From b0329406817c7af51fd0b97a756ad2afaf0757bb Mon Sep 17 00:00:00 2001
From: Florian Zumpe <florian.zumpe@automateops.io>
Date: Sun, 27 Sep 2026 18:19:55 +0200
Subject: [PATCH] fix sonarqube findings

---
 public/js/editor-ui.js | 16 ++++++++++------
 test/editor-ui.test.js |  5 ++++-
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/public/js/editor-ui.js b/public/js/editor-ui.js
index 731bd88..f94979f 100644
--- a/public/js/editor-ui.js
+++ b/public/js/editor-ui.js
@@ -766,11 +766,14 @@ globalThis.Wegwichtel = globalThis.Wegwichtel || {};
   }
 
   function safeGpxFilename(name) {
-    const base = text(name || 'wegwichtel-route')
+    let base = text(name || 'wegwichtel-route')
       .normalize('NFKD')
-      .replaceAll(/[^a-zA-Z0-9_-]+/g, '-')
-      .replaceAll(/^-+|-+$/g, '')
-      .slice(0, 80);
+      .replaceAll(/[^a-zA-Z0-9_-]+/g, '-');
+
+    while (base.startsWith('-')) base = base.slice(1);
+    while (base.endsWith('-')) base = base.slice(0, -1);
+
+    base = base.slice(0, 80);
     return `${base || 'wegwichtel-route'}.gpx`;
   }
 
@@ -822,17 +825,18 @@ globalThis.Wegwichtel = globalThis.Wegwichtel || {};
       const orderedPois = [...(routePackage.pois || [])]
         .sort((left, right) => Number(left.sequence) - Number(right.sequence));
       for (const [index, poi] of orderedPois.entries()) {
+        const poiTitle = poi.title || `Station ${index + 1}`;
         const poiPayload = await sendJson(`/routes/${encodeURIComponent(createdRouteId)}/pois`, 'POST', {
           description: poi.description || '',
           lat: poi.lat,
           lon: poi.lon,
           sequence: index,
-          title: poi.title || `Station ${index + 1}`,
+          title: poiTitle,
           triggerRadiusM: poi.triggerRadiusM || 25
         });
         const serverPoi = poiPayload.poi || poiPayload;
         const serverPoiId = poiId(serverPoi);
-        if (!serverPoiId) throw new Error(`Für ${poi.title || `Station ${index + 1}`} wurde keine Server-POI-ID zurückgegeben.`);
+        if (!serverPoiId) throw new Error(`Für ${poiTitle} wurde keine Server-POI-ID zurückgegeben.`);
         await uploadLocalPoiMedia(createdRouteId, serverPoiId, poi);
       }
       return createdRouteId;
diff --git a/test/editor-ui.test.js b/test/editor-ui.test.js
index 6aacab4..0a37003 100644
--- a/test/editor-ui.test.js
+++ b/test/editor-ui.test.js
@@ -365,6 +365,7 @@ test('public editor workflow saves new route and GPX POI locally without POSTing
   assert.equal(local.pois[0].images.length, 1);
   assert.match(local.pois[0].images[0].dataUrl, /^data:image\/jpeg/);
 
+  elements.get('editor-route-name').value = '--- Neue lokale Strecke ---';
   elements.get('editor-route-upload').dispatchEvent(pointerEvent());
   await tick();
   await tick();
@@ -373,7 +374,9 @@ test('public editor workflow saves new route and GPX POI locally without POSTing
 
   const routeUpload = calls.find(call => call.method === 'POST' && call.url === '/api/routes');
   assert.ok(routeUpload);
-  assert.ok(routeUpload.body.entries.some(([name]) => name === 'gpx'));
+  const gpxUpload = routeUpload.body.entries.find(([name]) => name === 'gpx');
+  assert.ok(gpxUpload);
+  assert.equal(gpxUpload[2], 'Neue-lokale-Strecke.gpx');
   assert.ok(calls.some(call => call.method === 'POST' && call.url === '/api/routes/22/pois'));
   assert.ok(calls.some(call => call.method === 'POST' && call.url === '/api/routes/22/pois/23/audio'));
   assert.ok(calls.some(call => call.method === 'POST' && call.url === '/api/routes/22/pois/23/pictures'));