kami
35 lines
1.2 KiB
Markdown
35 lines
1.2 KiB
Markdown
# muzick — overnight fix plan
|
|
|
|
## tasks
|
|
1. **fix N+1 queries** in generators.service.ts (#110, prio:4)
|
|
2. **fix SSRF guard** in images.routes.ts (#111, prio:3)
|
|
3. **clean & re-enrich images** (#124, prio:0 — operational)
|
|
4. **ethos UI migration** (#34, prio:5 — dispatched to ethos-ui agent)
|
|
|
|
## 1. N+1 queries
|
|
|
|
### comfortGenerator (lines 57-87)
|
|
current: loops 20 artists, `SELECT ... WHERE object_id = $1` per artist
|
|
fix: single query with `WHERE cf.object_id = ANY($1::uuid[])` + `unnest` to get per-artist rows back
|
|
|
|
### deepDiveGenerator (lines 248-274)
|
|
current: loops 20 albums, `SELECT ... WHERE t.album_id = $1` per album
|
|
fix: single query with `WHERE t.album_id = ANY($1::uuid[])` — already batched on artist query
|
|
|
|
### verification
|
|
`comfortGenerator` and `deepDiveGenerator` are tested in `generators.test.ts`
|
|
|
|
## 2. SSRF guard (images.routes.ts)
|
|
|
|
current: only checks `url.startsWith('http://') || url.startsWith('https://')` — trivial bypass
|
|
fix: add domain allowlist of known image hosts, validate after redirect
|
|
|
|
allowed domains:
|
|
- coverartarchive.org + *.coverartarchive.org
|
|
- lastfm.freetls.fastly.net
|
|
- i.scdn.co (spotify)
|
|
- images.genius.com
|
|
- *.musicbrainz.org
|
|
- commons.wikimedia.org
|
|
- e.snmc.io
|