577 lines
21 KiB
JSON
577 lines
21 KiB
JSON
{
|
|
"phase": "deep-audit-verification",
|
|
"repositoryHead": "715873b2ecc3a72ba974bb2a2be87c5ba82bd4e7",
|
|
"executionMode": "ISOLATED_SEQUENTIAL_ROLE_EXECUTION",
|
|
"rawFindingCount": 11,
|
|
"rawFindingDispositions": [
|
|
{
|
|
"rawFindingId": "ARCH-001",
|
|
"disposition": "REVISED",
|
|
"resultingFindingIds": ["ARCH-001"],
|
|
"reason": "Clarified protocol desynchronization between storefront client and NestJS auth endpoints."
|
|
},
|
|
{
|
|
"rawFindingId": "FE-001",
|
|
"disposition": "REVISED",
|
|
"resultingFindingIds": ["FE-001"],
|
|
"reason": "Confidence downgraded from CONFIRMED to HIGH_CONFIDENCE due to static unverified user bounce claims."
|
|
},
|
|
{
|
|
"rawFindingId": "BE-001",
|
|
"disposition": "SPLIT",
|
|
"resultingFindingIds": ["BE-001", "BE-002"],
|
|
"reason": "Split floating-point precision error (BE-001) from synchronous N+1 query lookup (BE-002)."
|
|
},
|
|
{
|
|
"rawFindingId": "ADM-001",
|
|
"disposition": "ACCEPTED",
|
|
"resultingFindingIds": ["ADM-001"],
|
|
"reason": "Fully verified missing RolesGuard on settings routes."
|
|
},
|
|
{
|
|
"rawFindingId": "DB-001",
|
|
"disposition": "REJECTED_FALSE_POSITIVE",
|
|
"resultingFindingIds": [],
|
|
"reason": "Contradicted by schema evidence which contains @unique on mobile column."
|
|
},
|
|
{
|
|
"rawFindingId": "SEC-001",
|
|
"disposition": "ACCEPTED",
|
|
"resultingFindingIds": ["SEC-001"],
|
|
"reason": "Fully verified hardcoded JWT secret fallback in JwtStrategy."
|
|
},
|
|
{
|
|
"rawFindingId": "SEC-002",
|
|
"disposition": "SPLIT",
|
|
"resultingFindingIds": ["SEC-002", "SEC-003"],
|
|
"reason": "Retained SEC-002 for Math.random() PRNG and split SEC-003 for plaintext OTP code disclosure in sendOtp response payload."
|
|
},
|
|
{
|
|
"rawFindingId": "TS-001",
|
|
"disposition": "REVISED",
|
|
"resultingFindingIds": ["TS-001"],
|
|
"reason": "Severity downgraded from MEDIUM to LOW as maintainability defect."
|
|
},
|
|
{
|
|
"rawFindingId": "TEST-001",
|
|
"disposition": "ACCEPTED",
|
|
"resultingFindingIds": ["TEST-001"],
|
|
"reason": "Fully verified controller spec assertions failing TypeScript compilation."
|
|
},
|
|
{
|
|
"rawFindingId": "DEVOPS-001",
|
|
"disposition": "REVISED",
|
|
"resultingFindingIds": ["DEVOPS-001"],
|
|
"reason": "Severity adjusted from HIGH to MEDIUM; scope clarified to repository-visible workflow definitions."
|
|
},
|
|
{
|
|
"rawFindingId": "DOC-001",
|
|
"disposition": "ACCEPTED",
|
|
"resultingFindingIds": ["DOC-001"],
|
|
"reason": "Fully verified swagger.yml desynchronization with active NestJS auth routes."
|
|
}
|
|
],
|
|
"identifierAliases": {
|
|
"NEW-BE-002": "BE-002",
|
|
"NEW-SEC-003": "SEC-003",
|
|
"NEW-TS-002": "TS-002",
|
|
"NEW-TS-003": "TS-003"
|
|
},
|
|
"verifiedFindings": [
|
|
{
|
|
"id": "ARCH-001",
|
|
"sourceFindingIds": ["ARCH-001"],
|
|
"title": "Disconnected Authentication Protocols Between Storefront Client and Backend OTP API",
|
|
"domain": "Architecture",
|
|
"category": "API Contract Alignment / Authentication Architecture",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "React Storefront (src/) and NestJS Backend (backend/src/)",
|
|
"affectedFiles": [
|
|
"backend/src/auth/auth.controller.ts",
|
|
"backend/src/auth/auth.service.ts",
|
|
"src/store/userStore.ts",
|
|
"src/App.tsx"
|
|
],
|
|
"relevantSymbols": [
|
|
"AuthController.sendOtp",
|
|
"AuthController.verifyOtp",
|
|
"useUserStore"
|
|
],
|
|
"evidenceSummary": "Backend requires SMS OTP auth while frontend relies on mock email/password state.",
|
|
"problemSummary": "The storefront and backend implement incompatible authentication protocols.",
|
|
"rootCauseSummary": "Frontend was built with mock state before NestJS SMS OTP endpoints were finalized.",
|
|
"recommendedDirection": "Refactor storefront login components to invoke SMS OTP endpoints.",
|
|
"verificationRequirements": [
|
|
"Verify storefront submits phone number to /api/auth/send-otp and completes verify-otp flow."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test OTP login modal flow."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/05-architectural-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "FE-001",
|
|
"sourceFindingIds": ["FE-001"],
|
|
"title": "Absence of Declarative Router Causes SPA State Desynchronization on Direct Links",
|
|
"domain": "React / Vite Storefront",
|
|
"category": "Routing Architecture & Client Navigation",
|
|
"severity": "MEDIUM",
|
|
"confidence": "HIGH_CONFIDENCE",
|
|
"status": "OPEN",
|
|
"affectedApplication": "React Storefront (src/)",
|
|
"affectedFiles": [
|
|
"src/App.tsx",
|
|
"src/components/Header.tsx"
|
|
],
|
|
"relevantSymbols": [
|
|
"App.handlePopState"
|
|
],
|
|
"evidenceSummary": "Ad-hoc view switching logic via useState causes browser back/forward desynchronization.",
|
|
"problemSummary": "Lacks a declarative router abstraction, leading to fragile navigation.",
|
|
"rootCauseSummary": "State-driven view switching used instead of React Router.",
|
|
"recommendedDirection": "Adopt React Router or TanStack Router.",
|
|
"verificationRequirements": [
|
|
"Test browser back button navigation."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test router URL param mapping."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/06-storefront-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "BE-001",
|
|
"sourceFindingIds": ["BE-001"],
|
|
"title": "Floating-Point Conversion in Monetary Order Total Calculations",
|
|
"domain": "NestJS Backend",
|
|
"category": "Financial Calculations / Transaction Integrity",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/orders/orders.service.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"OrdersService.create"
|
|
],
|
|
"evidenceSummary": "Converts Prisma Decimal price values to JS primitive numbers in order total accumulation.",
|
|
"problemSummary": "Causes floating-point rounding inaccuracies in financial subtotal calculation.",
|
|
"rootCauseSummary": "Use of primitive Number arithmetic instead of Decimal.js.",
|
|
"recommendedDirection": "Use Decimal.js instance operations for order total accumulation.",
|
|
"verificationRequirements": [
|
|
"Verify order total preserves exact decimal precision."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test order creation with decimal prices."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/07-backend-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "BE-002",
|
|
"sourceFindingIds": ["BE-001"],
|
|
"title": "Synchronous N+1 Query Lookup in Order Item Processing",
|
|
"domain": "NestJS Backend",
|
|
"category": "Performance & Query Optimization",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/orders/orders.service.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"OrdersService.create"
|
|
],
|
|
"evidenceSummary": "Loops over order items executing synchronous findUnique database queries.",
|
|
"problemSummary": "N+1 database query bottleneck during cart checkout.",
|
|
"rootCauseSummary": "Individual query execution inside loop instead of batch findMany lookup.",
|
|
"recommendedDirection": "Batch product lookups using findMany with in filter.",
|
|
"verificationRequirements": [
|
|
"Verify checkout executes single database query for product lookup."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test order service batch query execution."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/07-backend-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "ADM-001",
|
|
"sourceFindingIds": ["ADM-001"],
|
|
"title": "Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints",
|
|
"domain": "Admin Features",
|
|
"category": "Authorization & Privilege Escalation",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/settings/settings.controller.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"SettingsController"
|
|
],
|
|
"evidenceSummary": "Settings routes apply JwtAuthGuard without RolesGuard or Admin role check.",
|
|
"problemSummary": "Any authenticated pet owner user can edit UI text labels or delete scientific terms.",
|
|
"rootCauseSummary": "Missing RolesGuard and @Roles('Admin') decorator on settings controller.",
|
|
"recommendedDirection": "Add RolesGuard and protect settings routes with @Roles('Admin').",
|
|
"verificationRequirements": [
|
|
"Verify non-admin JWT token receives 403 Forbidden on settings mutations."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test RolesGuard on settings endpoints."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/08-admin-features-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "SEC-001",
|
|
"sourceFindingIds": ["SEC-001"],
|
|
"title": "Insecure Default Hardcoded JWT Secret Key Fallback in Production Configuration",
|
|
"domain": "Security",
|
|
"category": "Cryptographic Failures & Hardcoded Credentials",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/auth/jwt.strategy.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"JwtStrategy"
|
|
],
|
|
"evidenceSummary": "JwtStrategy falls back to 'super-secret-key-canina' when JWT_SECRET env var is omitted.",
|
|
"problemSummary": "Enables attackers to forge JWT tokens if environment secret is missing.",
|
|
"rootCauseSummary": "Hardcoded fallback string provided in JwtStrategy constructor.",
|
|
"recommendedDirection": "Enforce mandatory startup check for JWT_SECRET without fallbacks.",
|
|
"verificationRequirements": [
|
|
"Verify backend fails to start when JWT_SECRET is unset."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test strategy initialization without secret."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/10-security-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "SEC-002",
|
|
"sourceFindingIds": ["SEC-002"],
|
|
"title": "Non-Cryptographic Random Generation of SMS OTP Authentication Codes",
|
|
"domain": "Security",
|
|
"category": "Identification & Authentication Failures",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/auth/auth.service.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"AuthService.sendOtp"
|
|
],
|
|
"evidenceSummary": "Uses Math.random() to generate 5-digit OTP authentication codes.",
|
|
"problemSummary": "PRNG outputs can be predicted by observing sequence outputs.",
|
|
"rootCauseSummary": "Use of Math.random() instead of Node.js crypto CSPRNG.",
|
|
"recommendedDirection": "Use crypto.randomInt for OTP code generation.",
|
|
"verificationRequirements": [
|
|
"Verify OTP generation relies on crypto module."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test sendOtp CSPRNG generation."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/10-security-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "SEC-003",
|
|
"sourceFindingIds": ["SEC-002"],
|
|
"title": "Plaintext OTP Disclosure in Public API Response Payload",
|
|
"domain": "Security",
|
|
"category": "Sensitive Data Exposure",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/auth/auth.controller.ts",
|
|
"backend/src/auth/auth.service.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"AuthService.sendOtp",
|
|
"AuthController.sendOtp"
|
|
],
|
|
"evidenceSummary": "sendOtp API returns generated verification code directly in JSON response payload ({ success: true, code: '12345' }).",
|
|
"problemSummary": "Discloses OTP verification code to client response body, enabling instant auth bypass.",
|
|
"rootCauseSummary": "Development shortcut returning OTP in API response payload.",
|
|
"recommendedDirection": "Remove code property from public sendOtp response payload.",
|
|
"verificationRequirements": [
|
|
"Verify /api/auth/send-otp response does not contain code field."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test sendOtp response body structure."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/10-security-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "TS-001",
|
|
"sourceFindingIds": ["TS-001"],
|
|
"title": "Explicit any Type Annotations in Main Application State",
|
|
"domain": "TypeScript and Code Quality",
|
|
"category": "Type Safety & Code Quality",
|
|
"severity": "LOW",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "React Storefront (src/)",
|
|
"affectedFiles": [
|
|
"src/App.tsx"
|
|
],
|
|
"relevantSymbols": [
|
|
"App.subView",
|
|
"App.advisorData"
|
|
],
|
|
"evidenceSummary": "App.tsx declares state variables using explicit any.",
|
|
"problemSummary": "Bypasses static type checking for sub-views.",
|
|
"rootCauseSummary": "Use of any escape hatch in state definitions.",
|
|
"recommendedDirection": "Replace any with explicit component prop interfaces.",
|
|
"verificationRequirements": [
|
|
"Verify type check passes with no explicit any in App.tsx."
|
|
],
|
|
"testingRequirements": [
|
|
"Unit test type checking."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/11-code-quality-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "TS-002",
|
|
"sourceFindingIds": ["DIAG-001"],
|
|
"title": "Missing Required slug Field in Prisma Product Seed Script",
|
|
"domain": "TypeScript and Code Quality",
|
|
"category": "Type Safety / Seed Scripting",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/prisma/seed.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"ProductCreateInput"
|
|
],
|
|
"evidenceSummary": "seed.ts product insertion payload lacks required slug property (TS2322 error).",
|
|
"problemSummary": "Database seeding fails compilation check.",
|
|
"rootCauseSummary": "Schema updated with required slug field without updating seed payload.",
|
|
"recommendedDirection": "Add slug property to product objects in seed.ts.",
|
|
"verificationRequirements": [
|
|
"Verify backend tsc compiles seed.ts without TS2322 errors."
|
|
],
|
|
"testingRequirements": [
|
|
"Compile seed script during build check."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/18-compiler-diagnostic-dispositions.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "TS-003",
|
|
"sourceFindingIds": ["DIAG-002"],
|
|
"title": "Non-Type-Only Import of Express Response in Decorated Controller",
|
|
"domain": "TypeScript and Code Quality",
|
|
"category": "Type Safety / Decorator Metadata",
|
|
"severity": "LOW",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/common/metrics.controller.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"MetricsController.getMetrics"
|
|
],
|
|
"evidenceSummary": "metrics.controller.ts imports express Response directly, causing TS1272 under isolatedModules.",
|
|
"problemSummary": "Triggers compiler error under isolatedModules and emitDecoratorMetadata.",
|
|
"rootCauseSummary": "Missing import type annotation on parameter decorator type.",
|
|
"recommendedDirection": "Use import type { Response } from 'express'.",
|
|
"verificationRequirements": [
|
|
"Verify metrics.controller.ts compiles cleanly."
|
|
],
|
|
"testingRequirements": [
|
|
"Run backend tsc compilation check."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/18-compiler-diagnostic-dispositions.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "TEST-001",
|
|
"sourceFindingIds": ["TEST-001"],
|
|
"title": "Stale Unit Test Specifications Asserting Obsolete Property Signatures",
|
|
"domain": "Testing and Reliability",
|
|
"category": "Test Quality & Suite Rot",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/pets/pets.controller.spec.ts",
|
|
"backend/src/settings/settings.controller.spec.ts",
|
|
"backend/src/users/users.controller.spec.ts"
|
|
],
|
|
"relevantSymbols": [
|
|
"PetsControllerSpec",
|
|
"SettingsControllerSpec",
|
|
"UsersControllerSpec"
|
|
],
|
|
"evidenceSummary": "Unit spec assertions check for obsolete result.success wrapper property.",
|
|
"problemSummary": "Unit test suite compilation fails under tsc.",
|
|
"rootCauseSummary": "Service return types updated without updating unit spec files.",
|
|
"recommendedDirection": "Update spec assertions to match entity return types.",
|
|
"verificationRequirements": [
|
|
"Verify backend tsc compiles all controller spec files cleanly."
|
|
],
|
|
"testingRequirements": [
|
|
"Execute jest test suite."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/12-testing-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "DEVOPS-001",
|
|
"sourceFindingIds": ["DEVOPS-001"],
|
|
"title": "Absence of Committed CI/CD Pipeline Workflow Definitions in Repository",
|
|
"domain": "DevOps and CI/CD",
|
|
"category": "Automation & Quality Gates",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "Repository Root (.)",
|
|
"affectedFiles": [
|
|
".github/workflows/"
|
|
],
|
|
"relevantSymbols": [],
|
|
"evidenceSummary": "No GitHub Actions or CI configuration committed to repository.",
|
|
"problemSummary": "Pull requests are not automatically subjected to build/test quality gates.",
|
|
"rootCauseSummary": "CI workflow definitions have not been added to repository.",
|
|
"recommendedDirection": "Add .github/workflows/ci.yml with lint, typecheck, and test steps.",
|
|
"verificationRequirements": [
|
|
"Verify GitHub Actions triggers on pull request."
|
|
],
|
|
"testingRequirements": [
|
|
"Test CI workflow execution."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/13-devops-audit.md"
|
|
]
|
|
},
|
|
{
|
|
"id": "DOC-001",
|
|
"sourceFindingIds": ["DOC-001"],
|
|
"title": "Static Swagger Specification Desynchronization with Active NestJS Auth Endpoints",
|
|
"domain": "Documentation",
|
|
"category": "API Documentation Drift",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "Root Documentation (swagger.yml)",
|
|
"affectedFiles": [
|
|
"swagger.yml",
|
|
"backend/src/auth/auth.controller.ts"
|
|
],
|
|
"relevantSymbols": [],
|
|
"evidenceSummary": "swagger.yml documents login/register while NestJS controller implements send-otp/verify-otp.",
|
|
"problemSummary": "Static OpenAPI documentation contradicts active backend endpoints.",
|
|
"rootCauseSummary": "swagger.yml authored as design draft prior to SMS OTP implementation.",
|
|
"recommendedDirection": "Update swagger.yml to match active NestJS Swagger decorators.",
|
|
"verificationRequirements": [
|
|
"Verify swagger.yml matches NestJS /api/docs OpenAPI output."
|
|
],
|
|
"testingRequirements": [
|
|
"Validate YAML syntax."
|
|
],
|
|
"sourceReports": [
|
|
"docs/audit/14-documentation-audit.md"
|
|
]
|
|
}
|
|
],
|
|
"rejectedFindings": [
|
|
{
|
|
"id": "DB-001",
|
|
"reason": "Contradicted by schema evidence which explicitly defines `@unique` on `mobile` column.",
|
|
"evidence": "backend/prisma/schema.prisma line 15: `mobile String? @unique @db.VarChar(15)`"
|
|
}
|
|
],
|
|
"compilerDiagnostics": {
|
|
"total": 6,
|
|
"accountedFor": 6,
|
|
"unaccounted": 0
|
|
},
|
|
"sourceCoverage": {
|
|
"totalAuthoritativeFiles": 139,
|
|
"inspected": 138,
|
|
"excludedBinary": 1,
|
|
"blocked": 0,
|
|
"unaccounted": 0
|
|
},
|
|
"counts": {
|
|
"verifiedTotal": 14,
|
|
"bySeverity": {
|
|
"CRITICAL": 0,
|
|
"HIGH": 6,
|
|
"MEDIUM": 6,
|
|
"LOW": 2,
|
|
"INFO": 0
|
|
},
|
|
"byConfidence": {
|
|
"CONFIRMED": 13,
|
|
"HIGH_CONFIDENCE": 1,
|
|
"NEEDS_VERIFICATION": 0,
|
|
"SPECULATIVE": 0
|
|
},
|
|
"byDomain": {
|
|
"Architecture": 1,
|
|
"React / Vite Storefront": 1,
|
|
"NestJS Backend": 2,
|
|
"Admin Features": 1,
|
|
"Security": 3,
|
|
"TypeScript and Code Quality": 3,
|
|
"Testing and Reliability": 1,
|
|
"DevOps and CI/CD": 1,
|
|
"Documentation": 1
|
|
},
|
|
"byStatus": {
|
|
"OPEN": 14
|
|
},
|
|
"byDisposition": {
|
|
"ACCEPTED": 4,
|
|
"REVISED": 4,
|
|
"SPLIT": 2,
|
|
"REJECTED_FALSE_POSITIVE": 1
|
|
}
|
|
},
|
|
"limitations": [
|
|
"Root tsc binary unlinked requiring npm install prior to root type check execution",
|
|
"Static evaluation conducted without connecting to live database engine"
|
|
],
|
|
"businessDecisions": [
|
|
"SMS Gateway provider binding for NestJS AuthService.sendOtp",
|
|
"Live payment gateway provider for wallet deposits",
|
|
"Roadmap for placeholder frontend/application directory"
|
|
]
|
|
}
|