🔧 Code review audit batch (May 14) — fixes umbrella #127

New issue

Closed

opened 2026-05-14 20:27:38 +00:00 by lekss361 · 1 comment

lekss361 commented

2026-05-14 20:27:38 +00:00

(Migrated from github.com)

Context

Full project code review (May 14, 2026) запущен 6 параллельных subagent'ов — backend API + services/scrapers + workers + frontend + database + cross-cutting. Audit нашёл 7 critical + numerous high/medium issues. Этот umbrella tracker — для P1 hot fixes из audit.

P1 Audit Findings → PRs (in flight)

Severity	Finding	PR	Status
Security	`nspd_geo.enqueue_geo_job` — SQL injection vector через f-string + `chr(39)*2` quote escape	#123	OPEN
Correctness	`pzz_loader.py` — bare `db.rollback()` в loop без SAVEPOINT	#124	OPEN
DB hygiene	`rosreestr_deals_period_brin` — dead BRIN на partitioned parent	#122	OPEN
DB integrity	`73_complexes_master.sql` — нет `BEGIN/COMMIT` обёртки	#125	OPEN
Time-sensitive	`nspd-harvest-stale-quarters` beat запустится Mon 04:00 МСК	#121	OPEN
Incident fix	Frontend healthcheck re-apply (после incident #117)	#120	OPEN

P2/P3 Follow-up Work

parcels.py decomposition (1068 lines)
analytics_queries.py split (2571 → 5 files)
domrf_kn.py split _norm/_db/_sweep (1429 lines)
admin/scrape/page.tsx decomposition (1040 lines)
Frontend SectionLabel/EmptyState DRY extraction
_check_token → app/core/deps.py
renderMarkdown URL validation
celery_app.py → workers/lifecycle.py split

Vault refs

events/Incident_Prod_Down_May14_2026.md
fixes/Bug_NSPD_WMS_NotBulk_2026_May14.md
fixes/Bug_Nspd_Geo_Sql_Injection_May14.md
fixes/Bug_Pzz_Loader_Missing_Savepoint_May14.md
fixes/Migration_Drop_Dead_Brin_May14.md
fixes/Migration_73_Complexes_Atomic_May14.md

Related: #126 (NSPD WMS bulk fix Sprint 2)

## Context Full project code review (May 14, 2026) запущен 6 параллельных subagent'ов — backend API + services/scrapers + workers + frontend + database + cross-cutting. Audit нашёл 7 critical + numerous high/medium issues. Этот umbrella tracker — для P1 hot fixes из audit. ## P1 Audit Findings → PRs (in flight) | Severity | Finding | PR | Status | |---|---|---:|---| | Security | `nspd_geo.enqueue_geo_job` — SQL injection vector через f-string + `chr(39)*2` quote escape | **#123** | OPEN | | Correctness | `pzz_loader.py` — bare `db.rollback()` в loop без SAVEPOINT | **#124** | OPEN | | DB hygiene | `rosreestr_deals_period_brin` — dead BRIN на partitioned parent | **#122** | OPEN | | DB integrity | `73_complexes_master.sql` — нет `BEGIN/COMMIT` обёртки | **#125** | OPEN | | Time-sensitive | `nspd-harvest-stale-quarters` beat запустится Mon 04:00 МСК | **#121** | OPEN | | Incident fix | Frontend healthcheck re-apply (после incident #117) | **#120** | OPEN | ## P2/P3 Follow-up Work - `parcels.py` decomposition (1068 lines) - `analytics_queries.py` split (2571 → 5 files) - `domrf_kn.py` split _norm/_db/_sweep (1429 lines) - `admin/scrape/page.tsx` decomposition (1040 lines) - Frontend SectionLabel/EmptyState DRY extraction - `_check_token` → `app/core/deps.py` - renderMarkdown URL validation - `celery_app.py` → `workers/lifecycle.py` split ## Vault refs - `events/Incident_Prod_Down_May14_2026.md` - `fixes/Bug_NSPD_WMS_NotBulk_2026_May14.md` - `fixes/Bug_Nspd_Geo_Sql_Injection_May14.md` - `fixes/Bug_Pzz_Loader_Missing_Savepoint_May14.md` - `fixes/Migration_Drop_Dead_Brin_May14.md` - `fixes/Migration_73_Complexes_Atomic_May14.md` Related: #126 (NSPD WMS bulk fix Sprint 2)

lekss361 commented

2026-05-16 17:27:56 +00:00

Owner

Закрываю — все 6 P1 PRs из umbrella смержены:

PR #120 — frontend healthcheck re-apply (b3f32ae)
PR #121 — disable nspd-harvest-stale-quarters beat (f579417)
PR #122 — DROP dead BRIN rosreestr_deals_period_brin (7b32edc)
PR #123 — parametrized batch для nspd_geo enqueue (8dfab76)
PR #124 — SAVEPOINT per-row в pzz_loader (a3e7d21)
PR #125 — BEGIN/COMMIT обёртка для 73_complexes_master.sql (8a26650)

P2/P3 follow-up (parcels.py decomposition, analytics_queries split, domrf_kn.py split и т.п.) — не входили в hot fixes scope, остаются на backlog. Завести отдельные issues при необходимости.

Закрываю — все 6 P1 PRs из umbrella смержены: - PR #120 — frontend healthcheck re-apply (b3f32ae) - PR #121 — disable nspd-harvest-stale-quarters beat (f579417) - PR #122 — DROP dead BRIN rosreestr_deals_period_brin (7b32edc) - PR #123 — parametrized batch для nspd_geo enqueue (8dfab76) - PR #124 — SAVEPOINT per-row в pzz_loader (a3e7d21) - PR #125 — BEGIN/COMMIT обёртка для 73_complexes_master.sql (8a26650) P2/P3 follow-up (parcels.py decomposition, analytics_queries split, domrf_kn.py split и т.п.) — не входили в hot fixes scope, остаются на backlog. Завести отдельные issues при необходимости.