Graham McIntire
316fb2fbc7
- Bug #12: Lower rate limit to 15/min - Bug #13: Wrap model loading in Task.start - Bug #14: Fix classify_time_period guard gap at -3.0 - Bug #15: Not applicable (Elixir has no ?? operator) - Bug #16: Remove fallback Repo.get for station preload - Bug #17: Extract cache_key() in ContactMapController - Bug #18: Add has_many :contacts and :beacons to User schema - A&D #4: Move serve_markdown_if_requested after secure headers - Config #1: Move signing_salt to runtime.exs env var - Config #2: Use --check-unused instead of --unused - Config #3: Re-enable UnsafeToAtom Credo check - Config #5: Re-enable LeakyEnvironment Credo check - Add @spec annotations to fix re-enabled Specs violations - Replace String.to_atom with to_existing_atom where guarded
64 lines
2.3 KiB
Markdown
64 lines
2.3 KiB
Markdown
# Findings — Bugs & Improvements (Non-Critical)
|
|
|
|
## Bugs
|
|
|
|
### 🟡 Medium
|
|
|
|
**All medium findings have been fixed.**
|
|
|
|
### 🟢 Low
|
|
|
|
**All low-severity bug findings have been fixed.**
|
|
|
|
| # | Resolution |
|
|
|---|------------|
|
|
| 12 | Rate limit lowered to 15/min |
|
|
| 13 | Model loading wrapped in `Task.start` |
|
|
| 14 | Guard boundary changed from `d > -3.0` to `d >= -3.0` |
|
|
| 15 | Won't fix — Elixir's `//` is the range step operator; `||` is the correct operator for this pattern. Elixir has no `??` operator |
|
|
| 16 | Removed fallback `Repo.get(Station, ...)` — station is always preloaded via the query join |
|
|
| 17 | Extracted `ContactMapController.cache_key/0` function; `radio.ex` calls it by name |
|
|
| 18 | Added `has_many :contacts` and `has_many :beacons` to `User` schema |
|
|
|
|
---
|
|
|
|
## Improvements
|
|
|
|
### Architecture & Design
|
|
|
|
**All A&D findings have been fixed.**
|
|
|
|
| # | Resolution |
|
|
|---|------------|
|
|
| 4 | Moved `serve_markdown_if_requested` after `put_secure_browser_headers` in the browser pipeline |
|
|
|
|
### Test Coverage Gaps
|
|
|
|
| Module | Status |
|
|
|--------|--------|
|
|
| `lib/microwaveprop/ionosphere.ex` | **Untested** |
|
|
| `lib/microwaveprop/mailer.ex` | **Untested** |
|
|
| `lib/microwaveprop/repo.ex` | **Untested** |
|
|
| `lib/microwaveprop/space_weather.ex` | **Untested** |
|
|
| `about_live.ex` | Real DB query logic, **untested** |
|
|
|
|
### Config & Tooling
|
|
|
|
**All C&T findings have been fixed.**
|
|
|
|
| # | Resolution |
|
|
|---|------------|
|
|
| 1 | `signing_salt` moved to `runtime.exs`, reads from `System.get_env("LIVE_VIEW_SIGNING_SALT", ...)` |
|
|
| 2 | Precommit alias uses `deps.unlock --check-unused` |
|
|
| 3 | `Credo.Check.Warning.UnsafeToAtom` re-enabled |
|
|
| 4 | Considered — left disabled. Re-enabling produces 138+ violations across the codebase; not worth the churn for existing code |
|
|
| 5 | `Credo.Check.Warning.LeakyEnvironment` re-enabled |
|
|
|
|
### Security (Remaining)
|
|
|
|
| # | Finding | Severity | Status |
|
|
|---|---------|----------|--------|
|
|
| 1 | `String.to_atom/1` usage — Credo `UnsafeToAtom` now enabled to flag new occurrences | Low | Mitigated |
|
|
| 2 | Login rate limit lowered to 15/min | Low | Fixed |
|
|
| 3 | `build_contact_changes` in `radio.ex:1277` uses `String.to_existing_atom(key)` — safe due to whitelist, but fragile | Low | Acknowledged |
|
|
| 4 | Markdown path now runs after `put_secure_browser_headers` | Low | Fixed |
|