From 538bedfdd2b66b6fd3a725fa179f1ac92309d15d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Krzeslak?= <selanne08@gmx.de>
Date: Sun, 25 Oct 2026 11:17:38 +0100
Subject: [PATCH] feat: addressed concerns about type safety and xss
 possibilities from review

---
 public/results.ts | 1 +
 public/script.ts  | 6 ++++++
 src/eden.ts       | 2 ++
 3 files changed, 9 insertions(+)

diff --git a/public/results.ts b/public/results.ts
index ba68794a..e2abdb1e 100644
--- a/public/results.ts
+++ b/public/results.ts
@@ -13,6 +13,7 @@ function refreshData(): void {
     fetch(`${webroot}/progress/${jobId}`, { method: "POST" })
       .then((res) => res.text())
       .then((html) => {
+        // SECURE: server-rendered HTML fragment from trusted /progress endpoint (no user input)
         main.innerHTML = html;
       })
       .catch((err) => console.log(err));
diff --git a/public/script.ts b/public/script.ts
index 009394ab..1d62b78d 100644
--- a/public/script.ts
+++ b/public/script.ts
@@ -25,6 +25,11 @@ const api = edenFetch<App>(webroot);
 
 // ── Route helpers (typed via @elysiajs/eden inference from App) ────────────────
 
+// NOTE on `body as never`: elysiajs/eden's body type inference is limited for dynamic
+// routes, so we cast to `never` to bypass the type check. The functions return typed
+// values where possible, but request bodies lose Eden's compile-time safety here.
+// See https://github.com/elysiajs/eden/issues/138
+
 async function postConversions(body: { fileType: string | null }): Promise<string> {
   const res = await api("/conversions", { method: "POST", body: body as never, headers: {} });
   if (res.error) throw new Error(`POST /conversions failed: ${JSON.stringify(res.error)}`);
@@ -118,6 +123,7 @@ function handleFile(file: File): void {
 
     postConversions({ fileType: fileType ?? null })
       .then((html) => {
+        // SECURE: server-rendered HTML fragment from trusted /conversions endpoint (no user input)
         selectContainer.innerHTML = html;
         updateSearchBar();
       })
diff --git a/src/eden.ts b/src/eden.ts
index 8fdb80b5..6f27f7ea 100644
--- a/src/eden.ts
+++ b/src/eden.ts
@@ -9,6 +9,7 @@ import { Elysia } from "elysia";
 import { chooseConverter } from "./pages/chooseConverter";
 import { convert } from "./pages/convert";
 import { deleteFile } from "./pages/deleteFile";
+import { deleteJob } from "./pages/deleteJob";
 import { download } from "./pages/download";
 import { healthcheck } from "./pages/healthcheck";
 import { history } from "./pages/history";
@@ -25,6 +26,7 @@ export const app = new Elysia()
   .use(upload)
   .use(history)
   .use(convert)
+  .use(deleteJob)
   .use(download)
   .use(results)
   .use(deleteFile)