publika träningslogik är nu utbruten och testbar

docs/javascript-architecture.md

@@ -104,6 +104,7 @@ Scripts:
 - `npm run status`
 - `npm restart`
 - `npm run verify`
+- `npm test`
 - `npm run setup:windows`
 
 ### `server.js`
@@ -117,6 +118,7 @@ Uses:
 - `child_process.spawn`
 - `express`
 - `better-sqlite3`
+- `server/public_training_profile.js`
 
 Owns:
 - HTTP server
@@ -129,6 +131,8 @@ Owns:
 - tokenized public driver training profile API and standalone mobile shell
 - PDF export endpoint
 
+Delegates public training token validation and response shaping to `server/public_training_profile.js`; `server.js` does not duplicate those rules.
+
 Main API groups:
 - `/api/health`
 - `/api/app-version`
@@ -154,6 +158,22 @@ Runtime environment variables:
 - `RC_TIMING_PID_FILE`: optional PID-file path used by process control
 - `PUBLIC_OVERLAY_TOKEN`: optional shared token for public overlay routes
 
+### `server/public_training_profile.js`
+Role:
+- pure CommonJS backend helper for tokenized driver profiles
+
+Owns:
+- enabled share-token lookup
+- selected-driver lap filtering and aggregate statistics
+- sanitized branding, class, goal, rank, and recommendation response
+- clock-skew-safe personal timer start/window normalization
+- bounded current-session lap, best-lap, and average calculations
+
+Security boundary:
+- returns no driver IDs, transponders, raw passings, decoder settings, or other driver names
+- disabled, short, unknown, or driverless tokens return no profile
+- logo data is restricted to bounded PNG/JPEG/WebP data URLs
+
 ### `scripts/serverctl.js`
 Role:
 - local process manager for `server.js`
@@ -511,7 +531,8 @@ Owns:
 - `src/event_views.js`
 
 ### Backend/root imports
-- `server.js` imports Node core + `express` + `better-sqlite3`
+- `server.js` imports Node core + `express` + `better-sqlite3` + `server/public_training_profile.js`
+- `server/public_training_profile.js` imports no runtime modules
 - `scripts/serverctl.js` imports Node core only
 
 ## 3.2 Injected dependency graph
@@ -883,6 +904,7 @@ sequenceDiagram
 | `public-training.html` | standalone entry | `public_training.css`, `public_training.js` | `server.js` route | root only | no | no |
 | `src/public_training.js` | standalone public view | none | `public-training.html` | yes | local timer only | no backend mutation |
 | `src/public_training.css` | standalone stylesheet | n/a | `public-training.html` | n/a | no | no |
+| `server/public_training_profile.js` | backend pure logic | none | `server.js`, tests | no | no | no |
 | `server.js` | backend runtime | node core + deps | npm/node | n/a | backend process state | yes |
 | `scripts/serverctl.js` | process control | node core | npm scripts | n/a | no | pid/log files only |
 
@@ -2045,6 +2067,12 @@ npm test
 - recommendation branch selection
 - custom goal and automatic milestone progress
 
+`tests/public_training_profile.test.js` covers:
+- enabled/disabled/unknown share-token handling
+- selected-driver isolation and response sanitization
+- personal timer aggregate and frozen-window calculations
+- clock-skew-safe query normalization and bounds
+
 The suite uses Node's built-in `node:test` runner and does not add a test-framework dependency. Windows PowerShell/CMD can run the same suite with `npm.cmd test`.
 
 ## 19. Recommended Future Additions