fix(tools): OR'ed where clauses now AND'd so search excludes soft-deleted tools; localize delete confirm dialog

artifacts/api-server/src/routes/auth.ts

@@ -293,7 +293,7 @@ router.get("/auth/password-redirect", async (req, res): Promise<void> => {
 
 const ChangePasswordSchema = z.object({
   currentPassword: z.string().min(1),
-  newPassword: z.string().min(8),
+  newPassword: z.string().min(6),
 });
 
 router.post("/auth/me/password", passwordRateLimit, async (req, res): Promise<void> => {

artifacts/api-server/src/routes/tools.ts

@@ -1,5 +1,5 @@
 import { Router, type IRouter } from "express";
-import { eq, desc, asc, sql, and, not, isNull, inArray } from "drizzle-orm";
+import { eq, desc, asc, sql, and, not, isNull, inArray, type SQL } from "drizzle-orm";
 import { z } from "zod";
 import { db, toolsTable, ratingsTable, toolRelationsTable } from "@workspace/db";
 import {
@@ -57,21 +57,23 @@ router.get("/tools", async (req, res): Promise<void> => {
   const tagList = (tags ?? "").split(",").map((t) => t.trim()).filter(Boolean);
   const featureList = (features ?? "").split(",").map((f) => f.trim()).filter(Boolean);
 
-  let query = db.select().from(toolsTable).where(isNull(toolsTable.deletedAt)).$dynamic();
+  const conditions: SQL[] = [isNull(toolsTable.deletedAt)];
   if (category) {
-    query = query.where(eq(toolsTable.category, category));
+    conditions.push(eq(toolsTable.category, category));
   }
   if (search) {
     const escaped = search.replace(/[%_\\]/g, (m) => `\\${m}`);
-    query = query.where(sql`${toolsTable.name} ilike ${`%${escaped}%`} escape '\\'`);
+    conditions.push(sql`${toolsTable.name} ilike ${`%${escaped}%`} escape '\\'`);
   }
   if (tagList.length > 0) {
-    query = query.where(sql`${toolsTable.tags} @> ARRAY[${sql.join(tagList.map((t) => sql`${t}`), sql`, `)}]::text[]`);
+    conditions.push(sql`${toolsTable.tags} @> ARRAY[${sql.join(tagList.map((t) => sql`${t}`), sql`, `)}]::text[]`);
   }
   if (featureList.length > 0) {
-    query = query.where(sql`${toolsTable.features} @> ARRAY[${sql.join(featureList.map((f) => sql`${f}`), sql`, `)}]::text[]`);
+    conditions.push(sql`${toolsTable.features} @> ARRAY[${sql.join(featureList.map((f) => sql`${f}`), sql`, `)}]::text[]`);
   }
 
+  const query = db.select().from(toolsTable).where(and(...conditions));
+
   const tools = await query.orderBy(desc(toolsTable.createdAt));
 
   const toolIds = tools.map((t) => t.id);

artifacts/api-server/src/routes/users.ts

@@ -25,7 +25,7 @@ const UserUpdateSchema = z.object({
 });
 
 const SetPasswordSchema = z.object({
-  password: z.string().min(8),
+  password: z.string().min(6),
 });
 
 router.patch("/users/:id/password", requireAdmin, passwordRateLimit, async (req, res): Promise<void> => {

artifacts/toolrate/src/components/password-input.tsx

@@ -0,0 +1,25 @@
+import { useState } from "react";
+import { Eye, EyeOff } from "lucide-react";
+import { Input } from "@/components/ui/input";
+import { cn } from "@/lib/utils";
+
+export function PasswordInput({
+  className,
+  ...props
+}: Omit<React.ComponentProps<"input">, "type">) {
+  const [visible, setVisible] = useState(false);
+  return (
+    <div className={cn("relative", className)}>
+      <Input type={visible ? "text" : "password"} className="pr-9" {...props} />
+      <button
+        type="button"
+        onClick={() => setVisible((v) => !v)}
+        className="absolute right-0 top-0 flex h-9 w-9 items-center justify-center text-muted-foreground hover:text-foreground"
+        aria-label={visible ? "Hide password" : "Show password"}
+        tabIndex={-1}
+      >
+        {visible ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
+      </button>
+    </div>
+  );
+}

artifacts/toolrate/src/components/user-menu.tsx

@@ -15,8 +15,8 @@ import {
   DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogFooter } from "@/components/ui/dialog";
-import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { PasswordInput } from "@/components/password-input";
 import { useToast } from "@/hooks/use-toast";
 import { useChangeMyPassword, useGetPasswordRedirect, getGetPasswordRedirectQueryKey } from "@workspace/api-client-react";
 import { useQueryClient } from "@tanstack/react-query";
@@ -182,8 +182,7 @@ export function UserMenu() {
           <div className="space-y-4 py-2">
             <div className="space-y-2">
               <Label>{t("auth.currentPassword")}</Label>
-              <Input
-                type="password"
+              <PasswordInput
                 value={currentPassword}
                 onChange={(e) => setCurrentPassword(e.target.value)}
                 data-testid="input-current-password"
@@ -191,18 +190,16 @@ export function UserMenu() {
             </div>
             <div className="space-y-2">
               <Label>{t("auth.newPassword")}</Label>
-              <Input
-                type="password"
+              <PasswordInput
                 value={newPassword}
                 onChange={(e) => setNewPassword(e.target.value)}
-                placeholder="min. 8 characters"
+                placeholder="min. 6 characters"
                 data-testid="input-new-password"
               />
             </div>
             <div className="space-y-2">
               <Label>{t("auth.confirmPassword")}</Label>
-              <Input
-                type="password"
+              <PasswordInput
                 value={confirmPassword}
                 onChange={(e) => setConfirmPassword(e.target.value)}
                 data-testid="input-confirm-password"
@@ -219,7 +216,7 @@ export function UserMenu() {
                   toast({ title: t("auth.pwMismatch"), variant: "destructive" });
                   return;
                 }
-                if (newPassword.length < 8) {
+                if (newPassword.length < 6) {
                   toast({ title: t("auth.pwTooShort"), variant: "destructive" });
                   return;
                 }

artifacts/toolrate/src/i18n/locales/de.json

@@ -127,7 +127,12 @@
     "relatedTools": "Ähnliche Tools",
     "costs": "Kosten",
     "addCost": "Kosten hinzufügen",
-    "recentRatings": "Letzte Bewertungen"
+    "recentRatings": "Letzte Bewertungen",
+    "deleteConfirmTitle": "Dieses Tool löschen?",
+    "deleteToTrash": "Dies verschiebt {{name}} in den Papierkorb. Es kann später wiederhergestellt werden.",
+    "deletePermanent": "Dies entfernt {{name}} dauerhaft inklusive aller Bewertungen. Das kann nicht rückgängig gemacht werden.",
+    "deleting": "Löschen…",
+    "deleteAction": "Löschen"
   },
   "compare": {
     "title": "Tools vergleichen",

artifacts/toolrate/src/i18n/locales/en.json

@@ -127,7 +127,12 @@
     "relatedTools": "Related Tools",
     "costs": "Costs",
     "addCost": "Add Cost",
-    "recentRatings": "Recent Ratings"
+    "recentRatings": "Recent Ratings",
+    "deleteConfirmTitle": "Delete this tool?",
+    "deleteToTrash": "This will move {{name}} to the trash. It can be restored later.",
+    "deletePermanent": "This will permanently remove {{name}} and all its ratings. This cannot be undone.",
+    "deleting": "Deleting…",
+    "deleteAction": "Delete"
   },
   "compare": {
     "title": "Compare Tools",

artifacts/toolrate/src/pages/admin.tsx

@@ -17,6 +17,7 @@ import { useAuth } from "@/hooks/use-auth";
 import { Layout } from "@/components/layout";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
+import { PasswordInput } from "@/components/password-input";
 import { Label } from "@/components/ui/label";
 import { Badge } from "@/components/ui/badge";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
@@ -115,8 +116,8 @@ export default function Admin() {
 
   const handleSetUserPassword = () => {
     if (!editUser || !editPassword) return;
-    if (editPassword.length < 8) {
-      toast({ title: "Password too short", description: "Minimum 8 characters.", variant: "destructive" });
+    if (editPassword.length < 6) {
+      toast({ title: "Password too short", description: "Minimum 6 characters.", variant: "destructive" });
       return;
     }
     setUserPassword.mutate(
@@ -367,7 +368,7 @@ export default function Admin() {
             </div>
             <div className="space-y-2">
               <Label>Password</Label>
-              <Input type="password" value={newPassword} onChange={(e) => setNewPassword(e.target.value)} placeholder="min. 6 characters" />
+              <PasswordInput value={newPassword} onChange={(e) => setNewPassword(e.target.value)} placeholder="min. 6 characters" />
             </div>
             <div className="space-y-2">
               <Label>Email (Optional)</Label>
@@ -448,11 +449,10 @@ export default function Admin() {
             {editUser?.authProvider !== "oidc" ? (
               <div className="space-y-2 border-t pt-4">
                 <Label>Set Password</Label>
-                <Input
-                  type="password"
+                <PasswordInput
                   value={editPassword}
                   onChange={(e) => setEditPassword(e.target.value)}
-                  placeholder="min. 8 characters"
+                  placeholder="min. 6 characters"
                   data-testid="input-set-password"
                 />
                 <p className="text-xs text-muted-foreground">Resets the user's password immediately.</p>

artifacts/toolrate/src/pages/login.tsx

@@ -5,6 +5,7 @@ import { useQueryClient } from "@tanstack/react-query";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { PasswordInput } from "@/components/password-input";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 import { ThemeToggle } from "@/components/theme-toggle";
 import { Wrench, AlertCircle } from "lucide-react";
@@ -76,9 +77,8 @@ export default function Login() {
               </div>
               <div className="space-y-2">
                 <Label htmlFor="password">{t("auth.password")}</Label>
-                <Input
+                <PasswordInput
                   id="password"
-                  type="password"
                   value={password}
                   onChange={(e) => setPassword(e.target.value)}
                   required

artifacts/toolrate/src/pages/tool-detail.tsx

@@ -914,23 +914,23 @@ export default function ToolDetail() {
     <AlertDialog open={deleteOpen} onOpenChange={setDeleteOpen}>
       <AlertDialogContent>
         <AlertDialogHeader>
-          <AlertDialogTitle>Delete this tool?</AlertDialogTitle>
+          <AlertDialogTitle>{t("detail.deleteConfirmTitle")}</AlertDialogTitle>
           <AlertDialogDescription>
             {hasTrash ? (
-              <>This will move <span className="font-medium">{tool?.name}</span> to the trash. It can be restored later.</>
+              <>{t("detail.deleteToTrash", { name: tool?.name })}</>
             ) : (
-              <>This will permanently remove <span className="font-medium">{tool?.name}</span> and all its ratings. This cannot be undone.</>
+              <>{t("detail.deletePermanent", { name: tool?.name })}</>
             )}
           </AlertDialogDescription>
         </AlertDialogHeader>
         <AlertDialogFooter>
-          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogCancel>{t("common.cancel")}</AlertDialogCancel>
           <AlertDialogAction
             className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
             onClick={handleDelete}
             disabled={deleteTool.isPending}
           >
-            {deleteTool.isPending ? "Deleting…" : "Delete"}
+            {deleteTool.isPending ? t("detail.deleting") : t("detail.deleteAction")}
           </AlertDialogAction>
         </AlertDialogFooter>
       </AlertDialogContent>

lib/api-client-react/src/generated/api.schemas.ts

@@ -123,12 +123,12 @@ export interface UserRoleUpdate {
 export interface ChangePasswordInput {
   /** @minLength 1 */
   currentPassword: string;
-  /** @minLength 8 */
+  /** @minLength 6 */
   newPassword: string;
 }
 
 export interface SetPasswordInput {
-  /** @minLength 8 */
+  /** @minLength 6 */
   password: string;
 }
 

lib/api-spec/openapi.yaml

@@ -1013,7 +1013,7 @@ components:
           minLength: 1
         newPassword:
           type: string
-          minLength: 8
+          minLength: 6
 
     SetPasswordInput:
       type: object
@@ -1021,7 +1021,7 @@ components:
       properties:
         password:
           type: string
-          minLength: 8
+          minLength: 6
 
     PasswordRedirect:
       type: object

lib/api-zod/src/generated/api.ts

@@ -484,7 +484,7 @@ export const GetMeResponse = zod.object({
  * @summary Change own password (local users only)
  */
 
-export const changeMyPasswordBodyNewPasswordMin = 8;
+export const changeMyPasswordBodyNewPasswordMin = 6;
 
 
 
@@ -626,7 +626,7 @@ export const SetUserPasswordParams = zod.object({
   "id": zod.coerce.number()
 })
 
-export const setUserPasswordBodyPasswordMin = 8;
+export const setUserPasswordBodyPasswordMin = 6;
 
 
 

lib/api-zod/src/generated/types/changePasswordInput.ts

@@ -9,6 +9,6 @@
 export interface ChangePasswordInput {
   /** @minLength 1 */
   currentPassword: string;
-  /** @minLength 8 */
+  /** @minLength 6 */
   newPassword: string;
 }

lib/api-zod/src/generated/types/setPasswordInput.ts

@@ -7,6 +7,6 @@
  */
 
 export interface SetPasswordInput {
-  /** @minLength 8 */
+  /** @minLength 6 */
   password: string;
 }