From 295c447d582c5c6296dc9f3d6aba668ed78b6ce6 Mon Sep 17 00:00:00 2001
From: Thomas Hackner <thomas@hackner.dev>
Date: Tue, 14 Jul 2026 02:38:47 +0200
Subject: [PATCH] PDF-Export: /api/export monats/jahresbezogen gab 500
 (ungueltiges SQL)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Die gefilterten Export-Zweige bauten `SELECT * FROM (<subquery>) AND
strftime(...)` — ohne WHERE nach der abgeleiteten Tabelle. SQLite
quittierte das mit "near \"AND\": syntax error" => HTTP 500, der Client
erhielt {error:'Serverfehler'} statt des Bewerbungs-Arrays und
generatePdfDocument crashte mit "applications.map is not a function".

Fix: `AND` => `WHERE` in den drei gefilterten Zweigen (month+year,
month, year). Die Per-User-Isolation bleibt unberuehrt (user_id-Filter
steht weiterhin in der Subquery). Zusaetzlich prueft generatePDF jetzt
Array.isArray(applications) und zeigt eine klare Fehlermeldung statt
des .map-Crashs.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 public/js/main.js | 13 ++++++++++++-
 server.js         |  6 +++---
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/public/js/main.js b/public/js/main.js
index 2a01c9b..1cc7c08 100644
--- a/public/js/main.js
+++ b/public/js/main.js
@@ -223,10 +223,21 @@ function generatePDF(event) {
         fetch(url).then(res => res.json())
     ])
     .then(([_loaded, settings, applications]) => {
+        // /api/export returns an array of applications; on a server error it
+        // returns { error: '...' } instead. Guard so we surface a real message
+        // rather than crashing inside generatePdfDocument with "applications.map
+        // is not a function".
+        if (!Array.isArray(applications)) {
+            alert('Export fehlgeschlagen: ' + ((applications && applications.error) || 'Unbekannter Serverfehler'));
+            return;
+        }
         generatePdfDocument(settings, applications, month, year);
         hideModal(pdfExportModal);
     })
-    .catch(error => console.error('Error generating PDF:', error));
+    .catch(error => {
+        console.error('Error generating PDF:', error);
+        alert('Export fehlgeschlagen. Bitte erneut versuchen.');
+    });
 }
 
 // PDF Generation with jsPDF
diff --git a/server.js b/server.js
index de675b3..3b48acd 100644
--- a/server.js
+++ b/server.js
@@ -2048,15 +2048,15 @@ initializeDatabase().then(async () => {
       const params = [U, U];
 
       if (month && year) {
-        query = `SELECT * FROM (${base}) AND strftime("%m", eff_datum) = ? AND strftime("%Y", eff_datum) = ? ORDER BY eff_datum DESC`;
+        query = `SELECT * FROM (${base}) WHERE strftime("%m", eff_datum) = ? AND strftime("%Y", eff_datum) = ? ORDER BY eff_datum DESC`;
         params.push(month.padStart(2, '0'), year);
       } else if (month) {
         // A month without a year must still restrict the export to that month —
         // never fall through to exporting every application.
-        query = `SELECT * FROM (${base}) AND strftime("%m", eff_datum) = ? ORDER BY eff_datum DESC`;
+        query = `SELECT * FROM (${base}) WHERE strftime("%m", eff_datum) = ? ORDER BY eff_datum DESC`;
         params.push(month.padStart(2, '0'));
       } else if (year) {
-        query = `SELECT * FROM (${base}) AND strftime("%Y", eff_datum) = ? ORDER BY eff_datum DESC`;
+        query = `SELECT * FROM (${base}) WHERE strftime("%Y", eff_datum) = ? ORDER BY eff_datum DESC`;
         params.push(year);
       }