From f4e1f592bede0537b74980e0ce69caddd18d72a5 Mon Sep 17 00:00:00 2001
From: fabiodalez-dev <fabiodalezbackup@gmail.com>
Date: Fri, 6 Nov 2026 01:40:02 +0100
Subject: [PATCH 1/3] Visitor log: the card field also finds a member by name

A reader who forgot the card can be found by name, surname, e-mail or phone, with the borrower search of the loan form. Picking a member sends utente_id, looked up within the operator's borrower scope as the card is; the operator confirms with "Registra ingresso". Enter picks a suggestion only when one is highlighted with the arrows, so a desk reader that types the code and sends Enter keeps working while the list is open.
---
 .github/workflows/ci-e2e.yml             |   1 +
 app/Controllers/AttendanceController.php |   9 +-
 app/Models/AttendanceRepository.php      |  28 ++-
 app/Views/attendance/index.php           | 183 +++++++++++++++-
 locale/da_DK.json                        |   5 +-
 locale/de_DE.json                        |   5 +-
 locale/en_US.json                        |   5 +-
 locale/fr_FR.json                        |   5 +-
 locale/it_IT.json                        |   5 +-
 tests/attendance-member-search.spec.js   | 266 +++++++++++++++++++++++
 10 files changed, 497 insertions(+), 15 deletions(-)
 create mode 100644 tests/attendance-member-search.spec.js

diff --git a/.github/workflows/ci-e2e.yml b/.github/workflows/ci-e2e.yml
index ea538e7da..46639cfad 100644
--- a/.github/workflows/ci-e2e.yml
+++ b/.github/workflows/ci-e2e.yml
@@ -434,6 +434,7 @@ jobs:
           - group: catalogue
             specs: >-
               tests/attendance-090.spec.js
+              tests/attendance-member-search.spec.js
               tests/catalogue-cards-090.spec.js
               tests/feature-toggle-catalogue-cards.spec.js
               tests/feature-toggles-followups.spec.js
diff --git a/app/Controllers/AttendanceController.php b/app/Controllers/AttendanceController.php
index 7f184a0e0..76c85743a 100644
--- a/app/Controllers/AttendanceController.php
+++ b/app/Controllers/AttendanceController.php
@@ -60,10 +60,15 @@ public function scan(Request $request, Response $response, mysqli $db): Response
         $body = (array) $request->getParsedBody();
         $repo = new AttendanceRepository($db);
         $card = is_string($body['codice_tessera'] ?? null) ? $body['codice_tessera'] : '';
+        // A member picked from the name search arrives as utente_id, and the
+        // field then holds the label, not a code: the id wins over the card.
+        $pickedId = filter_var($body['utente_id'] ?? null, FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]);
         try {
-            $member = $repo->findMemberByCard($card);
+            $member = $pickedId !== false ? $repo->findMemberById($pickedId) : $repo->findMemberByCard($card);
             if ($member === null) {
-                $_SESSION['error_message'] = __('Tessera non riconosciuta. Controlla il codice o registra la visita come ospite.');
+                $_SESSION['error_message'] = $pickedId !== false
+                    ? __('Utente non trovato')
+                    : __('Tessera non riconosciuta. Controlla il codice o registra la visita come ospite.');
                 return $this->back($response);
             }
             $repo->recordMember($member['id'], $this->rememberBranch($repo, $body));
diff --git a/app/Models/AttendanceRepository.php b/app/Models/AttendanceRepository.php
index 9c55226a0..5939596b0 100644
--- a/app/Models/AttendanceRepository.php
+++ b/app/Models/AttendanceRepository.php
@@ -57,9 +57,35 @@ public function findMemberByCard(string $card): ?array
         $stmt->execute();
         $row = $stmt->get_result()->fetch_assoc();
         $stmt->close();
-        if (!$row) {
+        return $row ? self::member($row) : null;
+    }
+
+    /**
+     * The member picked by name in the desk search, for a reader who forgot
+     * the card. Same reach as findMemberByCard().
+     *
+     * @return array{id:int, nome:string, cognome:string, stato:string}|null
+     */
+    public function findMemberById(int $userId): ?array
+    {
+        if ($userId <= 0) {
             return null;
         }
+        $scope = Permissions::accountScopeSql('', Permissions::SCOPE_BORROWER);
+        $stmt = $this->db->prepare('SELECT id, nome, cognome, stato FROM utenti WHERE id = ?' . $scope . ' LIMIT 1');
+        $stmt->bind_param('i', $userId);
+        $stmt->execute();
+        $row = $stmt->get_result()->fetch_assoc();
+        $stmt->close();
+        return $row ? self::member($row) : null;
+    }
+
+    /**
+     * @param array<string, mixed> $row
+     * @return array{id:int, nome:string, cognome:string, stato:string}
+     */
+    private static function member(array $row): array
+    {
         return [
             'id' => (int) $row['id'],
             'nome' => (string) $row['nome'],
diff --git a/app/Views/attendance/index.php b/app/Views/attendance/index.php
index cecde403d..eba9d99dc 100644
--- a/app/Views/attendance/index.php
+++ b/app/Views/attendance/index.php
@@ -85,9 +85,14 @@
         <form method="post" action="<?= htmlspecialchars(url('/admin/attendance/scan'), ENT_QUOTES, 'UTF-8') ?>" id="attendance-scan-form" class="space-y-4" autocomplete="off">
           <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf, ENT_QUOTES, 'UTF-8') ?>">
           <div>
-            <label for="codice_tessera" class="form-label"><?= __("Codice tessera") ?></label>
+            <label for="codice_tessera" class="form-label"><?= __("Tessera o nome del socio") ?></label>
             <div class="flex gap-2">
-              <input id="codice_tessera" name="codice_tessera" type="text" maxlength="20" required autofocus class="form-input" placeholder="<?= htmlspecialchars(__('Passa la tessera sul lettore o digita il codice'), ENT_QUOTES, 'UTF-8') ?>" />
+              <div class="relative flex-1">
+                <input id="codice_tessera" name="codice_tessera" type="text" maxlength="150" required autofocus class="form-input" placeholder="<?= htmlspecialchars(__('Passa la tessera, digita il codice o cerca il socio per nome'), ENT_QUOTES, 'UTF-8') ?>"
+                       role="combobox" aria-autocomplete="list" aria-expanded="false" aria-controls="attendance-member-suggest" />
+                <div id="attendance-member-suggest" class="suggestions-box" role="listbox" aria-label="<?= htmlspecialchars(__('Tessera o nome del socio'), ENT_QUOTES, 'UTF-8') ?>"></div>
+              </div>
+              <input type="hidden" name="utente_id" id="attendance-member-id" value="" />
               <button type="button" id="attendance-card-scan" data-copy-scan data-copy-scan-target="codice_tessera" aria-label="<?= htmlspecialchars(__('Scansiona la tessera con la fotocamera'), ENT_QUOTES, 'UTF-8') ?>"
                       class="inline-flex items-center gap-2 whitespace-nowrap px-4 py-2 bg-gray-100 text-gray-900 border border-gray-300 rounded-lg hover:bg-gray-200 transition-colors font-medium">
                 <i class="fas fa-camera"></i><span class="hidden sm:inline"><?= __("Scansiona") ?></span>
@@ -309,12 +314,186 @@ class="inline-flex items-center gap-2 whitespace-nowrap px-4 py-2 bg-gray-100 te
     </div>
   </div>
 </section>
+<style>
+  .suggestions-box {
+    position: absolute;
+    background: white;
+    border: 1px solid #e2e8f0;
+    z-index: 50;
+    width: 100%;
+    max-height: 250px;
+    overflow-y: auto;
+    border-radius: 0.5rem;
+    display: none;
+    box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1), 0 2px 4px -1px rgba(0, 0, 0, 0.06);
+  }
+  .suggestion-item {
+    padding: 0.75rem 1rem;
+    cursor: pointer;
+    border-bottom: 1px solid #f1f5f9;
+  }
+  .suggestion-item:last-child {
+    border-bottom: none;
+  }
+  .suggestion-item:hover {
+    background-color: #f8fafc;
+  }
+  .suggestion-item.selected {
+    background-color: #f1f5f9;
+  }
+</style>
 <?php include __DIR__ . '/../partials/copy-scanner-i18n.php'; ?>
 <script src="<?= htmlspecialchars(assetUrl('copy-scanner.bundle.js'), ENT_QUOTES, 'UTF-8') ?>" defer></script>
 <script>
 document.addEventListener('DOMContentLoaded', function () {
   const card = document.getElementById('codice_tessera');
   if (card) { card.focus(); }
+  // Name search: the same borrower search as the loan form. Picking a member
+  // fills utente_id and the operator confirms with "Registra ingresso". Enter
+  // picks a suggestion only when one is highlighted with the arrows, so a
+  // desk reader that types the code and sends Enter is never captured.
+  (function () {
+    const suggest = document.getElementById('attendance-member-suggest');
+    const picked = document.getElementById('attendance-member-id');
+    if (!card || !suggest || !picked) { return; }
+    const endpoint = <?= json_encode(url('/api/search/utenti'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) ?>;
+    const noResults = <?= json_encode(__('Nessun risultato'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) ?>;
+    const searchFailed = <?= json_encode(__('Ricerca non disponibile. Riprova.'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) ?>;
+    let timer = null;
+    let request = null;
+    let active = -1;
+
+    function items() { return Array.prototype.slice.call(suggest.querySelectorAll('.suggestion-item[data-id]')); }
+    // Every way out of a search goes through here, so a timer or an answer
+    // still on its way cannot reopen a list the operator has already left.
+    function cancel() {
+      clearTimeout(timer);
+      if (request) { request.abort(); request = null; }
+    }
+    function hide() {
+      suggest.style.display = 'none';
+      suggest.innerHTML = '';
+      active = -1;
+      card.setAttribute('aria-expanded', 'false');
+      card.removeAttribute('aria-activedescendant');
+    }
+    function open() {
+      suggest.style.display = 'block';
+      card.setAttribute('aria-expanded', 'true');
+      card.removeAttribute('aria-activedescendant');
+      active = -1;
+    }
+    function highlight(index) {
+      const list = items();
+      list.forEach(function (el, i) { el.classList.toggle('selected', i === index); el.setAttribute('aria-selected', i === index ? 'true' : 'false'); });
+      active = index;
+      if (list[index]) {
+        card.setAttribute('aria-activedescendant', list[index].id);
+        list[index].scrollIntoView({ block: 'nearest' });
+      } else {
+        card.removeAttribute('aria-activedescendant');
+      }
+    }
+    function choose(el) {
+      cancel();
+      picked.value = el.getAttribute('data-id') || '';
+      card.value = el.textContent.trim();
+      hide();
+      const submit = card.form.querySelector('button[type="submit"]');
+      if (submit) { submit.focus(); }
+    }
+    // A line that cannot be picked: no match, or a search that did not run.
+    function notice(text) {
+      suggest.innerHTML = '';
+      const el = document.createElement('div');
+      el.className = 'suggestion-item';
+      el.setAttribute('role', 'option');
+      el.setAttribute('aria-disabled', 'true');
+      el.style.color = '#6b7280';
+      el.style.cursor = 'default';
+      el.textContent = text;
+      suggest.appendChild(el);
+      open();
+    }
+    function show(rows) {
+      if (rows.length === 0) { notice(noResults); return; }
+      suggest.innerHTML = '';
+      rows.forEach(function (row) {
+        const id = parseInt(row.id, 10);
+        if (isNaN(id)) { return; }
+        const el = document.createElement('div');
+        el.className = 'suggestion-item';
+        el.id = 'attendance-member-option-' + id;
+        el.setAttribute('role', 'option');
+        el.setAttribute('aria-selected', 'false');
+        el.setAttribute('data-id', String(id));
+        el.textContent = String(row.label || '');
+        suggest.appendChild(el);
+      });
+      open();
+    }
+
+    card.addEventListener('input', function () {
+      picked.value = '';
+      // The list on screen answers the previous text: a highlight on it must
+      // not catch the Enter a reader sends right after the new code.
+      highlight(-1);
+      const query = card.value.trim();
+      cancel();
+      if (query.length < 2) { hide(); return; }
+      timer = setTimeout(function () {
+        request = new AbortController();
+        fetch(endpoint + '?q=' + encodeURIComponent(query), { signal: request.signal, credentials: 'same-origin', headers: { 'Accept': 'application/json' } })
+          .then(function (r) { if (!r.ok) { throw new Error('search ' + r.status); } return r.json(); })
+          .then(function (data) {
+            if (!Array.isArray(data)) { throw new Error('search answer'); }
+            // A late answer for text the operator has since changed is dropped.
+            if (card.value.trim() !== query) { return; }
+            show(data);
+          })
+          .catch(function (err) {
+            // "Nobody matches" and "the search failed" are not the same news.
+            if (err && err.name !== 'AbortError' && card.value.trim() === query) { notice(searchFailed); }
+          });
+      }, 300);
+    });
+    card.addEventListener('keydown', function (event) {
+      const list = items();
+      if (event.key === 'ArrowDown' && list.length > 0) {
+        event.preventDefault();
+        highlight(active + 1 >= list.length ? 0 : active + 1);
+      } else if (event.key === 'ArrowUp' && list.length > 0) {
+        event.preventDefault();
+        highlight(active <= 0 ? list.length - 1 : active - 1);
+      } else if (event.key === 'Enter') {
+        if (active >= 0 && list[active]) {
+          event.preventDefault();
+          choose(list[active]);
+        } else {
+          cancel();
+          hide();
+        }
+      } else if (event.key === 'Escape') {
+        cancel();
+        hide();
+      }
+    });
+    card.addEventListener('blur', function () {
+      cancel();
+      hide();
+    });
+    suggest.addEventListener('mousedown', function (event) {
+      // Always, not only on an option: pressing the list or its scrollbar must
+      // not take the focus away, or the blur above would close it.
+      event.preventDefault();
+      const el = event.target.closest('.suggestion-item[data-id]');
+      if (el) { choose(el); }
+    });
+    // iOS Safari keeps the focus on a tap outside the field, so no blur there.
+    document.addEventListener('click', function (event) {
+      if (event.target !== card && !suggest.contains(event.target)) { cancel(); hide(); }
+    });
+  })();
   // A card read by the camera registers the entry at once, as a desk reader
   // does with Enter. The scanner fills the field with a synthetic change
   // event (isTrusted false); typing, pasting or autofill fire trusted ones
diff --git a/locale/da_DK.json b/locale/da_DK.json
index de0970667..59a852bb2 100644
--- a/locale/da_DK.json
+++ b/locale/da_DK.json
@@ -8630,7 +8630,6 @@
   "Ospiti": "Gæster",
   "P. IVA": "Momsnr.",
   "Partita IVA": "Momsnummer",
-  "Passa la tessera sul lettore o digita il codice": "Scan kortet eller indtast koden",
   "Presenza dell'ospite registrata.": "Gæstens besøg er registreret.",
   "Presenza registrata per %s, ma la tessera non è attiva.": "Besøg registreret for %s, men kortet er ikke aktivt.",
   "Presenze": "Besøg",
@@ -9322,5 +9321,7 @@
   "L'esito di questa importazione non è stato salvato: controlla il catalogo prima di importare di nuovo, con una nuova chiave.": "Resultatet af denne import blev ikke gemt: kontroller kataloget, før du importerer igen, med en ny nøgle.",
   "Impossibile salvare l'avanzamento dell'importazione: la riga non è stata contata, riprova.": "Importens fremskridt kunne ikke gemmes: rækken blev ikke talt med, prøv igen.",
   "Utente importato, ma l'invito potrebbe essere già stato inviato: se non è arrivato, invialo di nuovo dalla scheda dell'utente.": "Bruger importeret, men invitationen er muligvis allerede sendt: hvis den ikke er nået frem, så send den igen fra brugerens side.",
-  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "Denne søgning har nået det maksimale antal importer: søg igen for at fortsætte."
+  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "Denne søgning har nået det maksimale antal importer: søg igen for at fortsætte.",
+  "Tessera o nome del socio": "Lånerkort eller medlemmets navn",
+  "Passa la tessera, digita il codice o cerca il socio per nome": "Scan kortet, indtast koden eller søg efter medlemmet ved navn"
 }
diff --git a/locale/de_DE.json b/locale/de_DE.json
index 8b797c531..315891af4 100644
--- a/locale/de_DE.json
+++ b/locale/de_DE.json
@@ -8630,7 +8630,6 @@
   "Ospiti": "Gäste",
   "P. IVA": "USt-IdNr.",
   "Partita IVA": "Umsatzsteuer-Identifikationsnummer",
-  "Passa la tessera sul lettore o digita il codice": "Karte scannen oder Code eingeben",
   "Presenza dell'ospite registrata.": "Gastbesuch erfasst.",
   "Presenza registrata per %s, ma la tessera non è attiva.": "Besuch für %s erfasst, aber die Karte ist nicht aktiv.",
   "Presenze": "Besuche",
@@ -9322,5 +9321,7 @@
   "L'esito di questa importazione non è stato salvato: controlla il catalogo prima di importare di nuovo, con una nuova chiave.": "Das Ergebnis dieses Imports wurde nicht gespeichert: Prüfe den Katalog, bevor du erneut importierst, mit einem neuen Schlüssel.",
   "Impossibile salvare l'avanzamento dell'importazione: la riga non è stata contata, riprova.": "Der Importfortschritt konnte nicht gespeichert werden: Die Zeile wurde nicht gezählt, versuche es erneut.",
   "Utente importato, ma l'invito potrebbe essere già stato inviato: se non è arrivato, invialo di nuovo dalla scheda dell'utente.": "Benutzer importiert, aber die Einladung wurde möglicherweise bereits gesendet: Falls sie nicht angekommen ist, sende sie erneut aus dem Benutzerdatensatz.",
-  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "Diese Suche hat die maximale Anzahl an Importen erreicht: Bitte erneut suchen, um fortzufahren."
+  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "Diese Suche hat die maximale Anzahl an Importen erreicht: Bitte erneut suchen, um fortzufahren.",
+  "Tessera o nome del socio": "Ausweis oder Name des Mitglieds",
+  "Passa la tessera, digita il codice o cerca il socio per nome": "Ausweis scannen, Code eingeben oder das Mitglied nach Namen suchen"
 }
diff --git a/locale/en_US.json b/locale/en_US.json
index bb556e069..320a0f0b6 100644
--- a/locale/en_US.json
+++ b/locale/en_US.json
@@ -8630,7 +8630,6 @@
   "Ospiti": "Guests",
   "P. IVA": "VAT no.",
   "Partita IVA": "VAT number",
-  "Passa la tessera sul lettore o digita il codice": "Scan the card or type its code",
   "Presenza dell'ospite registrata.": "Guest visit recorded.",
   "Presenza registrata per %s, ma la tessera non è attiva.": "Visit recorded for %s, but the card is not active.",
   "Presenze": "Visits",
@@ -9322,5 +9321,7 @@
   "L'esito di questa importazione non è stato salvato: controlla il catalogo prima di importare di nuovo, con una nuova chiave.": "The outcome of this import was not saved: check the catalogue before importing again, with a new key.",
   "Impossibile salvare l'avanzamento dell'importazione: la riga non è stata contata, riprova.": "The import progress could not be saved: the row was not counted, try again.",
   "Utente importato, ma l'invito potrebbe essere già stato inviato: se non è arrivato, invialo di nuovo dalla scheda dell'utente.": "User imported, but the invitation may already have been sent: if it did not arrive, send it again from the user record.",
-  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "This search has reached the maximum number of imports: search again to continue."
+  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "This search has reached the maximum number of imports: search again to continue.",
+  "Tessera o nome del socio": "Card or member name",
+  "Passa la tessera, digita il codice o cerca il socio per nome": "Scan the card, type its code or search for the member by name"
 }
diff --git a/locale/fr_FR.json b/locale/fr_FR.json
index 48d5d4e8f..abca4f6f0 100644
--- a/locale/fr_FR.json
+++ b/locale/fr_FR.json
@@ -8630,7 +8630,6 @@
   "Ospiti": "Invités",
   "P. IVA": "N° TVA",
   "Partita IVA": "Numéro de TVA",
-  "Passa la tessera sul lettore o digita il codice": "Passez la carte sur le lecteur ou saisissez le code",
   "Presenza dell'ospite registrata.": "Visite de l’invité enregistrée.",
   "Presenza registrata per %s, ma la tessera non è attiva.": "Visite enregistrée pour %s, mais la carte n’est pas active.",
   "Presenze": "Visites",
@@ -9322,5 +9321,7 @@
   "L'esito di questa importazione non è stato salvato: controlla il catalogo prima di importare di nuovo, con una nuova chiave.": "Le résultat de cette importation n'a pas été enregistré : vérifiez le catalogue avant d'importer à nouveau, avec une nouvelle clé.",
   "Impossibile salvare l'avanzamento dell'importazione: la riga non è stata contata, riprova.": "La progression de l'importation n'a pas pu être enregistrée : la ligne n'a pas été comptée, réessayez.",
   "Utente importato, ma l'invito potrebbe essere già stato inviato: se non è arrivato, invialo di nuovo dalla scheda dell'utente.": "Utilisateur importé, mais l'invitation a peut-être déjà été envoyée : si elle n'est pas arrivée, renvoyez-la depuis la fiche de l'utilisateur.",
-  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "Cette recherche a atteint le nombre maximal d'importations : relancez la recherche pour continuer."
+  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "Cette recherche a atteint le nombre maximal d'importations : relancez la recherche pour continuer.",
+  "Tessera o nome del socio": "Carte ou nom du membre",
+  "Passa la tessera, digita il codice o cerca il socio per nome": "Passez la carte, saisissez son code ou cherchez le membre par son nom"
 }
diff --git a/locale/it_IT.json b/locale/it_IT.json
index 2adcca19a..b65921065 100644
--- a/locale/it_IT.json
+++ b/locale/it_IT.json
@@ -8630,7 +8630,6 @@
   "Ospiti": "Ospiti",
   "P. IVA": "P. IVA",
   "Partita IVA": "Partita IVA",
-  "Passa la tessera sul lettore o digita il codice": "Passa la tessera sul lettore o digita il codice",
   "Presenza dell'ospite registrata.": "Presenza dell'ospite registrata.",
   "Presenza registrata per %s, ma la tessera non è attiva.": "Presenza registrata per %s, ma la tessera non è attiva.",
   "Presenze": "Presenze",
@@ -9322,5 +9321,7 @@
   "L'esito di questa importazione non è stato salvato: controlla il catalogo prima di importare di nuovo, con una nuova chiave.": "L'esito di questa importazione non è stato salvato: controlla il catalogo prima di importare di nuovo, con una nuova chiave.",
   "Impossibile salvare l'avanzamento dell'importazione: la riga non è stata contata, riprova.": "Impossibile salvare l'avanzamento dell'importazione: la riga non è stata contata, riprova.",
   "Utente importato, ma l'invito potrebbe essere già stato inviato: se non è arrivato, invialo di nuovo dalla scheda dell'utente.": "Utente importato, ma l'invito potrebbe essere già stato inviato: se non è arrivato, invialo di nuovo dalla scheda dell'utente.",
-  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare."
+  "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.": "Questa ricerca ha raggiunto il numero massimo di importazioni: ripeti la ricerca per continuare.",
+  "Tessera o nome del socio": "Tessera o nome del socio",
+  "Passa la tessera, digita il codice o cerca il socio per nome": "Passa la tessera, digita il codice o cerca il socio per nome"
 }
diff --git a/tests/attendance-member-search.spec.js b/tests/attendance-member-search.spec.js
new file mode 100644
index 000000000..614c2333c
--- /dev/null
+++ b/tests/attendance-member-search.spec.js
@@ -0,0 +1,266 @@
+// @ts-check
+// Visitor log: the desk field also finds a member by name. Picking one records
+// the entry for that member (one who forgot the card), and a card reader that
+// types the code and sends Enter is never captured by the suggestion list.
+const { execFileSync } = require('child_process');
+const { test, expect } = require('@playwright/test');
+
+const featureToggles = require('./helpers/feature-toggles');
+let featureSnapshot;
+test.beforeAll(async () => { featureSnapshot = await featureToggles.enableFeatures(['visitor_log']); });
+test.afterAll(async () => { await featureToggles.restoreFeatures(featureSnapshot); });
+const h = require('./helpers/minor-features-090');
+
+test.skip(!h.configured, 'E2E credentials not configured');
+
+const STAMP = Date.now().toString(36);
+const CARD = `E2ES${STAMP}`.slice(0, 20);
+const CARD_B = `E2ET${STAMP}`.slice(0, 20);
+// A surname no other row has, so the search returns only these two members.
+const SURNAME = `Presenzi${STAMP}`;
+
+test.describe.serial('Visitor log: member search by name', () => {
+  let context;
+  let page;
+  let withCard = 0;
+  let bruno = 0;
+
+  const visits = (userId) => parseInt(h.dbQuery(`SELECT COUNT(*) FROM presenze WHERE utente_id = ${userId} AND tipo = 'socio'`), 10);
+  const suggestions = () => page.locator('#attendance-member-suggest .suggestion-item[data-id]');
+  const submitAndWait = (action) => Promise.all([page.waitForURL(/\/admin\/attendance$/), action()]);
+
+  test.beforeAll(async ({ browser }) => {
+    h.dbQuery(`INSERT INTO utenti (codice_tessera, nome, cognome, email, password, stato, tipo_utente) VALUES (${h.sqlString(CARD)}, 'Anna', ${h.sqlString(SURNAME)}, ${h.sqlString(`ps-a-${STAMP}@example.test`)}, 'x', 'attivo', 'standard')`);
+    withCard = parseInt(h.dbQuery(`SELECT id FROM utenti WHERE codice_tessera = ${h.sqlString(CARD)}`), 10);
+    h.dbQuery(`INSERT INTO utenti (codice_tessera, nome, cognome, email, password, stato, tipo_utente) VALUES (${h.sqlString(CARD_B)}, 'Bruno', ${h.sqlString(SURNAME)}, ${h.sqlString(`ps-b-${STAMP}@example.test`)}, 'x', 'attivo', 'standard')`);
+    bruno = parseInt(h.dbQuery(`SELECT id FROM utenti WHERE codice_tessera = ${h.sqlString(CARD_B)}`), 10);
+    context = await browser.newContext();
+    page = await context.newPage();
+    await h.loginAsAdmin(page);
+  });
+
+  test.afterAll(async () => {
+    try { h.dbQuery(`DELETE FROM presenze WHERE utente_id IN (${withCard}, ${bruno})`); } catch (_) { /* cleanup */ }
+    try { h.dbQuery(`DELETE FROM utenti WHERE id IN (${withCard}, ${bruno})`); } catch (_) { /* cleanup */ }
+    await context?.close();
+  });
+
+  test('1. Typing the surname lists the members; a click picks one and the entry is recorded for them', async () => {
+    await page.goto(`${h.BASE}/admin/attendance`);
+    await page.locator('#codice_tessera').pressSequentially(SURNAME.slice(0, 12));
+    await expect(suggestions()).toHaveCount(2);
+    await expect(suggestions().filter({ hasText: 'Anna' })).toContainText(`Tessera: ${CARD}`);
+    await suggestions().filter({ hasText: 'Anna' }).click();
+    await expect(page.locator('#attendance-member-suggest')).toBeHidden();
+    await expect(page.locator('#attendance-member-id')).toHaveValue(String(withCard));
+    await expect(page.locator('#attendance-scan-form button[type="submit"]')).toBeFocused();
+    await submitAndWait(() => page.click('#attendance-scan-form button[type="submit"]'));
+    await expect(page.getByText(/Benvenuto\/a, Anna P\.: presenza registrata\./)).toBeVisible();
+    expect(visits(withCard)).toBe(1);
+    expect(visits(bruno)).toBe(0);
+  });
+
+  test('2. A member is picked with the arrows and Enter, and recorded', async () => {
+    await page.goto(`${h.BASE}/admin/attendance`);
+    await page.locator('#codice_tessera').pressSequentially(`Bruno ${SURNAME}`);
+    await expect(suggestions()).toHaveCount(1);
+    await page.locator('#codice_tessera').press('ArrowDown');
+    await expect(suggestions().first()).toHaveClass(/selected/);
+    // The first Enter picks the highlighted member and does not submit.
+    await page.locator('#codice_tessera').press('Enter');
+    await expect(page.locator('#attendance-member-id')).toHaveValue(String(bruno));
+    expect(visits(bruno)).toBe(0);
+    await submitAndWait(() => page.keyboard.press('Enter'));
+    await expect(page.getByText(/Benvenuto\/a, Bruno P\.: presenza registrata\./)).toBeVisible();
+    expect(visits(bruno)).toBe(1);
+  });
+
+  test('3. A card typed by a reader is sent with Enter even while the list is open', async () => {
+    await page.goto(`${h.BASE}/admin/attendance`);
+    // The code also matches the search, so the list opens on it; nothing is
+    // highlighted, so Enter sends the code as before.
+    await page.locator('#codice_tessera').pressSequentially(CARD);
+    await expect(suggestions()).toHaveCount(1);
+    await submitAndWait(() => page.locator('#codice_tessera').press('Enter'));
+    await expect(page.getByText(/Benvenuto\/a, Anna P\.: presenza registrata\./)).toBeVisible();
+    expect(visits(withCard)).toBe(2);
+  });
+
+  test('4. Editing the field after a pick drops the picked member', async () => {
+    await page.goto(`${h.BASE}/admin/attendance`);
+    await page.locator('#codice_tessera').pressSequentially(`Bruno ${SURNAME}`);
+    await suggestions().first().click();
+    await expect(page.locator('#attendance-member-id')).toHaveValue(String(bruno));
+    await page.locator('#codice_tessera').fill(`NOPE${STAMP}`.slice(0, 20));
+    await expect(page.locator('#attendance-member-id')).toHaveValue('');
+    await submitAndWait(() => page.click('#attendance-scan-form button[type="submit"]'));
+    await expect(page.getByText('Tessera non riconosciuta. Controlla il codice o registra la visita come ospite.')).toBeVisible();
+    expect(visits(bruno)).toBe(1);
+  });
+
+  test('5. A picked id that matches no member is refused and nothing is recorded', async () => {
+    await page.goto(`${h.BASE}/admin/attendance`);
+    const before = parseInt(h.dbQuery('SELECT COUNT(*) FROM presenze'), 10);
+    const missing = parseInt(h.dbQuery('SELECT COALESCE(MAX(id), 0) + 1000 FROM utenti'), 10);
+    await page.evaluate((id) => { /** @type {HTMLInputElement} */ (document.getElementById('attendance-member-id')).value = String(id); }, missing);
+    await page.evaluate(() => { /** @type {HTMLInputElement} */ (document.getElementById('codice_tessera')).value = 'x'; });
+    await submitAndWait(() => page.click('#attendance-scan-form button[type="submit"]'));
+    await expect(page.getByText('Utente non trovato')).toBeVisible();
+    expect(parseInt(h.dbQuery('SELECT COUNT(*) FROM presenze'), 10)).toBe(before);
+  });
+});
+
+// Not serial: each case stands alone, so one failure cannot hide the others.
+test.describe('Visitor log: member search edge cases', () => {
+  const EDGE = `Bordi${STAMP}`;
+  const EDGE_CARD = `E2EU${STAMP}`.slice(0, 20);
+  const ROLE = `ZZ Presenze ${STAMP}`;
+  const OPERATOR_EMAIL = `ps-op-${STAMP}@example.test`;
+  const OPERATOR_PASS = `Op!${STAMP}Aa1`;
+  let member = 0;
+  let operator = 0;
+  let role = 0;
+
+  const field = (page) => page.locator('#codice_tessera');
+  const box = (page) => page.locator('#attendance-member-suggest');
+  const options = (page) => page.locator('#attendance-member-suggest .suggestion-item[data-id]');
+  const visits = () => parseInt(h.dbQuery(`SELECT COUNT(*) FROM presenze WHERE utente_id = ${member} AND tipo = 'socio'`), 10);
+  const sent = (page, action) => Promise.all([page.waitForURL(/\/admin\/attendance$/, { timeout: 8000 }), action()]);
+  const openDesk = async (page) => {
+    await h.loginAsAdmin(page);
+    await page.goto(`${h.BASE}/admin/attendance`);
+  };
+  const forge = (page, id) => page.evaluate((value) => {
+    /** @type {HTMLInputElement} */ (document.getElementById('attendance-member-id')).value = value;
+    /** @type {HTMLInputElement} */ (document.getElementById('codice_tessera')).value = 'x';
+  }, id);
+
+  test.beforeAll(() => {
+    h.dbQuery(`INSERT INTO utenti (codice_tessera, nome, cognome, email, password, stato, tipo_utente) VALUES (${h.sqlString(EDGE_CARD)}, 'Carla', ${h.sqlString(EDGE)}, ${h.sqlString(`ps-c-${STAMP}@example.test`)}, 'x', 'attivo', 'standard')`);
+    member = parseInt(h.dbQuery(`SELECT id FROM utenti WHERE codice_tessera = ${h.sqlString(EDGE_CARD)}`), 10);
+    h.dbQuery(`INSERT INTO ruoli (nome, permessi) VALUES (${h.sqlString(ROLE)}, '["backend.access","loans.manage"]')`);
+    role = parseInt(h.dbQuery(`SELECT id FROM ruoli WHERE nome = ${h.sqlString(ROLE)}`), 10);
+    const hash = execFileSync('php', ['-r', 'echo password_hash($argv[1], PASSWORD_DEFAULT);', OPERATOR_PASS], { encoding: 'utf-8' });
+    h.dbQuery(`INSERT INTO utenti (codice_tessera, nome, cognome, email, password, stato, email_verificata, tipo_utente, ruolo_id, privacy_accettata) VALUES (${h.sqlString(`E2EV${STAMP}`.slice(0, 20))}, 'Olga', 'Operatrice', ${h.sqlString(OPERATOR_EMAIL)}, ${h.sqlString(hash)}, 'attivo', 1, 'standard', ${role}, 1)`);
+    operator = parseInt(h.dbQuery(`SELECT id FROM utenti WHERE email = ${h.sqlString(OPERATOR_EMAIL)}`), 10);
+  });
+
+  test.afterAll(() => {
+    try { h.dbQuery(`DELETE FROM presenze WHERE utente_id IN (${member}, ${operator})`); } catch (_) { /* cleanup */ }
+    try { h.dbQuery(`DELETE FROM utenti WHERE id IN (${member}, ${operator})`); } catch (_) { /* cleanup */ }
+    try { h.dbQuery(`DELETE FROM ruoli WHERE id = ${role}`); } catch (_) { /* cleanup */ }
+  });
+
+  test('A highlight does not survive more typing: Enter then sends the text', async ({ page }) => {
+    await openDesk(page);
+    await field(page).pressSequentially(`Carla ${EDGE}`);
+    await expect(options(page)).toHaveCount(1);
+    await field(page).press('ArrowDown');
+    await expect(options(page).first()).toHaveClass(/selected/);
+    // A reader firing into the field: new text and Enter, before the list refreshes.
+    await field(page).press('x');
+    await sent(page, () => field(page).press('Enter'));
+    await expect(page.getByText('Tessera non riconosciuta. Controlla il codice o registra la visita come ospite.')).toBeVisible();
+    expect(visits()).toBe(0);
+  });
+
+  test('Escape also stops a search still waiting to start', async ({ page }) => {
+    await openDesk(page);
+    await field(page).pressSequentially(`Carla ${EDGE}`);
+    await field(page).press('Escape');
+    await page.waitForTimeout(900);
+    await expect(box(page)).toBeHidden();
+  });
+
+  test('A failed search says so instead of claiming nobody matches', async ({ page }) => {
+    await openDesk(page);
+    await page.route('**/api/search/utenti*', (route) => route.fulfill({ status: 500, contentType: 'application/json', body: '{"error":true}' }));
+    await field(page).pressSequentially(EDGE);
+    await expect(box(page)).toContainText('Ricerca non disponibile. Riprova.');
+    await page.unroute('**/api/search/utenti*');
+    await page.route('**/api/search/utenti*', (route) => route.fulfill({ status: 200, contentType: 'application/json', body: '{"error":true}' }));
+    await field(page).press('a');
+    await expect(box(page)).toContainText('Ricerca non disponibile. Riprova.');
+    await expect(box(page)).not.toContainText('Nessun risultato');
+    await page.unroute('**/api/search/utenti*');
+    await field(page).fill('');
+    await field(page).pressSequentially(`Nessuno${STAMP}`);
+    await expect(box(page)).toContainText('Nessun risultato');
+  });
+
+  test('Leaving the field closes the list; pressing inside it keeps the field', async ({ page }) => {
+    await openDesk(page);
+    await field(page).pressSequentially(`Nessuno${STAMP}`);
+    await expect(box(page)).toContainText('Nessun risultato');
+    await box(page).locator('.suggestion-item').click();
+    await expect(field(page)).toBeFocused();
+    await expect(box(page)).toBeVisible();
+    await field(page).press('Tab');
+    await expect(box(page)).toBeHidden();
+  });
+
+  test('The list is announced to assistive technology', async ({ page }) => {
+    await openDesk(page);
+    await field(page).pressSequentially(`Carla ${EDGE}`);
+    await expect(options(page)).toHaveCount(1);
+    await expect(box(page)).toHaveAttribute('aria-label', /.+/);
+    await field(page).press('ArrowDown');
+    const optionId = await options(page).first().getAttribute('id');
+    expect(optionId).toBeTruthy();
+    await expect(field(page)).toHaveAttribute('aria-activedescendant', String(optionId));
+    await field(page).press('Escape');
+    await expect(field(page)).not.toHaveAttribute('aria-activedescendant', /.+/);
+    await field(page).fill('');
+    await field(page).pressSequentially(`Nessuno${STAMP}`);
+    await expect(box(page).locator('.suggestion-item')).toHaveAttribute('role', 'option');
+  });
+
+  test('On a phone the field and its list stay inside the screen', async ({ page }) => {
+    await page.setViewportSize({ width: 375, height: 812 });
+    await openDesk(page);
+    await field(page).pressSequentially(`Carla ${EDGE}`);
+    await expect(options(page)).toHaveCount(1);
+    const fits = await page.evaluate(() => {
+      const edge = (id) => { const r = document.getElementById(id).getBoundingClientRect(); return { left: r.left, right: r.right, width: r.width }; };
+      return { page: document.documentElement.scrollWidth, view: window.innerWidth, field: edge('codice_tessera'), list: edge('attendance-member-suggest'), scan: edge('attendance-card-scan') };
+    });
+    expect(fits.page).toBeLessThanOrEqual(fits.view);
+    expect(fits.list.left).toBeGreaterThanOrEqual(0);
+    expect(fits.list.right).toBeLessThanOrEqual(fits.view);
+    expect(fits.scan.right).toBeLessThanOrEqual(fits.view);
+    expect(fits.field.width).toBeGreaterThan(120);
+  });
+
+  test('A malformed member id is not read as a number', async ({ page }) => {
+    await openDesk(page);
+    const before = visits();
+    await forge(page, `${member}abc`);
+    await sent(page, () => page.click('#attendance-scan-form button[type="submit"]'));
+    await expect(page.getByText('Tessera non riconosciuta. Controlla il codice o registra la visita come ospite.')).toBeVisible();
+    expect(visits()).toBe(before);
+  });
+
+  test('A custom-role desk operator finds readers, and cannot reach a built-in account by id', async ({ page }) => {
+    await page.goto(`${h.BASE}/accedi`);
+    await page.fill('input[name="email"]', OPERATOR_EMAIL);
+    await page.fill('input[name="password"]', OPERATOR_PASS);
+    const rejectCookies = page.locator('#silktide-wrapper .reject-all');
+    if (await rejectCookies.isVisible()) await rejectCookies.click();
+    await Promise.all([page.waitForURL((url) => !/accedi/.test(url.pathname)), page.locator('button[type="submit"]').first().click()]);
+    await page.goto(`${h.BASE}/admin/attendance`);
+    const before = visits();
+    await field(page).pressSequentially(`Carla ${EDGE}`);
+    await expect(options(page)).toHaveCount(1);
+    await options(page).first().click();
+    await sent(page, () => page.click('#attendance-scan-form button[type="submit"]'));
+    await expect(page.getByText(/Benvenuto\/a, Carla B\.: presenza registrata\./)).toBeVisible();
+    expect(visits()).toBe(before + 1);
+    const admin = parseInt(h.dbQuery("SELECT id FROM utenti WHERE tipo_utente = 'admin' ORDER BY id LIMIT 1"), 10);
+    const adminVisits = () => parseInt(h.dbQuery(`SELECT COUNT(*) FROM presenze WHERE utente_id = ${admin}`), 10);
+    const adminBefore = adminVisits();
+    await forge(page, String(admin));
+    await sent(page, () => page.click('#attendance-scan-form button[type="submit"]'));
+    await expect(page.getByText('Utente non trovato')).toBeVisible();
+    expect(adminVisits()).toBe(adminBefore);
+  });
+});

From 7d0bfe06b5729fa79b3688830f807d1584bc22e1 Mon Sep 17 00:00:00 2001
From: fabiodalez-dev <fabiodalezbackup@gmail.com>
Date: Fri, 6 Nov 2026 02:03:39 +0100
Subject: [PATCH 2/3] Visitor log search: the focus stays in the field after a
 pick; a changed text drops the old list

After a pick the focus moved to "Registra ingresso", so the Enter of a card swiped by the next reader confirmed the member picked before. The field keeps the focus with its text selected: Enter confirms the pick, and a swipe replaces the name, drops the pick and sends that card. The results of the previous text are removed as soon as the text changes, so none can be picked while the new search runs.
---
 app/Views/attendance/index.php         | 17 +++++++----
 tests/attendance-member-search.spec.js | 42 +++++++++++++++++++++++---
 2 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/app/Views/attendance/index.php b/app/Views/attendance/index.php
index eba9d99dc..7068d8401 100644
--- a/app/Views/attendance/index.php
+++ b/app/Views/attendance/index.php
@@ -399,8 +399,12 @@ function choose(el) {
       picked.value = el.getAttribute('data-id') || '';
       card.value = el.textContent.trim();
       hide();
-      const submit = card.form.querySelector('button[type="submit"]');
-      if (submit) { submit.focus(); }
+      // The focus stays in the field, with its text selected: Enter there
+      // confirms the pick, and a card swiped by the next reader replaces the
+      // name, which drops the pick and sends that card, instead of reaching
+      // a focused button that would confirm the previous member.
+      card.focus();
+      card.select();
     }
     // A line that cannot be picked: no match, or a search that did not run.
     function notice(text) {
@@ -435,12 +439,13 @@ function show(rows) {
 
     card.addEventListener('input', function () {
       picked.value = '';
-      // The list on screen answers the previous text: a highlight on it must
-      // not catch the Enter a reader sends right after the new code.
-      highlight(-1);
+      // The list on screen answers the previous text: it goes at once, so
+      // neither a click nor the Enter a reader sends right after the new code
+      // can pick a member the field no longer names.
+      hide();
       const query = card.value.trim();
       cancel();
-      if (query.length < 2) { hide(); return; }
+      if (query.length < 2) { return; }
       timer = setTimeout(function () {
         request = new AbortController();
         fetch(endpoint + '?q=' + encodeURIComponent(query), { signal: request.signal, credentials: 'same-origin', headers: { 'Accept': 'application/json' } })
diff --git a/tests/attendance-member-search.spec.js b/tests/attendance-member-search.spec.js
index 614c2333c..9b2f44ee5 100644
--- a/tests/attendance-member-search.spec.js
+++ b/tests/attendance-member-search.spec.js
@@ -53,7 +53,8 @@ test.describe.serial('Visitor log: member search by name', () => {
     await suggestions().filter({ hasText: 'Anna' }).click();
     await expect(page.locator('#attendance-member-suggest')).toBeHidden();
     await expect(page.locator('#attendance-member-id')).toHaveValue(String(withCard));
-    await expect(page.locator('#attendance-scan-form button[type="submit"]')).toBeFocused();
+    // The focus stays in the field, so the next swipe cannot confirm this pick.
+    await expect(page.locator('#codice_tessera')).toBeFocused();
     await submitAndWait(() => page.click('#attendance-scan-form button[type="submit"]'));
     await expect(page.getByText(/Benvenuto\/a, Anna P\.: presenza registrata\./)).toBeVisible();
     expect(visits(withCard)).toBe(1);
@@ -114,10 +115,12 @@ test.describe.serial('Visitor log: member search by name', () => {
 test.describe('Visitor log: member search edge cases', () => {
   const EDGE = `Bordi${STAMP}`;
   const EDGE_CARD = `E2EU${STAMP}`.slice(0, 20);
+  const NEXT_CARD = `E2EW${STAMP}`.slice(0, 20);
   const ROLE = `ZZ Presenze ${STAMP}`;
   const OPERATOR_EMAIL = `ps-op-${STAMP}@example.test`;
   const OPERATOR_PASS = `Op!${STAMP}Aa1`;
   let member = 0;
+  let nextReader = 0;
   let operator = 0;
   let role = 0;
 
@@ -138,6 +141,8 @@ test.describe('Visitor log: member search edge cases', () => {
   test.beforeAll(() => {
     h.dbQuery(`INSERT INTO utenti (codice_tessera, nome, cognome, email, password, stato, tipo_utente) VALUES (${h.sqlString(EDGE_CARD)}, 'Carla', ${h.sqlString(EDGE)}, ${h.sqlString(`ps-c-${STAMP}@example.test`)}, 'x', 'attivo', 'standard')`);
     member = parseInt(h.dbQuery(`SELECT id FROM utenti WHERE codice_tessera = ${h.sqlString(EDGE_CARD)}`), 10);
+    h.dbQuery(`INSERT INTO utenti (codice_tessera, nome, cognome, email, password, stato, tipo_utente) VALUES (${h.sqlString(NEXT_CARD)}, 'Dario', ${h.sqlString(`Dopo${STAMP}`)}, ${h.sqlString(`ps-d-${STAMP}@example.test`)}, 'x', 'attivo', 'standard')`);
+    nextReader = parseInt(h.dbQuery(`SELECT id FROM utenti WHERE codice_tessera = ${h.sqlString(NEXT_CARD)}`), 10);
     h.dbQuery(`INSERT INTO ruoli (nome, permessi) VALUES (${h.sqlString(ROLE)}, '["backend.access","loans.manage"]')`);
     role = parseInt(h.dbQuery(`SELECT id FROM ruoli WHERE nome = ${h.sqlString(ROLE)}`), 10);
     const hash = execFileSync('php', ['-r', 'echo password_hash($argv[1], PASSWORD_DEFAULT);', OPERATOR_PASS], { encoding: 'utf-8' });
@@ -146,8 +151,8 @@ test.describe('Visitor log: member search edge cases', () => {
   });
 
   test.afterAll(() => {
-    try { h.dbQuery(`DELETE FROM presenze WHERE utente_id IN (${member}, ${operator})`); } catch (_) { /* cleanup */ }
-    try { h.dbQuery(`DELETE FROM utenti WHERE id IN (${member}, ${operator})`); } catch (_) { /* cleanup */ }
+    try { h.dbQuery(`DELETE FROM presenze WHERE utente_id IN (${member}, ${nextReader}, ${operator})`); } catch (_) { /* cleanup */ }
+    try { h.dbQuery(`DELETE FROM utenti WHERE id IN (${member}, ${nextReader}, ${operator})`); } catch (_) { /* cleanup */ }
     try { h.dbQuery(`DELETE FROM ruoli WHERE id = ${role}`); } catch (_) { /* cleanup */ }
   });
 
@@ -164,6 +169,33 @@ test.describe('Visitor log: member search edge cases', () => {
     expect(visits()).toBe(0);
   });
 
+  test('After a pick left unconfirmed, the next reader\'s swipe records that reader', async ({ page }) => {
+    await openDesk(page);
+    const nextVisits = () => parseInt(h.dbQuery(`SELECT COUNT(*) FROM presenze WHERE utente_id = ${nextReader} AND tipo = 'socio'`), 10);
+    const before = [visits(), nextVisits()];
+    await field(page).pressSequentially(`Carla ${EDGE}`);
+    await options(page).first().click();
+    await expect(page.locator('#attendance-member-id')).toHaveValue(String(member));
+    // A keyboard-wedge reader types the next card and sends Enter.
+    await field(page).pressSequentially(NEXT_CARD);
+    await expect(page.locator('#attendance-member-id')).toHaveValue('');
+    await sent(page, () => field(page).press('Enter'));
+    await expect(page.getByText(/Benvenuto\/a, Dario D\.: presenza registrata\./)).toBeVisible();
+    expect([visits(), nextVisits()]).toEqual([before[0], before[1] + 1]);
+  });
+
+  test('The list of the previous text goes as soon as the text changes', async ({ page }) => {
+    await openDesk(page);
+    await field(page).pressSequentially(`Carla ${EDGE}`);
+    await expect(options(page)).toHaveCount(1);
+    // Hold the next answer, so only the old list could still be on screen.
+    await page.route('**/api/search/utenti*', async (route) => { await new Promise((r) => setTimeout(r, 1500)); await route.continue(); });
+    await field(page).press('x');
+    await expect(options(page)).toHaveCount(0);
+    await expect(box(page)).toBeHidden();
+    await page.unroute('**/api/search/utenti*');
+  });
+
   test('Escape also stops a search still waiting to start', async ({ page }) => {
     await openDesk(page);
     await field(page).pressSequentially(`Carla ${EDGE}`);
@@ -192,7 +224,9 @@ test.describe('Visitor log: member search edge cases', () => {
     await openDesk(page);
     await field(page).pressSequentially(`Nessuno${STAMP}`);
     await expect(box(page)).toContainText('Nessun risultato');
-    await box(page).locator('.suggestion-item').click();
+    // The line is aria-disabled, so Playwright would wait for it forever:
+    // force the press, which is exactly what this case is about.
+    await box(page).locator('.suggestion-item').click({ force: true });
     await expect(field(page)).toBeFocused();
     await expect(box(page)).toBeVisible();
     await field(page).press('Tab');

From 7781513086215e4552223e51b57740f318ca5e67 Mon Sep 17 00:00:00 2001
From: fabiodalez-dev <fabiodalezbackup@gmail.com>
Date: Fri, 6 Nov 2026 03:15:57 +0100
Subject: [PATCH 3/3] Tests: the malformed-answer search starts from an empty
 field

The notice of the first failed search could satisfy the assertions of the second one before it ran. The field is cleared first, so only the non-array answer brings the notice back.
---
 tests/attendance-member-search.spec.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/attendance-member-search.spec.js b/tests/attendance-member-search.spec.js
index 9b2f44ee5..1ef09f0b8 100644
--- a/tests/attendance-member-search.spec.js
+++ b/tests/attendance-member-search.spec.js
@@ -211,7 +211,11 @@ test.describe('Visitor log: member search edge cases', () => {
     await expect(box(page)).toContainText('Ricerca non disponibile. Riprova.');
     await page.unroute('**/api/search/utenti*');
     await page.route('**/api/search/utenti*', (route) => route.fulfill({ status: 200, contentType: 'application/json', body: '{"error":true}' }));
-    await field(page).press('a');
+    // Start the second search from an empty field, so the notice of the first
+    // error is gone and only the non-array answer can bring it back.
+    await field(page).fill('');
+    await expect(box(page)).toBeHidden();
+    await field(page).pressSequentially(`${EDGE}a`);
     await expect(box(page)).toContainText('Ricerca non disponibile. Riprova.');
     await expect(box(page)).not.toContainText('Nessun risultato');
     await page.unroute('**/api/search/utenti*');