Push-Zeitmail: Review-Fixes (Rate-Limit begrenzt, kein NaN-Datum, Störung ≠ gelöscht)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/services/pushTimeEntry.js

@@ -12,12 +12,20 @@ export const MAX_MINUTES = 720
 
 const pad = (n) => String(n).padStart(2, '0')
 
-/** Wand-Uhrzeit rueckwaerts rechnen ('tt.mm.jjjj', 'hhmm'); reine Kalenderrechnung, ohne Zeitzone. */
+/**
+ * Wand-Uhrzeit rueckwaerts rechnen ('tt.mm.jjjj', 'hhmm'); reine Kalenderrechnung, ohne Zeitzone
+ * (wie "Zeit nachtragen" in WOMS). Ungueltiges Datum/Uhrzeit -> null.
+ */
 export function startFromEnd(endDate, endTime, minutes) {
-  const [day, month, year] = String(endDate).split('.').map(Number)
-  const hours = Number(String(endTime).slice(0, 2))
-  const mins = Number(String(endTime).slice(2, 4))
-  const start = new Date(Date.UTC(year, month - 1, day, hours, mins) - minutes * 60 * 1000)
+  const date = String(endDate || '').match(/^(\d{2})\.(\d{2})\.(\d{4})$/)
+  const time = String(endTime || '').match(/^(\d{2})(\d{2})$/)
+  if (!date || !time) return null
+  const [day, month, year] = [Number(date[1]), Number(date[2]), Number(date[3])]
+  const [hours, mins] = [Number(time[1]), Number(time[2])]
+  const end = new Date(Date.UTC(year, month - 1, day, hours, mins))
+  // 31.02. o. ae. rollt in Date.UTC weiter - dann ist das Datum ungueltig
+  if (end.getUTCDate() !== day || end.getUTCMonth() !== month - 1 || hours > 23 || mins > 59) return null
+  const start = new Date(end.getTime() - minutes * 60 * 1000)
   return {
     startDate: `${pad(start.getUTCDate())}.${pad(start.getUTCMonth() + 1)}.${start.getUTCFullYear()}`,
     startTime: `${pad(start.getUTCHours())}${pad(start.getUTCMinutes())}`,
@@ -50,20 +58,25 @@ export function formatMinutes(min) {
 }
 
 /**
- * @returns {Promise<{ status: 'saved' | 'already' | 'missing' | 'not_git', worksheet?: object }>}
+ * @returns {Promise<{ status: 'saved' | 'already' | 'missing' | 'not_git' | 'invalid', worksheet?: object }>}
+ *   invalid: Push-Datum/-Uhrzeit im Arbeitsblatt unbrauchbar (nichts gespeichert).
+ *   Andere Appwrite-Fehler als 404 werden weitergeworfen.
  */
 export async function applyPushTime(worksheetId, minutes) {
   return withLocks([`ws-time:${worksheetId}`], async () => {
     let ws
     try {
       ws = await getDocument(config.collections.worksheets, worksheetId)
-    } catch {
-      return { status: 'missing' }
+    } catch (err) {
+      if (err?.status === 404) return { status: 'missing' }
+      throw err
     }
     if (ws.serviceType !== 'GIT') return { status: 'not_git', worksheet: ws }
     if (!needsTimeEntry(ws)) return { status: 'already', worksheet: ws }
 
-    const { startDate, startTime } = startFromEnd(ws.endDate, ws.endTime, minutes)
+    const start = startFromEnd(ws.endDate, ws.endTime, minutes)
+    if (!start) return { status: 'invalid', worksheet: ws }
+    const { startDate, startTime } = start
     const worksheet = await updateDocument(config.collections.worksheets, worksheetId, {
       startDate,
       startTime,