towerops/lib/towerops_web/controllers/api
Graham McIntire 7e6ec7098c fix: 10 high-severity bugs from code audit (H1-H5, H14-H16, H27, H30)
- H1: batch count queries in MobileController (org sites/devices/alerts, site
  device counts) — reduces 1+3N+2M queries to 4 + 2
- H2: batch Oban cancel for stop_device_checks — single ANY(?) query instead
  of one per check
- H3: resolve_active_alerts_for_device uses update_all + deduped PubSub
  broadcasts (was N updates + N broadcasts)
- H4: atomic ON CONFLICT upsert for auto-discovery checks; restore partial
  unique index dropped in 20260404000002 (dedup migration included)
- H5: wrap apply_agent_to_all_equipment delete+insert in transaction so a
  failed insert_all rolls back the prior delete
- H14: replace String.to_integer/1 on untrusted SNMP OID components with
  Integer.parse/1 + validation (neighbor_discovery, discovery storage index,
  printer supply index)
- H15: ActivityFeedLive whitelists activity types against @all_types instead
  of String.to_existing_atom/1
- H16: defensive page param parsing in user_settings and admin dashboard
  LiveViews
- H27: search sanitize/1 delegates to QueryHelpers.sanitize_like/1 which
  escapes backslash first
- H30: JobCleanupTask no longer cancels jobs in "executing" state so
  in-flight polls complete naturally
2026-05-12 10:55:01 -05:00
..
v1 fix: 11 critical security/correctness bugs from code audit 2026-05-12 10:20:52 -05:00
account_data_controller.ex fix: 11 critical security/correctness bugs from code audit 2026-05-12 10:20:52 -05:00
error_helpers.ex perf: disable Req retry for faster error tests 2026-03-10 16:19:31 -05:00
mobile_auth_controller.ex fix: return raw session token instead of hash in mobile QR login (#42) 2026-03-16 13:59:52 -05:00
mobile_controller.ex fix: 10 high-severity bugs from code audit (H1-H5, H14-H16, H27, H30) 2026-05-12 10:55:01 -05:00