chore/refactor #54

Merged

eliott merged 18 commits from chore/refactor into develop 2026-06-04 22:18:17 +02:00

Conversation 0 Commits 18 Files changed 32 +3199 -2090

eliott commented 2026-05-30 20:44:58 +02:00

Owner

• Copy link

No description provided.

eliott added 3 commits 2026-05-30 20:44:58 +02:00

chore: relicense under AGPL-3.0-or-later ... 960a55d27a

Add the AGPL-3.0 license text and set the package.json license field
accordingly (was UNLICENSED).

chore(deps): bump dependencies ... 0d6b0a62ec

Routine maintenance bump across NestJS, better-auth, and the test/build
toolchain (jest, ts-jest, prettier, tsx, typescript-eslint, etc.) with
the matching pnpm-lock.yaml update. No API-affecting changes.

feat(import): guard against zip bombs and cap request body size ... f6f1efe2c7

Reject a data.json whose declared uncompressed size exceeds
MAX_DATA_JSON_BYTES (64 MiB) before inflating, so a tiny compressed
entry cannot inflate to gigabytes and exhaust memory. Lower the upload
cap MAX_IMPORT_BYTES to 25 MiB (real exports are KB-to-low-MB) and set
explicit 128kb json/urlencoded body limits via AuthModule.forRoot so the
non-multipart bound is intentional rather than express's silent default.

eliott added 1 commit 2026-05-30 20:49:55 +02:00

Replace LICENSE with verbatim FSF AGPL-3.0 text 01c383e0ae

eliott added 1 commit 2026-06-03 21:42:25 +02:00

chore: move to 0.x versioning (8.1.2 -> 0.8.1), rewrite changelog versions a4668d00c1

eliott added 1 commit 2026-06-03 22:09:47 +02:00

ci: gate the test workflow behind a manual run-ci label 3ffdce76af

eliott added 1 commit 2026-06-03 22:14:08 +02:00

ci: drop label-name guard (skipped jobs report success, bypassing the gate) f66d6334ca

eliott added 1 commit 2026-06-04 19:45:33 +02:00

chore: drop redundant casts, fix generic .from() typing for drizzle 0.45 a34e752f38

eliott added 1 commit 2026-06-04 19:59:00 +02:00

fix: construct the pg Pool explicitly so the pg dependency is imported 14da48370d

eliott added 6 commits 2026-06-04 20:37:13 +02:00

Harden import pipeline, encryption, and input validation ... 76480d28dd

From a full-codebase review:

- import: run wipe + import in a single transaction so a failed import can
  no longer destroy existing data with nothing restored; compensate orphaned
  accounts from a failed CreateNew import; make DataWipe atomic
- import: reject zip bombs before decompression (entry-count + declared and
  actual uncompressed-size caps) and lower the compressed upload cap
- import: structurally validate the cast-only export payload before any DB
  write, so malformed archives fail with 400 instead of a mid-tx 500
- import: per-route throttle on /import and /import/preview; stop echoing
  Better-Auth internals on account-creation failure
- crypto: version-tag random-IV ciphertext for unambiguous detection;
  document the deterministic-encryption leakage tradeoff
- http: ValidationPipe transform:true; expose X-Request-Id via CORS
- config: require SMTP vars in production; depth-guard the FK cause chain

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

perf(import): batch row inserts instead of one query per row ... 6ed575b0e3

Each importer looped issuing a separate tx.insert per row, so a sizable
import meant hundreds-to-thousands of sequential round-trips holding the
import transaction (and its locks) open. Every row already gets an explicit
v7() id and no importer uses .returning(), so the per-row reuse/dedup logic
is unchanged — rows are now collected and flushed via a single chunked
batchInsert(tx, table, rows) per table. Identical ids, counts and label
reuse; far fewer round-trips.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

perf(frame): skip full-shoot renumber when delete leaves it gapless ... b6db63cfc4

Deleting any frame ran two full-shoot UPDATEs to recompact numbers to 1..N,
even when removing the highest-numbered frame. Numbers are distinct positive
integers, so the shoot is already gapless 1..N exactly when COUNT == MAX.
Check that cheaply after the delete and skip the rewrite when it holds (the
common case); only a gap left mid-sequence still falls back to the existing
negate-then-renumber two-pass. End state is unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

perf(export): derive counts from streamed rows, drop pre-count pass ... 0c7b1fc6f5

planExport fired 11 COUNT(*) queries to populate meta.counts and then both
export paths re-read every row anyway. buildExport now derives counts from
the arrays it already collects; streamArchive tallies rows as they stream and
emits meta (with counts) last. Safe because the importer does a full
JSON.parse (key order irrelevant) and never reads meta.counts, so the archive
format is unchanged. Removes the now-dead countRows from PagedQuery.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

refactor(api): simplify checkRef, shoot mutations, and changelog update ... 4360096921

- reference-validator: collapse the duplicated global/non-global branches in
  checkRef into a single query with a conditional column.
- shoot: route update/setPinned/setDone through one updateOwnedOrThrow helper
  instead of repeating the update-then-404 block three times.
- changelog: drop the pre-select existence check in update (TOCTOU); the
  UPDATE ... RETURNING already reports a missing row, and throwing before the
  item rewrite rolls the transaction back.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Merge pull request 'refactor/simplify' (#53) from refactor/simplify into chore/refactor ... 4bd6e53b63

Reviewed-on: #53

eliott added 2 commits 2026-06-04 21:39:49 +02:00

ci: pin fallow to 2.88.3 and disable its analysis cache ... b962a70d54

The v2 action tag floats across near-daily fallow releases while the
action's cache step restores .fallow/ through a prefix fallback key, so
a cache written by one fallow version can be read by another and corrupt
the new-only gate's introduced/inherited attribution. Pinning the CLI
version and forcing --no-cache makes the audit verdict deterministic.

chore: clear fallow dead-dep findings and apply lint autofixes ... 6fafb6d046

- ignore @nestjs/schematics (nest-cli collection), tsconfig-paths
  (test:debug -r register) and eslint-config-prettier (bundled via
  eslint-plugin-prettier/recommended) in .fallowrc.json: all three are
  toolchain usage invisible to import analysis
- remove @eslint/eslintrc and source-map-support: referenced nowhere in
  src, test, config or scripts
- drop two redundant type assertions flagged by the lockfile-pinned
  eslint --fix

eliott added the

run-ci

label 2026-06-04 21:40:09 +02:00

eliott added 1 commit 2026-06-04 21:51:28 +02:00

refactor(export): track JSON separator instead of first-row flag in streamQuery ... d2223497b0

Drops the per-row ternary, taking streamQuery from CRAP 30.0 (gate
threshold) to under it. This was the one introduced finding failing the
fallow audit gate: the action passes a line-scoped diff (diff-filter
added), so touching lines inside an at-threshold function counts the
finding as introduced even though the function predates the PR.

eliott merged commit 7ebad8033a into develop 2026-06-04 22:18:17 +02:00

eliott deleted branch chore/refactor 2026-06-04 22:18:17 +02:00

eliott referenced this pull request from a commit 2026-06-04 22:18:18 +02:00

Merge pull request 'chore/refactor' (#54) from chore/refactor into develop

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

run-ci

Trigger the required CI run

No labels

run-ci

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

RollNote/rollnote-api!54

No description provided.