towerops/lib/towerops_web
Graham McIntire 3a408a8dc1 Security hardening + performance fixes across codebase
CRITICAL:
- Membership: remove :role/:org_id/:user_id from mass-assignment cast; use explicit create_changeset/4 and role_update_changeset/2
- GraphQL member resolver: add authorize_invite/3 checking admin/owner role and role hierarchy
- REST invitations controller: add auth check for invite creation

HIGH:
- ApiToken: remove :organization_id/:user_id from cast; use explicit create_changeset/4

MEDIUM:
- Move 8 LiveView Ecto queries into context modules (Admin, Alerts, Coverages, OnCall, Snmp)
- Replace Process.put/Process.get with socket assigns for unresolved_alert_count (user_auth + layouts + 50 templates)
- Add batch get_utilization_for_interfaces/1 to eliminate N+1 capacity queries in device show
- Replace Process.sleep with Process.monitor/assert_receive or Process.send_after in 5 test files

LOW:
- Add handle_params/3 to UserResetPasswordLive, UserRegistrationLive, StatusPageLive
- Remove redundant Repo.preload calls; add preloads to list_site_devices/1
- Fix @impl annotations and credo nesting warnings
2026-06-21 17:40:50 -05:00
..
channels credo fixes 2026-06-14 08:27:57 -05:00
components Security hardening + performance fixes across codebase 2026-06-21 17:40:50 -05:00
controllers Security hardening + performance fixes across codebase 2026-06-21 17:40:50 -05:00
graphql Security hardening + performance fixes across codebase 2026-06-21 17:40:50 -05:00
helpers Major codebase cleanup: DRY schemas, remove dead config, consolidate modules 2026-06-16 15:29:22 -05:00
live Security hardening + performance fixes across codebase 2026-06-21 17:40:50 -05:00
plugs credo fixes 2026-06-14 08:27:57 -05:00
changelog_parser.ex remove-gleam (#218) 2026-03-29 11:03:20 -05:00
endpoint.ex fix: resolve session salts at runtime so prod release boots 2026-05-12 16:26:54 -05:00
gettext.ex init 2025-12-21 11:10:43 -06:00
gettext_helpers.ex feat: migrate email templates to gettext (Phase 2 - Emails) 2026-02-02 09:48:30 -06:00
graphql_socket.ex perf+refactor: codebase-wide query and antipattern audit 2026-04-28 16:58:51 -05:00
permissions.ex credo fixes 2026-06-14 08:27:57 -05:00
plug_exceptions.ex handle exceptions gracefully on api endpoints 2026-02-04 12:18:14 -06:00
remote_ip.ex fix: address security and reliability findings from bugs.md review 2026-05-11 18:54:12 -05:00
router.ex fix(oban): use DynamicLifeline in prod; add /health/live + split k8s probes 2026-05-20 12:07:29 -05:00
scoped_resource.ex fix: M1 — prevent cross-org resource existence probing via scoped fetch 2026-05-12 13:44:19 -05:00
telemetry.ex credo fixes 2026-06-14 08:27:57 -05:00
user_auth.ex Security hardening + performance fixes across codebase 2026-06-21 17:40:50 -05:00