golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(09): record code review disposition

Browse Source
This commit is contained in:
Jakub Zych
2026-10-01 21:43:15 +02:00
parent 9d2128acc2
commit 2ecc85ea19
1 changed files with 42 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-REVIEW-DISPOSITION.md
View File

@@ -5,83 +5,83 @@ titles: json
findings:
- id: CR-01
severity: critical
disposition: open
disposition: fixed
title: "Writable numeric fields cannot be saved; bad field values return 500 instead of 422"
- id: WR-01
severity: warning
disposition: open
disposition: fixed
title: "Required-permission wildcards never match, and multiple required codes use ALL rather than Winter's ANY"
- id: WR-02
severity: warning
disposition: open
disposition: fixed
title: "Navigation shows a denied parent item, including its label and target controller"
- id: WR-03
severity: warning
disposition: open
disposition: fixed
title: "Create, update and delete are not gated by the compiled list and form declarations"
- id: WR-04
severity: warning
disposition: open
disposition: fixed
title: "A form field that is `required` but limited by `context` makes every create fail"
- id: WR-05
severity: warning
disposition: open
disposition: fixed
title: "Relation link and unlink ignore the panel's toolbarButtons"
- id: WR-06
severity: warning
disposition: open
disposition: fixed
title: "A relation list without an explicit `sort` fails when the first column is not sortable"
- id: WR-07
severity: warning
disposition: open
disposition: fixed
title: "Relation column order depends on a fixed 16-space YAML indentation"
- id: WR-08
severity: warning
disposition: open
disposition: fixed
title: "List search returns 500 for non-text searchable columns, and the scaffold creates one"
- id: WR-09
severity: warning
disposition: open
disposition: fixed
title: "Scaffolded admin controllers have no permissions and no record source"
- id: WR-10
severity: warning
disposition: open
disposition: fixed
title: "Cabana silently reuses any guard already registered under the name \"backend\""
- id: WR-11
severity: warning
disposition: open
disposition: fixed
title: "Login identifier can resolve to the wrong admin; admin:create does not prevent login/email collisions"
- id: WR-12
severity: warning
disposition: open
disposition: fixed
title: "The dummy hash cost is fixed at 10 while real hashes use the configured cost (timing oracle)"
- id: WR-13
severity: warning
disposition: open
disposition: fixed
title: "Admin passwords are passed as command-line flags"
- id: WR-14
severity: warning
disposition: open
disposition: fixed
title: "Logout cannot revoke a token whose access lifetime has expired but whose refresh window is still open"
- id: WR-15
severity: warning
disposition: open
disposition: fixed
title: "The editors pivot `granted_by` stores a backend_users id in a frontend-user column"
- id: WR-16
severity: warning
disposition: open
disposition: fixed
title: "Reflection helpers skip embedded structs and fall back to case-insensitive Go field names"
- id: WR-17
severity: warning
disposition: open
disposition: fixed
title: "User-level `backend_users.permissions` is ignored, so Winter denies are lost at cutover"
- id: WR-18
severity: warning
disposition: open
disposition: fixed
title: "The phase gate's zero-test check applies per invocation, not per package"
- id: WR-19
severity: warning
disposition: open
disposition: fixed
title: "Plugin hooks and scopes query outside the CRUD transaction"
- id: IN-01
severity: info
@@ -131,35 +131,35 @@ findings:
severity: info
disposition: open
title: "The scaffold marks a file that must be edited as \"DO NOT EDIT\""
open: 32
open: 12
total: 32
recorded: 2026-09-27T21:52:17.704Z
recorded: 2026-10-01T19:43:14.734Z
---
# Phase 09: Code Review Disposition
| Finding | Severity | Disposition | Source |
|---------|----------|-------------|--------|
| CR-01 | critical | open | - |
| WR-01 | warning | open | - |
| WR-02 | warning | open | - |
| WR-03 | warning | open | - |
| WR-04 | warning | open | - |
| WR-05 | warning | open | - |
| WR-06 | warning | open | - |
| WR-07 | warning | open | - |
| WR-08 | warning | open | - |
| WR-09 | warning | open | - |
| WR-10 | warning | open | - |
| WR-11 | warning | open | - |
| WR-12 | warning | open | - |
| WR-13 | warning | open | - |
| WR-14 | warning | open | - |
| WR-15 | warning | open | - |
| WR-16 | warning | open | - |
| WR-17 | warning | open | - |
| WR-18 | warning | open | - |
| WR-19 | warning | open | - |
| CR-01 | critical | fixed | 09-REVIEW-FIX.md |
| WR-01 | warning | fixed | 09-REVIEW-FIX.md |
| WR-02 | warning | fixed | 09-REVIEW-FIX.md |
| WR-03 | warning | fixed | 09-REVIEW-FIX.md |
| WR-04 | warning | fixed | 09-REVIEW-FIX.md |
| WR-05 | warning | fixed | 09-REVIEW-FIX.md |
| WR-06 | warning | fixed | 09-REVIEW-FIX.md |
| WR-07 | warning | fixed | 09-REVIEW-FIX.md |
| WR-08 | warning | fixed | 09-REVIEW-FIX.md |
| WR-09 | warning | fixed | 09-REVIEW-FIX.md |
| WR-10 | warning | fixed | 09-REVIEW-FIX.md |
| WR-11 | warning | fixed | 09-REVIEW-FIX.md |
| WR-12 | warning | fixed | 09-REVIEW-FIX.md |
| WR-13 | warning | fixed | 09-REVIEW-FIX.md |
| WR-14 | warning | fixed | 09-REVIEW-FIX.md |
| WR-15 | warning | fixed | 09-REVIEW-FIX.md |
| WR-16 | warning | fixed | 09-REVIEW-FIX.md |
| WR-17 | warning | fixed | 09-REVIEW-FIX.md |
| WR-18 | warning | fixed | 09-REVIEW-FIX.md |
| WR-19 | warning | fixed | 09-REVIEW-FIX.md |
| IN-01 | info | open | - |
| IN-02 | info | open | - |
| IN-03 | info | open | - |