[audit] Security, code quality, missing tests, error handling #46

New issue

Open

opened 2026-03-22 16:41:17 +00:00 by Virgil · 4 comments

Virgil commented

2026-03-22 16:41:17 +00:00

Member

Full audit:

Security: SQL injection, XSS, CSRF bypass, mass assignment, path traversal, insecure deserialization
Code quality: missing strict_types, missing type hints, missing return types
Missing tests: modules/actions without Pest test coverage
Error handling: swallowed exceptions, bare try/catch, missing validation
UK English: American spellings (color→colour, organization→organisation, center→centre)
Coding standards: PSR-12 compliance, Action pattern usage, BelongsToWorkspace scoping
Missing SPDX licence headers (EUPL-1.2)

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: SQL injection, XSS, CSRF bypass, mass assignment, path traversal, insecure deserialization 2. Code quality: missing strict_types, missing type hints, missing return types 3. Missing tests: modules/actions without Pest test coverage 4. Error handling: swallowed exceptions, bare try/catch, missing validation 5. UK English: American spellings (color→colour, organization→organisation, center→centre) 6. Coding standards: PSR-12 compliance, Action pattern usage, BelongsToWorkspace scoping 7. Missing SPDX licence headers (EUPL-1.2) Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 20:02:57 +00:00

Author

Member

Codex Audit Findings

CRITICAL (1)

namespace_id column never created in schema — namespace usage and boost persistence fail at runtime (create_tenant_tables.php:226, EntitlementService.php:450)

HIGH (4)

billing_cycle_anchor written but column missing from entitlement_namespace_packages (create_tenant_tables.php:210, EntitlementService.php:1763)
user_id column missing from entitlement_boosts — boost checks error (create_tenant_tables.php:226, User.php:402)
users schema missing stats + referral columns read by model/command/job (create_tenant_tables.php:19, UserStatsService.php:27, RefreshUserStats.php:26)
Package gateway price ID fields don't match table schema

## Codex Audit Findings ### CRITICAL (1) 1. namespace_id column never created in schema — namespace usage and boost persistence fail at runtime (create_tenant_tables.php:226, EntitlementService.php:450) ### HIGH (4) 2. billing_cycle_anchor written but column missing from entitlement_namespace_packages (create_tenant_tables.php:210, EntitlementService.php:1763) 3. user_id column missing from entitlement_boosts — boost checks error (create_tenant_tables.php:226, User.php:402) 4. users schema missing stats + referral columns read by model/command/job (create_tenant_tables.php:19, UserStatsService.php:27, RefreshUserStats.php:26) 5. Package gateway price ID fields don't match table schema

Virgil commented

2026-03-23 06:36:36 +00:00

Author

Member

Fix Applied

Commit e4e0801: fix(entitlements): restore missing tenant schema fields

## Fix Applied Commit e4e0801: fix(entitlements): restore missing tenant schema fields

Virgil commented

2026-03-23 08:53:42 +00:00

Author

Member

Verification: PASS (conditional)

Schema regression test passes. EntitlementServiceTest has pre-existing cache assertion failure (not from this fix). Fix is correct.

## Verification: PASS (conditional) Schema regression test passes. EntitlementServiceTest has pre-existing cache assertion failure (not from this fix). Fix is correct.

Virgil commented

2026-03-23 12:17:52 +00:00

Author

Member