="ts">
 	import { useLiveQueryWithDefault } from '@mana/local-store/svelte';
 	import { db } from '$lib/data/database';
+	import { evaluate as evalExpression, formatResult } from './engine/evaluate';
 	import type { LocalCalculation } from './types';
 
 	const calcQuery = useLiveQueryWithDefault(async () => {
@@ -32,37 +33,31 @@
 			return;
 		}
 		try {
-			const sanitized = expression.replace(/[^0-9+\-*/().%\s]/g, '');
-			const evalResult = Function('"use strict"; return (' + sanitized + ')')();
-			if (evalResult === undefined || evalResult === null || isNaN(evalResult)) {
-				result = expression;
-				hasError = false;
-			} else {
-				result = String(evalResult);
-				hasError = false;
-			}
+			const num = evalExpression(expression);
+			result = formatResult(num);
+			hasError = false;
 		} catch {
 			// Incomplete expression — don't show error while typing
 			hasError = false;
 		}
 	});
 
-	function evaluate() {
+	function calc() {
 		if (!expression.trim()) return;
 		try {
-			const sanitized = expression.replace(/[^0-9+\-*/().%\s]/g, '');
-			const evalResult = Function('"use strict"; return (' + sanitized + ')')();
-			result = String(evalResult);
+			const num = evalExpression(expression);
+			result = formatResult(num);
 			hasError = false;
-		} catch {
-			result = 'Fehler';
+		} catch (e) {
+			console.error('[calc] ListView error:', e);
+			result = e instanceof Error ? e.message : 'Fehler';
 			hasError = true;
 		}
 	}
 
 	function press(key: string) {
 		if (key === '=') {
-			evaluate();
+			calc();
 		} else if (key === 'C') {
 			expression = '';
 			result = '0';
@@ -77,7 +72,7 @@
 	function handleKeydown(e: KeyboardEvent) {
 		if (e.key === 'Enter') {
 			e.preventDefault();
-			evaluate();
+			calc();
 		}
 	}
 
diff --git a/apps/mana/apps/web/src/routes/(app)/calc/standard/+page.svelte b/apps/mana/apps/web/src/routes/(app)/calc/standard/+page.svelte
index d2106087d..94f475d63 100644
--- a/apps/mana/apps/web/src/routes/(app)/calc/standard/+page.svelte
+++ b/apps/mana/apps/web/src/routes/(app)/calc/standard/+page.svelte
@@ -86,18 +86,19 @@
 			const result = evaluate(expression);
 			const formatted = formatResult(result);
 
+			display = formatted;
+			hasResult = true;
+			error = '';
+
 			await calculationsStore.addCalculation({
 				mode: 'standard',
 				expression: expression,
 				result: formatted,
 				skin: activeSkin,
 			});
-
-			display = formatted;
-			hasResult = true;
-			error = '';
 		} catch (e) {
-			error = e instanceof Error ? e.message : 'Fehler';
+			console.error('[calc] Fehler bei Berechnung:', e);
+			error = e instanceof Error ? e.message : String(e);
 		}
 	}