From a54b4cc7bb4395b0b198725373b8a7786d60c1c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=BE=9D=E7=91=AA=E8=B2=93?= <imacat@mail.imacat.idv.tw>
Date: Tue, 10 Mar 2026 07:37:37 +0800
Subject: [PATCH] Use globalThis instead of window for global object access
 (S7764)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/stores/files.ts | 6 +++---
 src/stores/login.ts | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/stores/files.ts b/src/stores/files.ts
index bcde0f3..8451480 100644
--- a/src/stores/files.ts
+++ b/src/stores/files.ts
@@ -271,7 +271,7 @@ export const useFilesStore = defineStore("filesStore", {
      * @param {number} id - The file ID.
      */
     async deleteFile(type, id) {
-      if (id === null || id === undefined || isNaN(id)) {
+      if (id === null || id === undefined || Number.isNaN(Number(id))) {
         console.error("Delete File API Error: invalid id");
         return;
       }
@@ -317,13 +317,13 @@ export const useFilesStore = defineStore("filesStore", {
         const response = await apiClient.get(`${getFileApiBase(type, id)}/csv`);
         const csvData = response.data;
         const blob = new Blob([csvData], { type: "text/csv" });
-        const url = window.URL.createObjectURL(blob);
+        const url = globalThis.URL.createObjectURL(blob);
         const link = document.createElement("a");
 
         link.href = url;
         link.download = `${fileName}.csv`;
         link.click();
-        window.URL.revokeObjectURL(url);
+        globalThis.URL.revokeObjectURL(url);
       } catch (error) {
         apiError(error, "Failed to download.");
       }
diff --git a/src/stores/login.ts b/src/stores/login.ts
index b3fba90..ab58b57 100644
--- a/src/stores/login.ts
+++ b/src/stores/login.ts
@@ -81,7 +81,7 @@ export const useLoginStore = defineStore("loginStore", {
           }
           // Only allow relative paths to prevent open redirect attacks
           if (decodedUrl.startsWith("/") && !decodedUrl.startsWith("//")) {
-            window.location.href = decodedUrl;
+            globalThis.location.href = decodedUrl;
             return;
           }
         }