fix unhandled promises

Author: grahamegrieve

.eslintrc.js

@@ -1,4 +1,5 @@
 module.exports = {
+  root: true,
   env: {
     browser: true,
     commonjs: true,
@@ -27,5 +28,29 @@ module.exports = {
     'build/',
     'coverage/',
     '*.min.js'
+  ],
+  // Type-aware rules to catch a forgotten `await`. They need TypeScript type info, so
+  // they run via @typescript-eslint with parserOptions.project, scoped to the source
+  // files in tsconfig.eslint.json. Test files and other excluded paths keep the plain
+  // parser so linting never errors on a file outside the TS program.
+  overrides: [
+    {
+      files: ['**/*.js'],
+      excludedFiles: ['**/*.test.js', 'tests/**', 'static/**', 'coverage/**'],
+      parser: '@typescript-eslint/parser',
+      parserOptions: {
+        ecmaVersion: 2022,
+        sourceType: 'module',
+        project: './tsconfig.eslint.json'
+      },
+      plugins: ['@typescript-eslint'],
+      rules: {
+        // A promise-returning call left unhandled is almost always a forgotten await.
+        '@typescript-eslint/no-floating-promises': 'error',
+        // A promise used where a sync value is expected (e.g. `if (asyncThing())`).
+        // Warn, not error: there are intentional fire-and-forget callbacks.
+        '@typescript-eslint/no-misused-promises': 'warn'
+      }
+    }
   ]
-};
+};

npmprojector/watcher.js

@@ -313,7 +313,7 @@ class PackageWatcher {
    */
   stop() {
     if (this.watcher) {
-      this.watcher.close();
+      this.watcher.close().catch((err) => this.log.error('Error closing watcher: ' + err.message));
       this.watcher = null;
     }
     if (this.debounceTimer) {

packages/packages.js

@@ -1712,7 +1712,7 @@ class PackagesModule {
       // Update download counts after successful response
       // Do this asynchronously to not delay the response
       setImmediate(() => {
-        this.incrementDownloadCounts(packageData.PackageVersionKey, id);
+        void this.incrementDownloadCounts(packageData.PackageVersionKey, id); // fire-and-forget; errors handled internally
       });
 
     } catch (error) {

publisher/publisher.js

@@ -2665,14 +2665,14 @@ class PublisherModule {
     return colors[status] || 'secondary';
   }
 
-  async logUserAction(userId, action, targetId, ipAddress) {
-    return new Promise((resolve) => {
-      this.db.run(
-          'INSERT INTO user_actions (user_id, action, target_id, ip_address) VALUES (?, ?, ?, ?)',
-          [userId, action, targetId, ipAddress],
-          () => resolve() // Don't fail if logging fails
-      );
-    });
+  // Fire-and-forget audit logging: callers don't await this, and it must never fail a
+  // request, so it returns void and swallows any DB error in the callback.
+  logUserAction(userId, action, targetId, ipAddress) {
+    this.db.run(
+        'INSERT INTO user_actions (user_id, action, target_id, ip_address) VALUES (?, ?, ?, ?)',
+        [userId, action, targetId, ipAddress],
+        () => {} // don't fail (or block) the request if audit logging fails
+    );
   }
 
   getStatus() {

registry/registry.js

@@ -116,13 +116,13 @@ class RegistryModule {
 
     // Run initial crawl after a short delay
     setTimeout(() => {
-      this.performCrawl();
+      this.performCrawl().catch((err) => this.logger.error('Registry crawl failed: ' + err.message));
     }, 5000);
 
     // Set up periodic crawling
     this.stats.addTask("TxRegistry", `${intervalMinutes} min`);
     this.crawlInterval = setInterval(() => {
-      this.performCrawl();
+      this.performCrawl().catch((err) => this.logger.error('Registry crawl failed: ' + err.message));
     }, intervalMs);
 
     this.logger.info(`Started periodic crawl every ${intervalMinutes} minutes`);

server.js

@@ -860,4 +860,7 @@ async function serveFhirsmithHome(req, res) {
 }
 
 // Start the server
-startServer();
+startServer().catch((err) => {
+  serverLog.error('Fatal error during startup:', err);
+  process.exit(1);
+});

token/token.js

@@ -528,7 +528,7 @@ class TokenModule {
           }
 
           if (userId) {
-            this.logSecurityEvent(userId, 'logout', req.ip, req.get('User-Agent'), {});
+            void this.logSecurityEvent(userId, 'logout', req.ip, req.get('User-Agent'), {}); // fire-and-forget audit; errors handled internally
           }
 
           res.redirect('/token/login');

tsconfig.eslint.json

@@ -0,0 +1,9 @@
+{
+  "compilerOptions": {
+    "allowJs": true, "checkJs": false, "noEmit": true,
+    "moduleResolution": "node", "target": "es2022", "module": "commonjs",
+    "strict": false, "skipLibCheck": true
+  },
+  "include": ["**/*.js"],
+  "exclude": ["node_modules", "static", "**/*.test.js", "tests", "coverage"]
+}

xig/xig.js

@@ -3156,7 +3156,7 @@ async function initializeXigModule(stats, xigConfig) {
     if (!fs.existsSync(XIG_DB_PATH)) {
       xigLog.info('No existing XIG database found, triggering initial download');
       setTimeout(() => {
-        updateXigDatabase();
+        updateXigDatabase().catch((err) => xigLog.error('XIG database update failed: ' + err.message));
       }, 5000);
     }
 
@@ -3167,7 +3167,7 @@ async function initializeXigModule(stats, xigConfig) {
     // Note: This assumes we're called only when XIG is enabled
     if (xigConfig?.autoUpdate !== false) {
       cron.schedule('0 2 * * *', () => {
-        updateXigDatabase();
+        updateXigDatabase().catch((err) => xigLog.error('XIG database update failed: ' + err.message));
       });
     }