From 69c8d80ef238b9ba4ee153a3bbe5f1c2660a317b Mon Sep 17 00:00:00 2001
From: aewing <aewing@cardoza.construction>
Date: Sun, 29 Mar 2026 03:16:07 +0000
Subject: [PATCH] Harden Tasgird user task lookup

---
 server.ts  | 23 ++++++++++++++++++++++-
 tasks.html |  9 +++++++--
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/server.ts b/server.ts
index 92815e4..4c985a7 100644
--- a/server.ts
+++ b/server.ts
@@ -559,6 +559,23 @@ app.get('/api/tasks/list', async (c) => {
         return matched.map((user: any) => String(user.id || '').trim()).filter(Boolean);
       }
 
+      try {
+        const allUsers = await taskPb.collection(PB_AUTH_COLLECTION).getFullList({
+          fields: 'id,name,email,username',
+        });
+        const lowerTarget = target.toLowerCase();
+        const fuzzy = allUsers.filter((user: any) => {
+          const values = [user?.name, user?.username, user?.email]
+            .map((value) => String(value || '').trim().toLowerCase())
+            .filter(Boolean);
+          return values.includes(lowerTarget);
+        });
+        if (fuzzy.length) {
+          return fuzzy.map((user: any) => String(user.id || '').trim()).filter(Boolean);
+        }
+      } catch {
+      }
+
       if (meId && target === meName) {
         return [meId];
       }
@@ -572,7 +589,11 @@ app.get('/api/tasks/list', async (c) => {
     let effectiveUserName = targetUserName;
     try {
       if (targetUserName) {
-        const targetUserIds = await resolveUserIdsByName(targetUserName);
+        const targetUserIds = Array.from(new Set([
+          ...(await resolveUserIdsByName(targetUserName)),
+          ...(requestedUserId ? [requestedUserId] : []),
+          ...(meId && targetUserName === meName ? [meId] : []),
+        ].map((id) => String(id || '').trim()).filter(Boolean)));
         if (!targetUserIds.length) {
           warning = `No Users record matched name "${targetUserName}".`;
           records = [];
diff --git a/tasks.html b/tasks.html
index 1011da7..bda1f51 100644
--- a/tasks.html
+++ b/tasks.html
@@ -374,8 +374,13 @@
       await ensurePocketBaseClient();
       const token = getCurrentToken();
       const userName = String(taskUserSelect.value || '').trim();
-      const url = userName
-        ? `/api/tasks/list?userName=${encodeURIComponent(userName)}`
+      const selectedOption = taskUserSelect.selectedOptions?.[0] || null;
+      const userId = String(selectedOption?.dataset?.userId || '').trim();
+      const query = new URLSearchParams();
+      if (userName) query.set('userName', userName);
+      if (userId) query.set('userId', userId);
+      const url = query.toString()
+        ? `/api/tasks/list?${query.toString()}`
         : '/api/tasks/list';
       const resp = await fetch(url, {
         headers: { 'x-pb-token': token },