Files

Siavash Sameni dceaf82934 audit: 2026-05-30 full-codebase audit — report, issues, docs, runbooks

Full-codebase-audit 2026-05-30 outputs:
- Audit report: 09 - Audits/Full Codebase Audit - 2026-05-30.md
- 81 issue files ISSUE-055..135 (decisions + 1 skipped no-brainer).
- Scanner docs from scratch (was zero): architecture, data model, API ref, payment
  flow, operations runbook + repo README.
- Doc-sync updates across API reference, data models, flows, design system.
- Secret Rotation Runbook (08 - Operations) for the exposed credentials.
- Reusable workflow guide (07 - Development) + .claude/workflows/full-codebase-audit.js.

Issues remain status:open intentionally — the code fixes are uncommitted-then-committed
working-tree changes per repo and aren't "resolved" until merged/deployed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-30 18:48:04 +04:00

1.4 KiB

Raw Blame History

issue, title, severity, domain, status, resolved, fix, labels, status, created, source

issue

title

severity

domain

status

resolved

fix

labels

status

created

source

045

addParticipants frontend sends { participants: string[] } array but backend expects { userId: string } single user

major

Chat

resolved

2026-05-29

Fixed addParticipants in chat.ts to send { participantIds: participants } instead of { participants } — matches backend's expected body shape.

bug

frontend

major

chat

open

2026-05-29

Doc vs Code Audit 2026-05-29

🟠 addParticipants frontend sends { participants: string[] } array but backend expects { userId: string } single user

Severity: major Domain: Chat Labels: bug, frontend, major, chat

Description

The frontend addParticipants action (chat.ts line 425) sends { participants: string[] } as the body. The API documents POST /api/chat/:id/participants with body { userId: string } — a single user. Backend expects a single userId, not an array. Bulk participant addition will be silently handled incorrectly.

Current Behavior

addParticipants sends an array payload that the backend does not expect. Participant addition may fail or be ignored.

Expected Behavior

Frontend should send { userId: string } and call the endpoint once per participant, or backend should be updated to accept an array.

Affected Files

frontend/src/actions/chat.ts

References

Doc vs Code Audit Report

1.4 KiB Raw Blame History