Files

Siavash Sameni dceaf82934 audit: 2026-05-30 full-codebase audit — report, issues, docs, runbooks

Full-codebase-audit 2026-05-30 outputs:
- Audit report: 09 - Audits/Full Codebase Audit - 2026-05-30.md
- 81 issue files ISSUE-055..135 (decisions + 1 skipped no-brainer).
- Scanner docs from scratch (was zero): architecture, data model, API ref, payment
  flow, operations runbook + repo README.
- Doc-sync updates across API reference, data models, flows, design system.
- Secret Rotation Runbook (08 - Operations) for the exposed credentials.
- Reusable workflow guide (07 - Development) + .claude/workflows/full-codebase-audit.js.

Issues remain status:open intentionally — the code fixes are uncommitted-then-committed
working-tree changes per repo and aren't "resolved" until merged/deployed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-30 18:48:04 +04:00

1.5 KiB

Raw Blame History

issue, title, severity, domain, labels, status, resolved, fix, status, created, source

issue

title

severity

domain

labels

status

resolved

fix

status

created

source

021

POST /api/marketplace/offers/:id/withdraw HTTP route does not exist — seller withdraw is dead code

major

Seller Offer

missing-feature

backend

frontend

major

resolved

2026-05-29

Added POST /offers/:id/withdraw route in marketplace/routes.ts. Calls sellerOfferService.withdrawOffer with ownership check (seller or admin only).

open

2026-05-29

Doc vs Code Audit 2026-05-29

🟠 POST /api/marketplace/offers/:id/withdraw HTTP route does not exist — seller withdraw is dead code

Severity: major Domain: Seller Offer Labels: missing-feature, backend, frontend, major

Description

SellerOfferService.withdrawOffer() method exists (lines 427-443) but no HTTP route calls it. The only way to withdraw is via PUT /offers/:id/status with {status:'withdrawn'} which applies no pending-only guard. No frontend withdraw button or action exists.

Current Behavior

Sellers have no UI path to withdraw an offer. withdrawOffer() service method is unreachable via HTTP. The route-level withdrawal via PUT /status has no transition guard.

Expected Behavior

A dedicated withdraw endpoint should be registered, calling withdrawOffer() which enforces the pending-only guard. Or the PUT /offers/:id/status path should enforce status transition guards.

Affected Files

backend/src/routes/routes.ts
frontend/src/actions/marketplace.ts

References

Doc vs Code Audit Report

1.5 KiB Raw Blame History