From 2ecc85ea19a307e39f785fcfa3446f5601a8856e Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Thu, 1 Oct 2026 21:43:15 +0200 Subject: [PATCH] docs(09): record code review disposition --- .../09-REVIEW-DISPOSITION.md | 84 +++++++++---------- 1 file changed, 42 insertions(+), 42 deletions(-) diff --git a/.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-REVIEW-DISPOSITION.md b/.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-REVIEW-DISPOSITION.md index 568c5be..07dc3f9 100644 --- a/.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-REVIEW-DISPOSITION.md +++ b/.planning/phases/09-backend-admin-authentication-and-schema-pipeline/09-REVIEW-DISPOSITION.md @@ -5,83 +5,83 @@ titles: json findings: - id: CR-01 severity: critical - disposition: open + disposition: fixed title: "Writable numeric fields cannot be saved; bad field values return 500 instead of 422" - id: WR-01 severity: warning - disposition: open + disposition: fixed title: "Required-permission wildcards never match, and multiple required codes use ALL rather than Winter's ANY" - id: WR-02 severity: warning - disposition: open + disposition: fixed title: "Navigation shows a denied parent item, including its label and target controller" - id: WR-03 severity: warning - disposition: open + disposition: fixed title: "Create, update and delete are not gated by the compiled list and form declarations" - id: WR-04 severity: warning - disposition: open + disposition: fixed title: "A form field that is `required` but limited by `context` makes every create fail" - id: WR-05 severity: warning - disposition: open + disposition: fixed title: "Relation link and unlink ignore the panel's toolbarButtons" - id: WR-06 severity: warning - disposition: open + disposition: fixed title: "A relation list without an explicit `sort` fails when the first column is not sortable" - id: WR-07 severity: warning - disposition: open + disposition: fixed title: "Relation column order depends on a fixed 16-space YAML indentation" - id: WR-08 severity: warning - disposition: open + disposition: fixed title: "List search returns 500 for non-text searchable columns, and the scaffold creates one" - id: WR-09 severity: warning - disposition: open + disposition: fixed title: "Scaffolded admin controllers have no permissions and no record source" - id: WR-10 severity: warning - disposition: open + disposition: fixed title: "Cabana silently reuses any guard already registered under the name \"backend\"" - id: WR-11 severity: warning - disposition: open + disposition: fixed title: "Login identifier can resolve to the wrong admin; admin:create does not prevent login/email collisions" - id: WR-12 severity: warning - disposition: open + disposition: fixed title: "The dummy hash cost is fixed at 10 while real hashes use the configured cost (timing oracle)" - id: WR-13 severity: warning - disposition: open + disposition: fixed title: "Admin passwords are passed as command-line flags" - id: WR-14 severity: warning - disposition: open + disposition: fixed title: "Logout cannot revoke a token whose access lifetime has expired but whose refresh window is still open" - id: WR-15 severity: warning - disposition: open + disposition: fixed title: "The editors pivot `granted_by` stores a backend_users id in a frontend-user column" - id: WR-16 severity: warning - disposition: open + disposition: fixed title: "Reflection helpers skip embedded structs and fall back to case-insensitive Go field names" - id: WR-17 severity: warning - disposition: open + disposition: fixed title: "User-level `backend_users.permissions` is ignored, so Winter denies are lost at cutover" - id: WR-18 severity: warning - disposition: open + disposition: fixed title: "The phase gate's zero-test check applies per invocation, not per package" - id: WR-19 severity: warning - disposition: open + disposition: fixed title: "Plugin hooks and scopes query outside the CRUD transaction" - id: IN-01 severity: info @@ -131,35 +131,35 @@ findings: severity: info disposition: open title: "The scaffold marks a file that must be edited as \"DO NOT EDIT\"" -open: 32 +open: 12 total: 32 -recorded: 2026-09-27T21:52:17.704Z +recorded: 2026-10-01T19:43:14.734Z --- # Phase 09: Code Review Disposition | Finding | Severity | Disposition | Source | |---------|----------|-------------|--------| -| CR-01 | critical | open | - | -| WR-01 | warning | open | - | -| WR-02 | warning | open | - | -| WR-03 | warning | open | - | -| WR-04 | warning | open | - | -| WR-05 | warning | open | - | -| WR-06 | warning | open | - | -| WR-07 | warning | open | - | -| WR-08 | warning | open | - | -| WR-09 | warning | open | - | -| WR-10 | warning | open | - | -| WR-11 | warning | open | - | -| WR-12 | warning | open | - | -| WR-13 | warning | open | - | -| WR-14 | warning | open | - | -| WR-15 | warning | open | - | -| WR-16 | warning | open | - | -| WR-17 | warning | open | - | -| WR-18 | warning | open | - | -| WR-19 | warning | open | - | +| CR-01 | critical | fixed | 09-REVIEW-FIX.md | +| WR-01 | warning | fixed | 09-REVIEW-FIX.md | +| WR-02 | warning | fixed | 09-REVIEW-FIX.md | +| WR-03 | warning | fixed | 09-REVIEW-FIX.md | +| WR-04 | warning | fixed | 09-REVIEW-FIX.md | +| WR-05 | warning | fixed | 09-REVIEW-FIX.md | +| WR-06 | warning | fixed | 09-REVIEW-FIX.md | +| WR-07 | warning | fixed | 09-REVIEW-FIX.md | +| WR-08 | warning | fixed | 09-REVIEW-FIX.md | +| WR-09 | warning | fixed | 09-REVIEW-FIX.md | +| WR-10 | warning | fixed | 09-REVIEW-FIX.md | +| WR-11 | warning | fixed | 09-REVIEW-FIX.md | +| WR-12 | warning | fixed | 09-REVIEW-FIX.md | +| WR-13 | warning | fixed | 09-REVIEW-FIX.md | +| WR-14 | warning | fixed | 09-REVIEW-FIX.md | +| WR-15 | warning | fixed | 09-REVIEW-FIX.md | +| WR-16 | warning | fixed | 09-REVIEW-FIX.md | +| WR-17 | warning | fixed | 09-REVIEW-FIX.md | +| WR-18 | warning | fixed | 09-REVIEW-FIX.md | +| WR-19 | warning | fixed | 09-REVIEW-FIX.md | | IN-01 | info | open | - | | IN-02 | info | open | - | | IN-03 | info | open | - |