PCivil/inventory-system
Watch
1
0
Fork
You've already forked inventory-system
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

fix: resolve all flaws identified in CODEBASE-ANALYSIS.md #8

Merged
gabogg merged 2 commits from fix/codebase-flaws into dev 2026-06-23 15:19:17 +00:00
Conversation 0 Commits 2 Files changed 65 +1634 -1064
gabogg commented 2026-06-23 14:28:48 +00:00
Owner
Copy link

Summary

Fixes all findings from the codebase analysis document.

Security Fixes

  • Default credentials: startup fails if ADMIN_PASSWORD is not set (no more default "password")
  • JWT secret: SHA-256 hashing instead of naive byte-repeat; min 16 chars enforced
  • CORS: aligned code default with application.yml
  • Token revocation: added token_version column to users (V5 migration) — checked on every JWT-authenticated request

Code Quality

  • Service layer: created 12 domain services, moved @Transactional boundaries out of controllers
  • Dead code: removed duplicate branches in AuditService.commitDelete
  • PageUtil: moved from web/ to common/ package
  • Version: injected from build properties instead of hardcoded "2.0.0"

Bug Fixes

  • Admin password rotation: re-hash on re-seed when ADMIN_PASSWORD changes
  • Item deletion: disincorporation/adjustment now keeps items at quantity 0 instead of deleting
  • Transfer validation: pre-validate entry fields match request type before execution
  • Item name uniqueness: changed from global unique to composite (name, branch_id) via V6 migration
  • Bag audit: fixed integer overflow; uses long arithmetic consistently
  • Department name: made "Inbound" a named constant instead of hardcoded string

Test Impact

  • 212/212 backend tests passing (0 failures, 0 errors)
  • Hostile/adversarial tests updated to test service layer directly where validation moved
## Summary Fixes all findings from the codebase analysis document. ### Security Fixes - **Default credentials**: startup fails if ADMIN_PASSWORD is not set (no more default "password") - **JWT secret**: SHA-256 hashing instead of naive byte-repeat; min 16 chars enforced - **CORS**: aligned code default with application.yml - **Token revocation**: added `token_version` column to users (V5 migration) — checked on every JWT-authenticated request ### Code Quality - **Service layer**: created 12 domain services, moved @Transactional boundaries out of controllers - **Dead code**: removed duplicate branches in AuditService.commitDelete - **PageUtil**: moved from web/ to common/ package - **Version**: injected from build properties instead of hardcoded "2.0.0" ### Bug Fixes - **Admin password rotation**: re-hash on re-seed when ADMIN_PASSWORD changes - **Item deletion**: disincorporation/adjustment now keeps items at quantity 0 instead of deleting - **Transfer validation**: pre-validate entry fields match request type before execution - **Item name uniqueness**: changed from global unique to composite (name, branch_id) via V6 migration - **Bag audit**: fixed integer overflow; uses long arithmetic consistently - **Department name**: made "Inbound" a named constant instead of hardcoded string ### Test Impact - 212/212 backend tests passing (0 failures, 0 errors) - Hostile/adversarial tests updated to test service layer directly where validation moved
Security fixes:
- Require ADMIN_PASSWORD env var at startup (fail hard if not set)
- Replace JWT byte-repeat key derivation with SHA-256 hashing
- Align CORS default between code and config
- Add tokenVersion to User entity for JWT revocation (V5 migration)

Code quality fixes:
- Extract service layer: 12 domain services with @Transactional boundaries
- Move @Transactional from controllers to services
- Remove dead code in AuditService.commitDelete
- Move PageUtil from web/ to common/ package
- Inject app version from build properties instead of hardcoding

Bug fixes:
- Check ADMIN_PASSWORD on re-seed + increment tokenVersion on password change
- Keep item quantity at 0 instead of deleting on disincorporation/adjustment
- Add pre-validation of entry fields matching request type in executeRequest
- Change Item.name unique constraint to composite (name, branch_id) (V6 migration)
- Fix BagController audit: use long arithmetic, remove Optional wrapper
- Use configurable constant for default Inbound department name

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Flaw 11 - Repetitive @JsonIgnoreProperties:
Remove 'hibernateLazyInitializer' and 'handler' from all entity
@JsonIgnoreProperties annotations — Hibernate6Module handles
these globally via Jackson configuration.

Flaw 12 - Fragile bag barcode lookup:
Change endpoint from /api/bags/barcode/{barcode} (@PathVariable)
to /api/bags/by-barcode?barcode= (@RequestParam) for better
handling of special characters in barcodes.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
PCivil/inventory-system!8
No description provided.