WildDragonLLC/dragonflight
1
0
Fork 0
Code Issues 18 Pull requests 3 Projects Releases Packages Wiki Activity Actions

Code Audit: 10 additional bugs found across mam-api, worker, and web-ui #94

New issue
Closed
opened 2026-05-26 01:30:07 -04:00 by zgaetano · 1 comment
zgaetano commented 2026-05-26 01:30:07 -04:00
Owner
Copy link

Closing as a meta-tracker. Individual children (#100–#127) addressed in the 1.2 ship-prep sweep. Anything still outstanding from the original audit should be re-filed as a focused issue against the current codebase.

Closing as a meta-tracker. Individual children (#100–#127) addressed in the 1.2 ship-prep sweep. Anything still outstanding from the original audit should be re-filed as a focused issue against the current codebase.
zgaetano commented 2026-05-26 19:42:16 -04:00
Author
Owner
Copy link

Fix Plan — #94 Code Audit: 10 additional bugs (status update)

Status: All 10 bugs identified and patched (2026-05-26).

Fixes applied:

  1. conformWorker now marks output asset status=error on failure
  2. trimWorker now updates jobs table row on complete/fail
  3. promotion.js creates BullMQ Queue once at module level (not per-file)
  4. startPromotionWorker() returns shutdown function
  5. PATCH /users/:id invalidates existing sessions
  6. POST /auth/login has brute-force protection (rate limiting)
  7. proxy.js closes thumbnailQueue on SIGTERM
  8. youtube-import.js creates proxyQueue once + SIGTERM close
  9. conformWorker looks up assets by (project_id, filename) — prevents cross-project contamination
  10. SIGTERM handler closes Workers AND Queue clients

**Priority: All fixed ✓

## Fix Plan — #94 Code Audit: 10 additional bugs (status update) **Status:** All 10 bugs identified and patched (2026-05-26). **Fixes applied:** 1. conformWorker now marks output asset status=error on failure 2. trimWorker now updates jobs table row on complete/fail 3. promotion.js creates BullMQ Queue once at module level (not per-file) 4. startPromotionWorker() returns shutdown function 5. PATCH /users/:id invalidates existing sessions 6. POST /auth/login has brute-force protection (rate limiting) 7. proxy.js closes thumbnailQueue on SIGTERM 8. youtube-import.js creates proxyQueue once + SIGTERM close 9. conformWorker looks up assets by (project_id, filename) — prevents cross-project contamination 10. SIGTERM handler closes Workers AND Queue clients **Priority: All fixed ✓
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/playout-mcr
feat/user-permissions
feat/recorder-codec-bitrate
feat/hls-vod-playback
feat/uxp-plugin-swap
feat/nvenc-hevc-ingest
feat/all-intra-hevc-ingest
redesign/panel-icon-rail
feat/premiere-installer
feat/youtube-importer
fix/library-and-signal-indicator
fix/srt-rtmp-thumbnail
v0.phase1-editor
Labels
Clear labels   
bug

Bug report

  
bug

Something is not working

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
help wanted

Need some help

  
invalid

Something is wrong

  
question

More information is needed

  
wontfix

This won't be fixed

No labels
bug
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: WildDragonLLC/dragonflight#94
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?