From 320f31086d0189b952f30cb782d08b345d6cd0d6 Mon Sep 17 00:00:00 2001
From: John O'Keefe <git@linuxhg.com>
Date: Tue, 13 Oct 2026 18:25:56 -0400
Subject: [PATCH] fix(web): field-mapping + fragile-hx-vals sweep across
 profile and library surfaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Field-by-field audit of the profile surface (set → save → reopen →
read back, driven through the emulator browser via CDP):

- getTemplateUserWithTheme (every SSR page + the /profile self-edit
  form) never mapped FirstName/LastName/CreatedAt — stored names
  rendered as empty inputs. Now mapped (timezone was already mapped).
- Admin profile-modal Timezone mapping fixed earlier this round held:
  all seven fields verified set → 200 + HX-Refresh → reopen → correct
  values, DB cross-checked.
- Role promote/demote via the card select verified against the DB (the
  PUT answers HX-Refresh, so the page reload shows the new role).
- Admin password reset verified end-to-end: new password logs in, old
  one 401s, original restored.
- admin_library folder-remove hx-vals was string-concatenated JSON —
  a folder path containing a quote or backslash made it invalid and
  the remove button silently died under htmx 2 (the same class as the
  profile-save bug). Now built with json.Marshal behind the js:
  prefix. Verified the generated attribute on the live page.
- Other hx-vals/hx-headers sites audited: constants and uuids only
  (safe charset), left alone.
---
 internal/router/helpers.go       | 17 ++++++++++-------
 templates/admin_library.templ    |  2 +-
 templates/admin_library_templ.go |  4 ++--
 templates/utils.go               | 11 +++++++++++
 4 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/internal/router/helpers.go b/internal/router/helpers.go
index 7eabf64d..9e463177 100644
--- a/internal/router/helpers.go
+++ b/internal/router/helpers.go
@@ -52,13 +52,16 @@ func getTemplateUserWithTheme(c *echo.Context, cfg *Config) (templates.User, err
 	}
 
 	return templates.User{
-		ID:       userID,
-		Email:    userEmail,
-		Username: userUsername,
-		Role:     userRole,
-		Theme:    userTheme,
-		Token:    token,
-		Timezone: userTimezone,
+		ID:        userID,
+		Email:     userEmail,
+		Username:  userUsername,
+		Role:      userRole,
+		Theme:     userTheme,
+		Token:     token,
+		Timezone:  userTimezone,
+		FirstName: getText(userDB.FirstName),
+		LastName:  getText(userDB.LastName),
+		CreatedAt: userDB.CreatedAt.Time,
 	}, nil
 }
 
diff --git a/templates/admin_library.templ b/templates/admin_library.templ
index ef9587cf..603812f1 100644
--- a/templates/admin_library.templ
+++ b/templates/admin_library.templ
@@ -307,7 +307,7 @@ templ LibraryPanel(user User, libraryID string, library LibraryData, folders []F
 							<button
 								class="icon-btn h-7 w-7 shrink-0"
 								hx-delete={ "/admin/library/" + libraryID + "/folders" }
-								hx-vals={ `{"folder_path": "` + folder.FolderPath + `"}` }
+								hx-vals={ hxValsFolderDelete(folder.FolderPath) }
 								hx-target={ "#library-panel-" + libraryID }
 								hx-swap="innerHTML"
 								hx-confirm="Remove this folder from the library?"
diff --git a/templates/admin_library_templ.go b/templates/admin_library_templ.go
index dd5c9027..60bbf24f 100644
--- a/templates/admin_library_templ.go
+++ b/templates/admin_library_templ.go
@@ -432,9 +432,9 @@ func LibraryPanel(user User, libraryID string, library LibraryData, folders []Fo
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var14 string
-				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(`{"folder_path": "` + folder.FolderPath + `"}`)
+				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(hxValsFolderDelete(folder.FolderPath))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 310, Col: 64}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `admin_library.templ`, Line: 310, Col: 55}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 				if templ_7745c5c3_Err != nil {
diff --git a/templates/utils.go b/templates/utils.go
index 7adf3b08..b745fa6d 100644
--- a/templates/utils.go
+++ b/templates/utils.go
@@ -339,3 +339,14 @@ func GroupTunableSettings(entries []SettingEntry) (live, restart []SettingGroup)
 	}
 	return liveGroups, restartGroups
 }
+
+// hxValsFolderDelete builds the hx-vals attribute for removing a library
+// folder: htmx 2 requires valid JSON (or a js: expression) — string
+// concatenation broke on paths containing quotes or backslashes.
+func hxValsFolderDelete(folderPath string) string {
+	b, err := json.Marshal(map[string]string{"folder_path": folderPath})
+	if err != nil {
+		return `js:{"folder_path": ""}`
+	}
+	return "js:" + string(b)
+}