From edffb2780cc231e194e1f7cd2b4de759c5138f3a Mon Sep 17 00:00:00 2001 From: Moheeb Zara Date: Sat, 1 Aug 2026 21:33:40 -0700 Subject: [PATCH] docs: record Phase A + Phase B progress in the audit log Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/AUDIT-2026-08.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/docs/AUDIT-2026-08.md b/docs/AUDIT-2026-08.md index 9a7064e..5f541b2 100644 --- a/docs/AUDIT-2026-08.md +++ b/docs/AUDIT-2026-08.md @@ -228,3 +228,39 @@ barrels** (full add-a-feature guide goes in `ARCHITECTURE.md`). - **Phase D — `ARCHITECTURE.md`** documenting the resulting structure + add-a-feature guide. Nothing is committed yet beyond this document. **No pushes to `main` without your explicit approval.** + +--- + +## Progress log + +### Phase A — tooling & type safety ✅ (branch `audit/cleanup-architecture`) +- `tsc --noEmit`: **586 → 0**. `next.config` `ignoreBuildErrors` **removed** — builds/deploys now type-check. +- Root cause fixed by annotating the Supabase client factories (`server`/`client`/`proxy`) as + `SupabaseClient`; `parseInput` rewritten to infer via `z.infer`; `flexibleDateTime` typed; + tsconfig target → ES2020; missing RPCs added to the generated types. A 40-agent behavior-preserving + sweep cleared the long tail (joins bridged with `as unknown as` + `// TODO(types)` to regenerate). +- **ESLint 9 flat config** added (`eslint.config.mjs`) — `pnpm run lint` now passes (0 errors). Added + `typecheck` script. `next build` green. + +### Phase B — confirmed fixes ✅ (one commit per fix, each with a regression test) +- **H1** invite `max_uses` TOCTOU → atomic compare-and-swap claim (`lib/invite-claim.ts`). +- **M1** board re-arming an admin invite → privilege guard on any re-arming field. +- **M2** `appealIncident` → restricted to admin/board; asserts the link UPDATE, rolls back orphan proposal. +- **M3** SSRF filter → blocks hex IPv4-mapped IPv6. +- **M4/M5** payment `last_paid_at` → advance-only (`resolveDuesAdvance`). +- **M6 / L6** members-list & payment-picker null derefs → guarded. +- **member-directory visibility gate** → repaired (was comparing against non-existent enum values). +- **L1** `reserveEquipment` → verifies target member is in the caller's space. +- **L2** unverified members → blocked from proposals/votes (per decision). +- **L5** `parseHeatSyncLog` → stale time-of-day + token-reuse fixed. +- **L7** CSV import → guards unparseable dates, never wedges the button. +- **Tests**: tautological `actions.test` replaced with real authz/IDOR tests; authz primitives covered. + 626 tests green. +- **Deferred — L3** (`markOnboardingStepDone` read-modify-write race): a correct fix needs a DB-side + atomic append (an RPC/migration) that can't be applied to the live DB from here. Low severity + (duplicate step-completions only). Follow-up: add a `jsonb` append RPC or a unique constraint. + +### Still open +- **CI runs no tests** (HIGH test-gap): add a GitHub Actions job running typecheck+lint+test (+ a + DB-backed integration run that fails on 0 executed tests). Not yet done — touches the deploy workflow. +- **Phase C** (refactor slices 0–9) and **Phase D** (`ARCHITECTURE.md`) — not started.