@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.1

package/backend/test/matrix/matrix_integration_test.go

@@ -3,10 +3,14 @@
 package matrix
 
 import (
+	"bytes"
+	"context"
 	"database/sql"
 	"encoding/json"
 	"fmt"
+	"io"
 	"log/slog"
+	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -20,8 +24,11 @@ import (
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	shareddb "github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/storage"
 	"github.com/brian-huanggg/AwardRegistration/backend/test/apispec"
 )
 
@@ -57,10 +64,21 @@ func newEnv(t *testing.T) *env {
 		Logouts: auth.LogoutHandler{Logouts: &auth.Logouts{Sessions: sessions, Audit: auditSvc}, Fail: errs.Write},
 		Me:      auth.MeHandler{Sessions: sessions, Fail: errs.Write},
 		Account: account.Handler{
-			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.DefaultPolicy()},
 			Fail:    errs.Write,
 		},
 		Deadline: deadline.Handler{Store: deadline.SQLStore{DB: db}},
+		Ideas: idea.Handler{
+			Service: &idea.Service{
+				DB: db, Audit: auditSvc,
+				Gate:    deadline.Gate{Store: deadline.SQLStore{DB: db}},
+				Slides:  server.IdeaSlideRules(),
+				Objects: discardObjects{},
+				Aborter: discardObjects{},
+			},
+			ExpectedFilename: storage.ExpectedFilenameBase,
+			Fail:             errs.Write,
+		},
 	}
 	chain := server.NewPublic(log, server.Mount(si),
 		auth.Middleware(sessions, server.IsPublic, log),
@@ -68,6 +86,35 @@ func newEnv(t *testing.T) *env {
 	return &env{db: db, plain: chain, checked: apispec.Load(t).Validate(t, chain)}
 }
 
+// discardObjects stands in for MinIO: the matrix is about who may call what,
+// not about storage.
+type discardObjects struct{}
+
+func (discardObjects) Put(_ context.Context, _ string, r io.Reader, _ int64, _ string) error {
+	_, err := io.Copy(io.Discard, r)
+	return err
+}
+
+func (discardObjects) AbortUpload(context.Context, string, shareddb.Outcome) {}
+
+// stateDeadline is the deadline expression that puts the contest in a state.
+var stateDeadline = map[string]string{
+	"NOT_OPEN": "NULL",
+	"OPEN":     "NOW(6) + INTERVAL 1 DAY",
+	"CLOSED":   "NOW(6) - INTERVAL 1 DAY",
+}
+
+func (e *env) setState(t *testing.T, state string) {
+	t.Helper()
+	expr, ok := stateDeadline[state]
+	if !ok {
+		t.Fatalf("unknown state %q", state)
+	}
+	if _, err := e.db.Exec(`UPDATE contest_setting SET deadline = ` + expr + ` WHERE id = 1`); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func (e *env) do(h http.Handler, req *http.Request) *httptest.ResponseRecorder {
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
@@ -90,10 +137,11 @@ func (e *env) addUser(t *testing.T, empNo, role string) {
 	}
 }
 
-// actor is one caller of the matrix: its employee number and, when logged in,
-// its session cookie.
+// actor is one caller of the matrix: its employee number, account name and,
+// when logged in, its session cookie.
 type actor struct {
 	empNo   string
+	name    string
 	session *http.Cookie
 }
 
@@ -124,7 +172,7 @@ func (e *env) newActor(t *testing.T, name string) actor {
 	if rec.Code != 200 {
 		t.Fatalf("login %s: %d %s", name, rec.Code, rec.Body)
 	}
-	return actor{empNo: empNo, session: cookie(rec, auth.SessionCookie)}
+	return actor{empNo: empNo, name: "N " + empNo, session: cookie(rec, auth.SessionCookie)}
 }
 
 func cookie(rec *httptest.ResponseRecorder, name string) *http.Cookie {
@@ -161,7 +209,11 @@ func (e *env) request(t *testing.T, r Row, a actor) *http.Request {
 		body = strings.NewReader(s)
 	}
 	var req *http.Request
-	if body != nil {
+	if r.Multipart != nil {
+		buf, ct := multipartBody(t, r.Multipart, a)
+		req = httptest.NewRequest(r.Method, r.Path, buf)
+		req.Header.Set("Content-Type", ct)
+	} else if body != nil {
 		req = httptest.NewRequest(r.Method, r.Path, body)
 		req.Header.Set("Content-Type", "application/json")
 	} else {
@@ -180,9 +232,38 @@ func (e *env) request(t *testing.T, r Row, a actor) *http.Request {
 	return req
 }
 
+func multipartBody(t *testing.T, m *Multipart, a actor) (*bytes.Buffer, string) {
+	t.Helper()
+	sub := strings.NewReplacer("${actorEmpNo}", a.empNo, "${actorName}", a.name)
+	var buf bytes.Buffer
+	mw := multipart.NewWriter(&buf)
+	for k, v := range m.Fields {
+		if err := mw.WriteField(k, sub.Replace(v)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	w, err := mw.CreateFormFile(m.File.Field, sub.Replace(m.File.Filename))
+	if err != nil {
+		t.Fatal(err)
+	}
+	switch m.File.Content {
+	case "pdf":
+		_, _ = w.Write([]byte("%PDF-1.7\nmatrix\n%%EOF\n"))
+	default:
+		t.Fatalf("unknown file content %q", m.File.Content)
+	}
+	if err := mw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return &buf, mw.FormDataContentType()
+}
+
 func TestPermissionMatrix(t *testing.T) {
 	e := newEnv(t)
 	for _, r := range load(t) {
+		if r.State != "" {
+			e.setState(t, r.State)
+		}
 		for _, name := range Actors {
 			want, ok := r.Expect[name]
 			if !ok {

package/backend/test/migration/pending_file_deletion_test.go

@@ -0,0 +1,46 @@
+//go:build integration
+
+package migration_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+)
+
+func TestPendingFileDeletionRules(t *testing.T) {
+	d := dbtest.New(t)
+	ins := func(key, reason string) error {
+		_, err := d.Exec(`INSERT INTO pending_file_deletion (object_key, reason) VALUES (?, ?)`, key, reason)
+		return err
+	}
+	for _, r := range []string{"REPLACED", "DELETED", "UPLOAD_ABORTED"} {
+		if err := ins("slides/a/b.pdf", r); err != nil {
+			t.Errorf("reason %s (same key again): want accepted, got %v", r, err)
+		}
+	}
+	if err := ins(strings.Repeat("k", 128), "DELETED"); err != nil {
+		t.Errorf("128-char key: %v", err)
+	}
+	for name, c := range map[string][2]string{
+		"unknown reason":    {"slides/x.pdf", "EXPIRED"},
+		"lower-case reason": {"slides/x.pdf", "replaced"},
+		"empty key":         {"", "DELETED"},
+		"129-char key":      {strings.Repeat("k", 129), "DELETED"},
+	} {
+		if err := ins(c[0], c[1]); err == nil {
+			t.Errorf("%s: want rejected", name)
+		}
+	}
+
+	var attempts int
+	var due bool
+	if err := d.QueryRow(`SELECT attempts, next_attempt_at <= NOW(6) AND created_at <= NOW(6)
+	                        FROM pending_file_deletion WHERE reason = 'DELETED' LIMIT 1`).Scan(&attempts, &due); err != nil {
+		t.Fatal(err)
+	}
+	if attempts != 0 || !due {
+		t.Errorf("defaults: attempts=%d due=%v, want 0 and due now", attempts, due)
+	}
+}

package/docs/API/api-endpoints.md

@@ -40,6 +40,6 @@ Every write (`POST`, `PUT`, `DELETE`, including login, register and logout) MUST
 Notes:
  
 - `DELETE /ideas/{id}/members/{empNo}` works on both `PENDING` and `ACCEPTED` rows (reject or remove); `DELETE …/members/me` works on the caller's own row (withdraw or leave). `me` is never a 6-digit employee ID, so the two paths cannot collide (PRD §6.7).
-- List endpoints enforce a maximum page size of 100 (`GET /ideas`: `page`, `size`, filters, `sort`, `order`; PRD §6.6). `GET /admin/audit-logs` uses keyset pagination with `cursor` and `limit` (PRD §6.11).
+- List endpoints enforce a maximum page size of 100 (`GET /ideas`: `page`, `size`, filters, `q`, `sort`, `order`; PRD §6.6). `GET /admin/audit-logs` uses keyset pagination with `cursor` and `limit` (PRD §6.11).
 - Unknown paths: 401 without a session, 404 with one; wrong method 405; unsupported `Accept` 406 (PRD §6.1, OI-15).
 - Operations endpoints are on the management port and are not routed by the public ingress (PRD §8.3).

package/docs/API/error-codes.md

@@ -37,7 +37,7 @@ Format: RFC 9457 `application/problem+json`.
  
 - `code` is the stable contract; `detail` is English and not for display (the UI localizes by `code`).
 - With several field errors, `errors[]` lists all of them in form-field order; the top-level `code` equals `errors[0].code` when that is a registered specific code, otherwise `VALIDATION_FAILED`.
-- Generic field codes: `REQUIRED`, `INVALID_FORMAT`, `OUT_OF_RANGE`, `INVALID_ENUM`. Per-field rules (which error a field reports first) are in PRD §6.2. The password is the exception: `errors[]` lists every violated rule (PRD §6.4).
+- Generic field codes: `REQUIRED`, `INVALID_FORMAT`, `OUT_OF_RANGE`, `INVALID_ENUM`. Per-field rules (which error a field reports first) are in PRD §6.2. The password is the exception: `errors[]` lists every violated rule (PRD §6.4), each as `{ "field": "password", "code": "PASSWORD_POLICY", "rule": "<rule id>" }` in table order. `rule` appears only on these entries.
 - `requestId` is a server-generated UUID. An incoming `X-Request-Id` is reused only if it is a valid UUID. It is returned in the response header and the error body.
 - 500 responses carry only `INTERNAL_ERROR` and `requestId`: no stack traces, SQL or paths.
 - A malformed ID in a path is a 404, not a 400.

package/frontend/src/app/App.tsx

@@ -1,18 +1,27 @@
-import { useEffect } from 'react';
+import { useCallback, useEffect } from 'react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { RouterProvider, createBrowserRouter, type DataRouter } from 'react-router';
 import { setUnauthenticatedHandler } from '@/shared/api';
 import { routes } from './router';
-import { handleSessionEnded } from './session';
+import { IdleWarning } from '@/features/auth/IdleWarning';
+import { handleSessionEnded, useMe } from './session';
 
 const queryClient = new QueryClient();
 const browserRouter = createBrowserRouter(routes);
 
+/** Mounted inside the providers so it can read `me`; ends the session like a 401 when the idle time is up. */
+function Idle({ router, client }: { router: DataRouter; client: QueryClient }) {
+  const { data: me } = useMe();
+  const onExpire = useCallback(() => handleSessionEnded(client, router), [client, router]);
+  return <IdleWarning signedIn={!!me} onExpire={onExpire} />;
+}
+
 export function App({ router = browserRouter, client = queryClient }: { router?: DataRouter; client?: QueryClient }) {
   useEffect(() => setUnauthenticatedHandler(() => handleSessionEnded(client, router)), [client, router]);
   return (
     <QueryClientProvider client={client}>
       <RouterProvider router={router} />
+      <Idle router={router} client={client} />
     </QueryClientProvider>
   );
 }

package/frontend/src/features/auth/IdleWarning.test.tsx

@@ -0,0 +1,82 @@
+import { act, render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { http, HttpResponse } from "msw";
+import { axe } from "vitest-axe";
+import { apiFetch, markActivity } from "@/shared/api";
+import { server } from "@/shared/api/mocks/server";
+import { initI18n } from "@/shared/i18n";
+import { IdleWarning } from "./IdleWarning";
+
+const API = "http://localhost:3000/api/v1";
+const MIN = 60_000;
+const DIALOG = { name: "Are you still there?" };
+
+beforeEach(async () => {
+  await initI18n("en");
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout", "Date"], shouldAdvanceTime: true });
+  markActivity();
+});
+afterEach(() => vi.useRealTimers());
+
+const advance = (ms: number) => act(() => vi.advanceTimersByTimeAsync(ms));
+
+describe("IdleWarning", () => {
+  it("opens at 28 minutes and ends the session at 30", async () => {
+    const onExpire = vi.fn();
+    render(<IdleWarning signedIn onExpire={onExpire} />);
+    await advance(28 * MIN - 1);
+    expect(screen.queryByRole("alertdialog")).toBeNull();
+    await advance(1);
+    expect(screen.getByRole("alertdialog", DIALOG)).toBeInTheDocument();
+    expect(onExpire).not.toHaveBeenCalled();
+    await advance(2 * MIN);
+    expect(onExpire).toHaveBeenCalledTimes(1);
+  });
+
+  it("Continue calls GET /auth/me, closes the dialog and restarts the clock", async () => {
+    let calls = 0;
+    server.use(
+      http.get(`${API}/auth/me`, () => {
+        calls += 1;
+        return HttpResponse.json({ empNo: "089290" });
+      }),
+    );
+    const onExpire = vi.fn();
+    render(<IdleWarning signedIn onExpire={onExpire} />);
+    await advance(28 * MIN);
+    const user = userEvent.setup({ advanceTimers: vi.advanceTimersByTimeAsync });
+    await user.click(screen.getByRole("button", { name: "Continue" }));
+    await vi.waitFor(() => expect(calls).toBe(1));
+    await vi.waitFor(() => expect(screen.queryByRole("alertdialog")).toBeNull());
+    await advance(29 * MIN);
+    expect(onExpire).not.toHaveBeenCalled();
+    await advance(MIN);
+    expect(onExpire).toHaveBeenCalledTimes(1);
+  });
+
+  it("any answered request restarts the clock before the warning", async () => {
+    server.use(http.get(`${API}/deadline`, () => HttpResponse.json({})));
+    render(<IdleWarning signedIn onExpire={vi.fn()} />);
+    await advance(20 * MIN);
+    await apiFetch("/deadline");
+    await advance(20 * MIN);
+    expect(screen.queryByRole("alertdialog")).toBeNull();
+    await advance(8 * MIN);
+    expect(screen.getByRole("alertdialog", DIALOG)).toBeInTheDocument();
+  });
+
+  it("does nothing for a visitor", async () => {
+    const onExpire = vi.fn();
+    render(<IdleWarning signedIn={false} onExpire={onExpire} />);
+    await advance(40 * MIN);
+    expect(screen.queryByRole("alertdialog")).toBeNull();
+    expect(onExpire).not.toHaveBeenCalled();
+  });
+
+  it("has no axe violations", async () => {
+    render(<IdleWarning signedIn onExpire={vi.fn()} />);
+    await advance(28 * MIN);
+    vi.useRealTimers();
+    expect((await axe(document.body)).violations).toEqual([]);
+  });
+});

package/frontend/src/features/auth/IdleWarning.tsx

@@ -0,0 +1,66 @@
+import { useEffect, useState, useSyncExternalStore } from "react";
+import { Dialog } from "radix-ui";
+import { useTranslation } from "react-i18next";
+import { apiFetch, lastActivity, subscribeActivity } from "@/shared/api";
+import { Button } from "@/shared/ui/button";
+
+/** Warn 2 min before the 30 min idle timeout: the 60 s refresh rule can put the server up to 1 min ahead (OI-11, OI-22). */
+export const WARN_AFTER_MS = 28 * 60_000;
+export const END_AFTER_MS = 30 * 60_000;
+
+/**
+ * Idle-timeout warning (WCAG 2.2.1, Frontend.md §8.1). 28 minutes after the last server request a dialog
+ * offers "Continue", which calls `GET /auth/me` (that refreshes the session and restarts both timers).
+ * With no answer the session ends at 30 minutes like any other 401 (`onExpire`).
+ */
+export function IdleWarning({
+  signedIn,
+  onExpire,
+}: {
+  signedIn: boolean;
+  onExpire: () => void;
+}) {
+  const { t } = useTranslation();
+  const last = useSyncExternalStore(subscribeActivity, lastActivity);
+  // The `last` the warning fired for: a newer request makes it stale, which closes the dialog without an effect.
+  const [warnedFor, setWarnedFor] = useState<number | null>(null);
+  const warning = signedIn && warnedFor === last;
+
+  useEffect(() => {
+    if (!signedIn) return;
+    const elapsed = Date.now() - last;
+    const warn = setTimeout(() => setWarnedFor(last), Math.max(0, WARN_AFTER_MS - elapsed));
+    const end = setTimeout(() => {
+      setWarnedFor(null);
+      onExpire();
+    }, Math.max(0, END_AFTER_MS - elapsed));
+    return () => {
+      clearTimeout(warn);
+      clearTimeout(end);
+    };
+  }, [signedIn, last, onExpire]);
+
+  // A failure needs no handling here: a 401 already ends the session through the global handler.
+  const keepAlive = () => void apiFetch("/auth/me").catch(() => undefined);
+
+  return (
+    <Dialog.Root open={warning} onOpenChange={(open) => !open && keepAlive()}>
+      <Dialog.Portal>
+        <Dialog.Overlay className="fixed inset-0 z-50 bg-black/50" />
+        <Dialog.Content
+          role="alertdialog"
+          className="fixed top-1/2 left-1/2 z-50 w-[calc(100%-2rem)] max-w-md -translate-x-1/2 -translate-y-1/2 rounded-lg border bg-background p-6 shadow-lg"
+          onInteractOutside={(e) => e.preventDefault()}
+        >
+          <Dialog.Title className="text-lg font-semibold">{t("pages.idle.title")}</Dialog.Title>
+          <Dialog.Description className="mt-2 text-sm text-muted-foreground">
+            {t("pages.idle.body")}
+          </Dialog.Description>
+          <div className="mt-6 flex justify-end">
+            <Button onClick={keepAlive}>{t("pages.idle.continue")}</Button>
+          </div>
+        </Dialog.Content>
+      </Dialog.Portal>
+    </Dialog.Root>
+  );
+}

package/frontend/src/shared/api/activity.ts

@@ -0,0 +1,20 @@
+/**
+ * Time of the last answered server request (Frontend.md §8.1, OI-22). Any answer except a 401 means
+ * the server saw the session, so the idle clock restarts; the idle-timeout warning reads it.
+ */
+let last = Date.now();
+const listeners = new Set<() => void>();
+
+export const lastActivity = () => last;
+
+export function markActivity(): void {
+  last = Date.now();
+  listeners.forEach((fn) => fn());
+}
+
+export function subscribeActivity(fn: () => void): () => void {
+  listeners.add(fn);
+  return () => {
+    listeners.delete(fn);
+  };
+}

package/frontend/src/shared/api/http.ts

@@ -1,3 +1,4 @@
+import { markActivity } from './activity';
 import { API_BASE, clearCsrfToken, getCsrfToken, refreshCsrfToken } from './csrf';
 import { parseApiError, type ApiError } from './problem';
 
@@ -73,6 +74,7 @@ export async function apiFetch(path: string, init: ApiRequestInit = {}): Promise
     res = await send(await refreshCsrfToken());
   }
 
+  if (res.status !== 401) markActivity();
   if (res.ok) {
     if (write && SESSION_CHANGING.has(path)) clearCsrfToken();
     return res;

package/frontend/src/shared/api/index.ts

@@ -4,3 +4,4 @@ export { apiFetch, setUnauthenticatedHandler } from './http';
 export type { ApiRequestInit } from './http';
 export { clearCsrfToken, getCsrfToken } from './csrf';
 export type { paths, components } from './types.generated';
+export { lastActivity, markActivity, subscribeActivity } from './activity';

package/frontend/src/shared/i18n/locales/en.ts

@@ -57,6 +57,7 @@ export const en = {
     leaderEmpNo: 'Leader employee ID',
   },
   pages: {
+    idle: { title: 'Are you still there?', body: 'You have been inactive for a while. For your security your session will end in about 2 minutes unless you continue.', continue: 'Continue' },
     login: { title: 'Sign in to your account', description: 'Enter your employee ID and password.', noAccount: 'No account yet?', panelTitle: 'ESG Idea Contest', panelBody: 'Register, form a team and submit your Idea.', submitting: 'Signing in…', sessionEnded: 'Your session has ended. Please sign in again.' },
     register: {
       title: 'Create an account',

package/frontend/src/shared/i18n/locales/zh-TW.ts

@@ -54,6 +54,7 @@ export const zhTW: Dictionary = {
     leaderEmpNo: '組長員工編號',
   },
   pages: {
+    idle: { title: '您還在嗎？', body: '您已閒置一段時間。為了安全，若不繼續使用，您的登入將在約 2 分鐘後結束。', continue: '繼續' },
     login: { title: '登入您的帳號', description: '請輸入員工編號與密碼。', noAccount: '還沒有帳號？', panelTitle: 'ESG 創意競賽', panelBody: '註冊、組隊並提交您的創意。', submitting: '登入中…', sessionEnded: '您的登入已結束，請重新登入。' },
     register: {
       title: '建立帳號',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johnnyboy11234/esg-idea-contest",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "ESG Idea Contest registration system: Go backend, React frontend and design documents (source distribution).",
   "license": "MIT",
   "author": "Brian Huang",

package/testdata/expected-filename.json

@@ -0,0 +1,93 @@
+{
+ "description": "Shared by backend (Go) and frontend (TS). Expected slide filename base per PRD 6.8 and the 255 UTF-8 byte rule of PRD 6.2 (length measured with .pptx). Inputs may be NFD; wantBase is always NFC.",
+ "cases": [
+  {
+   "id": "cool-idea-pdf-example",
+   "category": "COOL_IDEA",
+   "org": "BSID",
+   "leaderName": "\u738b\u5c0f\u660e",
+   "leaderEmpNo": "089290",
+   "ideaName": "\u6210\u7acb\u4f9b\u61c9\u5546\u6c38\u7e8c\u5b78\u9662",
+   "wantBase": "I_BSID_\u738b\u5c0f\u660e_089290_\u6210\u7acb\u4f9b\u61c9\u5546\u6c38\u7e8c\u5b78\u9662",
+   "wantBytes": 56,
+   "wantTooLong": false
+  },
+  {
+   "id": "outstanding-impact-example",
+   "category": "OUTSTANDING_IMPACT",
+   "org": "AAID",
+   "leaderName": "\u838a\u80b2\u6210",
+   "leaderEmpNo": "054616",
+   "ideaName": "AI\u79d8\u5bc6\u6b66\u5668\u667a\u80fd\u5c0d\u8a71",
+   "wantBase": "O_AAID_\u838a\u80b2\u6210_054616_AI\u79d8\u5bc6\u6b66\u5668\u667a\u80fd\u5c0d\u8a71",
+   "wantBytes": 55,
+   "wantTooLong": false
+  },
+  {
+   "id": "name-with-inner-space",
+   "category": "COOL_IDEA",
+   "org": "TSID",
+   "leaderName": "Alice Wang",
+   "leaderEmpNo": "000001",
+   "ideaName": "Green Plant 2.0",
+   "wantBase": "I_TSID_Alice Wang_000001_Green Plant 2.0",
+   "wantBytes": 45,
+   "wantTooLong": false
+  },
+  {
+   "id": "idea-name-nfd-becomes-nfc",
+   "category": "COOL_IDEA",
+   "org": "ICSD",
+   "leaderName": "Zoe",
+   "leaderEmpNo": "000002",
+   "ideaName": "Cafe\u0301 \u30ab\u3099",
+   "wantBase": "I_ICSD_Zoe_000002_Caf\u00e9 \u30ac",
+   "wantBytes": 32,
+   "wantTooLong": false
+  },
+  {
+   "id": "leader-name-nfd-becomes-nfc",
+   "category": "OUTSTANDING_IMPACT",
+   "org": "PLED",
+   "leaderName": "Jose\u0301",
+   "leaderEmpNo": "000003",
+   "ideaName": "Reuse",
+   "wantBase": "O_PLED_Jos\u00e9_000003_Reuse",
+   "wantBytes": 30,
+   "wantTooLong": false
+  },
+  {
+   "id": "exactly-255-bytes",
+   "category": "OUTSTANDING_IMPACT",
+   "org": "AAID",
+   "leaderName": "\u838a\u80b2\u6210",
+   "leaderEmpNo": "054616",
+   "ideaName": "\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275abcd",
+   "wantBase": "O_AAID_\u838a\u80b2\u6210_054616_\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275abcd",
+   "wantBytes": 255,
+   "wantTooLong": false
+  },
+  {
+   "id": "256-bytes-too-long",
+   "category": "OUTSTANDING_IMPACT",
+   "org": "AAID",
+   "leaderName": "\u838a\u80b2\u6210",
+   "leaderEmpNo": "054616",
+   "ideaName": "\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275abcde",
+   "wantBase": "O_AAID_\u838a\u80b2\u6210_054616_\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275\u5275abcde",
+   "wantBytes": 256,
+   "wantTooLong": true
+  },
+  {
+   "id": "emoji-four-byte-too-long",
+   "category": "COOL_IDEA",
+   "org": "DEID",
+   "leaderName": "\u738b\u5c0f\u660e",
+   "leaderEmpNo": "089290",
+   "ideaName": "\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00",
+   "wantBase": "I_DEID_\u738b\u5c0f\u660e_089290_\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00\ud83d\ude00",
+   "wantBytes": 269,
+   "wantTooLong": true
+  }
+ ]
+}