PONGo_ios/CHANGELOG.md

# Changelog

## 2026-05-31 — Code-review pass + TLS parity

A multi-agent code review of the iOS app, the confirmed fixes applied, and the
self-signed TLS option removed for parity with the Android client. This entry is
written for cross-pollination: the two apps share REST behaviour and field paths
(see `MCMS_API.md`), so items below are grouped by how likely they apply to Android.

### 🔁 Check on Android — shared REST logic / behaviour

- **Pagination cursor must be the real `_id`, not a synthesized id.**
  `getAll` followed the `next` cursor using each model's `id`, which fell back to a
  random value when `_id` was absent → the cursor became meaningless and could
  re-serve or skip pages (silently wrong fleet list). Fixed to drive the cursor off
  the actual `_id` and stop paging when it's absent.
  → *Android:* if the paginator derives `next` from a model `id` that has any
  non-`_id` fallback, it has the same bug. Use the document `_id` (or stop).

- **Firmware image with empty compatibility metadata was shown as "compatible for
  every ONU."** `isCompatible` returned true when the image declared no
  `Compatible Manufacturer` / `Compatible Model`. For a destructive flash that
  invites pushing the wrong image. Now requires a positive model match; un-typed
  images appear only under the "Show all" escape hatch.
  → *Android:* mirror the same rule in the firmware picker's compatibility filter.

- **Per-ONU alarm filter may return the WHOLE fleet's alarms.** The ONU-detail
  Alarms tab filters the fleet-wide alarm-history endpoint with
  `query = {"_id": onuId}`, but that key is unverified — if it's wrong the server
  returns 200 with every ONU's alarms (no error). Left as-is (couldn't verify the
  key off a live box) with a loud in-code warning.
  → *Android:* same endpoint + key risk. Verify the real filter key against
  `openapi.json` / a live response, or use the dedicated per-id alarm endpoint.

- **Optical RX thresholds were inconsistent between screens.** Dashboard flagged
  abnormal at `< -28 || > -10` dBm; the detail row tinted green at `>= -28` but its
  footer legend said "green ≥ -30". Unified to one source of truth
  (`OpticalThreshold`: green floor -28, red floor -30, high -10) and corrected the
  legend.
  → *Android:* if it shows optical levels with color thresholds, align dashboard
  and detail to one constant and check the legend text matches the actual rule.

- **Dashboard best-effort sections went stale silently on a transient failure.**
  During the 30s auto-refresh, if the alarm-histories fetch failed, the
  alarm-by-severity counts kept the previous cycle's values while the dashboard
  still showed "loaded" (and controller count masked a failed fetch as `0`). Now
  keeps last-good explicitly and doesn't report a failed count as zero.
  → *Android:* if the dashboard auto-refreshes with best-effort sections, decide
  explicitly between keep-last-good and show-empty rather than whatever the control
  flow produces.

- **JSON number → Int coercion could crash on a malformed/huge value.** Swift's
  `Int(double)` traps on NaN/±∞/out-of-range; a JSON literal like `1e400` decodes
  to `∞` and crashed an accessor. Guarded to return nil.
  → *Android:* Kotlin's `Double.toInt()` won't trap the same way, but confirm
  out-of-range / NaN counters (FW Bank Ptr, DHCP lease seconds, util %, temps)
  don't yield garbage Ints in the equivalent accessors.

### 🔒 Security parity (the point of this round)

- **Removed the "Allow self-signed certificate" option entirely** — the
  `ServerTrustPolicy.allowSelfSignedForHost` case, the Settings toggle, and its
  wiring. The app now uses **system TLS trust only** (a code-only public-key pinning
  option remains, unused by the UI). Consequence: a self-signed appliance (e.g. the
  lab box `mcms.lab.svorka.net`) is unreachable until its CA is installed on the
  device (MDM/configuration profile) or the box gets a CA-trusted cert. This matches
  the Android client. Old persisted configs that stored the self-signed policy will
  fail to decode and reset to defaults (one-time; just re-enter the server URL).

- **Public-key pin was hashed over the raw key, not the SubjectPublicKeyInfo** —
  so a standard `openssl … pkey -pubin -outform der | dgst -sha256` pin never
  matched (pinning failed closed). Now prepends the algorithm-specific ASN.1 SPKI
  header and hashes the real SPKI.
  → *Android:* if it pins, OkHttp `CertificatePinner` already uses SPKI
  `sha256/…` — no change needed; just don't reintroduce a raw-key hash.

### ❓ Analogous patterns worth a look (not certain to apply)

- **Overlapping load / stale-commit races.** iOS view models let a pull-to-refresh
  overlap a tab-switch / auto-refresh load and commit stale or wrong-tab data; fixed
  with a per-load generation guard + cancellation check before committing.
  → *Android:* if `load()` / refresh use coroutines without single-flight or
  job-cancel, the same stale-commit / wrong-tab race can occur.

- **List-row identity fallback.** iOS list rows fell back to a random id when `_id`
  was missing, breaking diffing/scroll/animation.
  → *Android:* if DiffUtil keys fall back similarly, use a stable/content-derived
  key.

- **Networking client lifecycle.** iOS leaked a `URLSession` per connection/probe
  (created with a delegate, never invalidated).
  → *Android:* ensure OkHttp clients are shared/closed rather than created and
  dropped per connection test.

### 📱 iOS-only (listed for completeness; not relevant to Android)

- Swift closure type-inference build fix (annotate list-VM merge locals).
- `MongoDocument.id` SwiftUI identity specifics; SwiftUI `ForEach` keying.
- `Format` byte/bit-rate rounding rollover at the unit boundary.
- Dead-code, stale-docstring, and helper-dedup cleanups.