kami
38 lines
1.7 KiB
Markdown
38 lines
1.7 KiB
Markdown
# Muzick — audit journal
|
|
|
|
## Goal
|
|
Audit the muzick project at `/home/kami/apps/muzick/`, file Vikunja tasks for findings, and work on autonomous items.
|
|
|
|
## Progress
|
|
|
|
### 2026-07-14 — Initial audit
|
|
|
|
**Git**: initialized, initial state committed (737bf19). Fixes committed in 42474c6.
|
|
|
|
**Project structure**: 196 files — TypeScript/Fastify backend, React/Vite frontend, BullMQ workers, PostgreSQL + Redis + Typesense.
|
|
|
|
### Fixes applied
|
|
1. **AGENTS.md tech stack**: `python/fastapi` → `fastify/typescript` (was wrong)
|
|
2. **CORS**: Added `@fastify/cors` plugin to backend with env-based origin config
|
|
3. **`.env.example`**: Created with placeholder values (secrets were only in `.env` which is gitignored)
|
|
4. **`backend/src/index.ts`**: Removed dead code (empty file, `server.ts` is real entry point)
|
|
|
|
### Tasks filed
|
|
- See Homelab infra project. Key items:
|
|
- #109: pin Docker images (NEEDS FIX — minio:latest etc)
|
|
- #110: N+1 queries in generators (PERFORMANCE)
|
|
- #111: image proxy SSRF guard (SECURITY)
|
|
|
|
### New critical issues found
|
|
1. **No auth on any API** — `x-user-id` header with hardcoded fallback UUID is the only identity
|
|
2. **Admin routes unprotected** — anyone can trigger scan/reindex/delete
|
|
3. **Postgres password "password"** hardcoded in docker-compose.yml
|
|
4. **Typesense API key "muzick-key"** hardcoded in docker-compose.yml
|
|
5. **SOCKS proxy IP** `192.168.1.104` exposed in .env and AGENTS.md
|
|
6. **No tests for any worker service** (1311-line enrichment.service.ts has 0 tests)
|
|
7. **Frontend never typechecked in CI**
|
|
8. **No input validation** on many routes (admin, library — `as any` casts)
|
|
|
|
### Remaining autonomous work items
|
|
- #109 — Pin Docker images in docker-compose.yml — CAN DO
|