refactor: address architectural review findings across stack

- db: unify event SP aliases (EventType_Name, Vote_Count) with additive backwards-compatible duplicates for zero-downtime rollout
- backend: self-only guard on GET /users/{id}; unify AuthController error shape via typed exceptions; remove .Result after Task.WhenAll in GeoController; rename WebApplication1.Options namespace to GroundShareAPI.Options
- frontend: align EventVoteResult with server aliases; replace swallowed .catch(() => {}) with structured console.warn logging in AddressSearchMain, NearbyReportsScreen, EventCard

Author: Yuval

01-Database/GroundShareDB.sql

@@ -485,8 +485,10 @@ AS
 BEGIN
     SET NOCOUNT ON;
     SELECT e.Event_ID, e.Description, e.EventStatus, e.Start_Date, e.End_Date, e.Picture, e.Created_At,
+           et.Name AS EventType_Name,
            et.Name AS EventType,
            u.Full_Name AS Author,
+           ISNULL((SELECT SUM(Vote) FROM event_vote WHERE Event_ID = e.Event_ID), 0) AS Vote_Count,
            ISNULL((SELECT SUM(Vote) FROM event_vote WHERE Event_ID = e.Event_ID), 0) AS VoteCount
     FROM event e
     INNER JOIN event_type et ON e.EventType_ID = et.EventType_ID
@@ -572,8 +574,10 @@ BEGIN
         END
     END
 
-    -- Return new total
-    SELECT ISNULL(SUM(Vote), 0) AS VoteCount FROM event_vote WHERE Event_ID = @Event_ID;
+    -- Return new total (both aliases during additive migration)
+    SELECT ISNULL(SUM(Vote), 0) AS Vote_Count,
+           ISNULL(SUM(Vote), 0) AS VoteCount
+    FROM event_vote WHERE Event_ID = @Event_ID;
 END
 GO
 

02-Server/Controllers/AuthController.cs

@@ -21,7 +21,7 @@
 using System.Text.RegularExpressions;
 using Google.Apis.Auth;
 using Microsoft.Extensions.Options;
-using WebApplication1.Options;
+using GroundShareAPI.Options;
 
 namespace GroundShareAPI.Controllers
 {
@@ -75,39 +75,42 @@ public async Task<IActionResult> Register([FromBody] RegisterRequest request)
             var streetName = Sanitize(request.Street_Name);
             var houseNumber = Sanitize(request.House_Number);
 
-            // --- Email validation ---
+            // Validation errors flow through ExceptionHandlingMiddleware so the
+            // client sees one ApiResponse<object> shape for every failure.
+            var fieldErrors = new Dictionary<string, string>();
+
             if (string.IsNullOrEmpty(email))
-                return BadRequest(new { field = "email", message = "כתובת מייל היא שדה חובה" });
-            if (email.Length > 254)
-                return BadRequest(new { field = "email", message = "כתובת מייל ארוכה מדי" });
-            if (!EmailRegex.IsMatch(email))
-                return BadRequest(new { field = "email", message = "כתובת מייל לא תקינה" });
+                fieldErrors["email"] = "כתובת מייל היא שדה חובה";
+            else if (email.Length > 254)
+                fieldErrors["email"] = "כתובת מייל ארוכה מדי";
+            else if (!EmailRegex.IsMatch(email))
+                fieldErrors["email"] = "כתובת מייל לא תקינה";
 
-            // --- Password validation ---
             if (string.IsNullOrEmpty(password))
-                return BadRequest(new { field = "password", message = "סיסמה היא שדה חובה" });
-            if (password.Length < 8)
-                return BadRequest(new { field = "password", message = "הסיסמה חייבת להכיל לפחות 8 תווים" });
-            if (password.Length > 128)
-                return BadRequest(new { field = "password", message = "הסיסמה ארוכה מדי (מקסימום 128 תווים)" });
-            if (!password.Any(char.IsUpper))
-                return BadRequest(new { field = "password", message = "הסיסמה חייבת לכלול לפחות אות גדולה באנגלית" });
-            if (!password.Any(char.IsLower))
-                return BadRequest(new { field = "password", message = "הסיסמה חייבת לכלול לפחות אות קטנה באנגלית" });
-            if (!password.Any(char.IsDigit))
-                return BadRequest(new { field = "password", message = "הסיסמה חייבת לכלול לפחות ספרה אחת" });
-
-            // --- Full name validation ---
+                fieldErrors["password"] = "סיסמה היא שדה חובה";
+            else if (password.Length < 8)
+                fieldErrors["password"] = "הסיסמה חייבת להכיל לפחות 8 תווים";
+            else if (password.Length > 128)
+                fieldErrors["password"] = "הסיסמה ארוכה מדי (מקסימום 128 תווים)";
+            else if (!password.Any(char.IsUpper))
+                fieldErrors["password"] = "הסיסמה חייבת לכלול לפחות אות גדולה באנגלית";
+            else if (!password.Any(char.IsLower))
+                fieldErrors["password"] = "הסיסמה חייבת לכלול לפחות אות קטנה באנגלית";
+            else if (!password.Any(char.IsDigit))
+                fieldErrors["password"] = "הסיסמה חייבת לכלול לפחות ספרה אחת";
+
             if (string.IsNullOrEmpty(fullName))
-                return BadRequest(new { field = "fullName", message = "שם מלא הוא שדה חובה" });
-            if (fullName.Length < 2)
-                return BadRequest(new { field = "fullName", message = "שם חייב להכיל לפחות 2 תווים" });
-            if (fullName.Length > 50)
-                return BadRequest(new { field = "fullName", message = "שם ארוך מדי (מקסימום 50 תווים)" });
+                fieldErrors["fullName"] = "שם מלא הוא שדה חובה";
+            else if (fullName.Length < 2)
+                fieldErrors["fullName"] = "שם חייב להכיל לפחות 2 תווים";
+            else if (fullName.Length > 50)
+                fieldErrors["fullName"] = "שם ארוך מדי (מקסימום 50 תווים)";
 
-            // --- Phone validation (optional) ---
             if (!string.IsNullOrEmpty(phone) && !PhoneRegex.IsMatch(phone))
-                return BadRequest(new { field = "phone", message = "מספר טלפון לא תקין" });
+                fieldErrors["phone"] = "מספר טלפון לא תקין";
+
+            if (fieldErrors.Count > 0)
+                throw new Exceptions.ValidationException("נתוני הרשמה אינם תקינים", fieldErrors);
 
             try
             {
@@ -121,7 +124,7 @@ public async Task<IActionResult> Register([FromBody] RegisterRequest request)
                     string.IsNullOrEmpty(houseNumber) ? null : houseNumber);
 
                 if (userRow == null)
-                    return StatusCode(500, new { message = "שגיאה בהרשמה" });
+                    throw new InvalidOperationException("User row was null after successful register.");
 
                 int userId = Convert.ToInt32(userRow["User_ID"]);
                 string accessToken = GenerateAccessToken(userId, email);
@@ -151,7 +154,7 @@ public async Task<IActionResult> Register([FromBody] RegisterRequest request)
         public async Task<IActionResult> Login([FromBody] LoginRequest request)
         {
             if (string.IsNullOrWhiteSpace(request.Email) || string.IsNullOrWhiteSpace(request.Password))
-                return BadRequest(new { message = "Email and password are required." });
+                throw new Exceptions.ValidationException("Email and password are required.");
 
             var userRow = await _usersDal.GetUserByEmailRawAsync(request.Email);
 
@@ -174,7 +177,7 @@ public async Task<IActionResult> Login([FromBody] LoginRequest request)
             {
                 await _audit.LogAsync(null, "LOGIN_FAILURE", ClientIp, ClientUserAgent,
                     JsonSerializer.Serialize(new { email = request.Email }));
-                return Unauthorized(new { message = "אימות נכשל" });
+                throw new UnauthorizedException("אימות נכשל");
             }
 
             int userId = Convert.ToInt32(userRow["User_ID"]);
@@ -202,7 +205,7 @@ await _audit.LogAsync(null, "LOGIN_FAILURE", ClientIp, ClientUserAgent,
         public async Task<IActionResult> GoogleSignIn([FromBody] GoogleSignInRequest request)
         {
             if (string.IsNullOrWhiteSpace(request?.IdToken))
-                return BadRequest(new { message = "Missing Google credential." });
+                throw new Exceptions.ValidationException("Missing Google credential.");
 
             // -----------------------------------------------------------------
             // Verify the ID token using Google's official library.
@@ -227,65 +230,58 @@ public async Task<IActionResult> GoogleSignIn([FromBody] GoogleSignInRequest req
                     });
 
                 if (!payload.EmailVerified)
-                    return Unauthorized(new { message = "Google email is not verified." });
+                    throw new UnauthorizedException("Google email is not verified.");
 
                 email = payload.Email ?? "";
                 fullName = payload.Name ?? payload.GivenName ?? email.Split('@')[0];
 
                 if (string.IsNullOrWhiteSpace(email))
-                    return Unauthorized(new { message = "Google token missing email." });
+                    throw new UnauthorizedException("Google token missing email.");
             }
             catch (InvalidJwtException)
             {
-                return Unauthorized(new { message = "Invalid Google token." });
+                throw new UnauthorizedException("Invalid Google token.");
             }
 
             email = Sanitize(email).ToLowerInvariant();
             fullName = Sanitize(fullName);
             if (fullName.Length > 50) fullName = fullName.Substring(0, 50);
             if (string.IsNullOrWhiteSpace(fullName)) fullName = email.Split('@')[0];
 
-            try
-            {
-                var userRow = await _socialAuthDal.UpsertGoogleUserAsync(email, fullName);
-                if (userRow == null)
-                    return StatusCode(500, new { message = "Failed to create or load user." });
+            var userRow = await _socialAuthDal.UpsertGoogleUserAsync(email, fullName);
+            if (userRow == null)
+                throw new InvalidOperationException("Failed to create or load Google user.");
 
-                int userId = Convert.ToInt32(userRow["User_ID"]);
-                string accessToken = GenerateAccessToken(userId, email);
-                string refreshToken = GenerateRefreshToken();
+            int userId = Convert.ToInt32(userRow["User_ID"]);
+            string accessToken = GenerateAccessToken(userId, email);
+            string refreshToken = GenerateRefreshToken();
 
-                await _refreshTokenDal.SaveTokenAsync(userId, refreshToken, DateTime.UtcNow.AddDays(7));
-                await _audit.LogAsync(userId, "GOOGLE_SIGNIN", ClientIp, ClientUserAgent);
+            await _refreshTokenDal.SaveTokenAsync(userId, refreshToken, DateTime.UtcNow.AddDays(7));
+            await _audit.LogAsync(userId, "GOOGLE_SIGNIN", ClientIp, ClientUserAgent);
 
-                return Ok(new
-                {
-                    accessToken,
-                    refreshToken,
-                    user = userRow
-                });
-            }
-            catch (Exception)
+            return Ok(new
             {
-                return StatusCode(500, new { message = "An error occurred during Google sign-in." });
-            }
+                accessToken,
+                refreshToken,
+                user = userRow
+            });
         }
 
         [HttpPost("refresh")]
         [EnableRateLimiting("auth-refresh")]
         public async Task<IActionResult> Refresh([FromBody] RefreshRequest request)
         {
             if (string.IsNullOrWhiteSpace(request.RefreshToken))
-                return BadRequest(new { message = "Refresh token is required." });
+                throw new Exceptions.ValidationException("Refresh token is required.");
 
             var tokenRow = await _refreshTokenDal.GetTokenAsync(request.RefreshToken);
 
             if (tokenRow == null)
-                return Unauthorized(new { message = "Invalid refresh token." });
+                throw new UnauthorizedException("Invalid refresh token.");
 
             var expiresAt = Convert.ToDateTime(tokenRow["Expires_At"]);
             if (expiresAt < DateTime.UtcNow)
-                return Unauthorized(new { message = "Refresh token expired." });
+                throw new UnauthorizedException("Refresh token expired.");
 
             // Revoke old token
             await _refreshTokenDal.RevokeTokenAsync(request.RefreshToken);
@@ -295,7 +291,7 @@ public async Task<IActionResult> Refresh([FromBody] RefreshRequest request)
             // Get user data
             var userRow = await _usersDal.GetUserByIdAsync(userId);
             if (userRow == null)
-                return Unauthorized(new { message = "User not found." });
+                throw new UnauthorizedException("User not found.");
 
             string email = userRow["Email"]?.ToString() ?? "";
             string newAccessToken = GenerateAccessToken(userId, email);

02-Server/Controllers/EventsController.cs

@@ -59,7 +59,7 @@ public async Task<IActionResult> Vote(int eventId, [FromBody] VoteRequest reques
         {
             int userId = GetUserId();
             int newCount = await _eventService.VoteOnEventAsync(userId, eventId, request.Vote);
-            return Ok(new { VoteCount = newCount });
+            return Ok(new { Vote_Count = newCount, VoteCount = newCount });
         }
 
         [HttpGet("{eventId}/comments")]

02-Server/Controllers/GeoController.cs

@@ -200,16 +200,17 @@ public async Task<IActionResult> GetPlanningStatus([FromQuery] double lat, [From
 
             await Task.WhenAll(tasks.Values);
 
-            // Parse results
-            var constructionSites = ParseFeatures(tasks["499"].Result);
-            var permits = ParseFeatures(tasks["772"].Result);
-            var nightWorkConstruction = ParseFeatures(tasks["479"].Result);
-            var nightWorkPublic = ParseFeatures(tasks["858"].Result);
-            var roadWorkPoly = ParseFeatures(tasks["852"].Result);
-            var roadWorkPoint = ParseFeatures(tasks["853"].Result);
-            var landUseMain = ParseFeatures(tasks["514"].Result);
-            var landUseDetailed = ParseFeatures(tasks["837"].Result);
-            var cityPlans = ParseFeatures(tasks["528"].Result);
+            // Tasks are completed here — await each to surface results without
+            // resorting to .Result (which re-introduces sync blocking).
+            var constructionSites = ParseFeatures(await tasks["499"]);
+            var permits = ParseFeatures(await tasks["772"]);
+            var nightWorkConstruction = ParseFeatures(await tasks["479"]);
+            var nightWorkPublic = ParseFeatures(await tasks["858"]);
+            var roadWorkPoly = ParseFeatures(await tasks["852"]);
+            var roadWorkPoint = ParseFeatures(await tasks["853"]);
+            var landUseMain = ParseFeatures(await tasks["514"]);
+            var landUseDetailed = ParseFeatures(await tasks["837"]);
+            var cityPlans = ParseFeatures(await tasks["528"]);
 
             // Combine road work
             var roadWork = new List<Dictionary<string, object?>>();
@@ -351,11 +352,11 @@ public async Task<IActionResult> GetNearbyDisruptions(
 
             await Task.WhenAll(tasks.Values);
 
-            var constructionSites = ParseFeaturesWithGeometry(tasks["499"].Result, "construction");
-            var nightWorkConst = ParseFeaturesWithGeometry(tasks["479"].Result, "nightWork");
-            var nightWorkPublic = ParseFeaturesWithGeometry(tasks["858"].Result, "nightWork");
-            var roadWorkPoly = ParseFeaturesWithGeometry(tasks["852"].Result, "roadWork");
-            var roadWorkPoint = ParseFeaturesWithGeometry(tasks["853"].Result, "roadWork");
+            var constructionSites = ParseFeaturesWithGeometry(await tasks["499"], "construction");
+            var nightWorkConst = ParseFeaturesWithGeometry(await tasks["479"], "nightWork");
+            var nightWorkPublic = ParseFeaturesWithGeometry(await tasks["858"], "nightWork");
+            var roadWorkPoly = ParseFeaturesWithGeometry(await tasks["852"], "roadWork");
+            var roadWorkPoint = ParseFeaturesWithGeometry(await tasks["853"], "roadWork");
 
             var all = new List<object>();
             all.AddRange(constructionSites);

02-Server/Controllers/UsersController.cs

@@ -45,6 +45,10 @@ public async Task<IActionResult> GetMyProfile()
         [HttpGet("{id}")]
         public async Task<IActionResult> GetUserById(int id)
         {
+            int callerId = GetUserId();
+            if (callerId != id)
+                return Forbid();
+
             var user = await _usersDal.GetUserByIdAsync(id);
 
             if (user == null)

02-Server/Options/GoogleApiOptions.cs

@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 
-namespace WebApplication1.Options;
+namespace GroundShareAPI.Options;
 
 /// <summary>
 /// Strongly-typed view of the "Google" configuration section.

02-Server/Options/JwtOptions.cs

@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 
-namespace WebApplication1.Options;
+namespace GroundShareAPI.Options;
 
 /// <summary>
 /// Strongly-typed view of the "Jwt" configuration section.

02-Server/Options/StorageOptions.cs

@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 
-namespace WebApplication1.Options;
+namespace GroundShareAPI.Options;
 
 /// <summary>
 /// Strongly-typed view of the "Storage" configuration section.

02-Server/Program.cs

@@ -5,7 +5,7 @@
 using System.Net;
 using System.Text;
 using System.Threading.RateLimiting;
-using WebApplication1.Options;
+using GroundShareAPI.Options;
 using GroundShareAPI.Middleware;
 using GroundShareAPI.DAL;
 using GroundShareAPI.DAL.Interfaces;

02-Server/Services/AzureBlobStorageService.cs

@@ -25,7 +25,7 @@
 using Azure.Storage.Blobs.Models;
 using Azure.Storage.Sas;
 using Microsoft.Extensions.Options;
-using WebApplication1.Options;
+using GroundShareAPI.Options;
 
 namespace GroundShareAPI.Services
 {