Mike/freno-dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: remediate pygienium audit findings

Browse Source 
Dead code: 77 verified-unused exports, files (BackArrow, MenuBars,
cookies.ts, db/create.ts, schemas/comment.ts, security-headers.ts) and
12 unused dependencies removed
Comments: ~370 RESTATE comments stripped across 53 files; 2 verbose
blocks tightened; dead commented-out config removed
Complexity: bulkUpsert extracted into 11 per-entity helpers (CCN 156->~10);
login formHandler split into 3 submitters (CCN 63->~5); account page render
split into 8 section components (CCN 40); updatePost SQL builder rebuilt;
assert*Owned consolidated behind generic assertOwnedBy
Defensive guards: 4 redundant rethrow/nullish guards removed
This commit is contained in:
Michael Freno
2026-08-11 13:36:18 -04:00
parent 33ca9213f2
commit 898c891bd5
76 changed files with 1437 additions and 2600 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1171
src/routes/account.tsx
View File

File diff suppressed because it is too large Load Diff

1
src/routes/api/Gaze/appcast.xml.ts
View File

@@ -39,7 +39,6 @@ export async function GET(_event: APIEvent) {
});
}
// Stream the XML content from S3
const body = await response.Body.transformToString();
return new Response(body, {

1
src/routes/api/InputHalo/appcast.xml.ts
View File

@@ -39,7 +39,6 @@ export async function GET(_event: APIEvent) {
});
}
// Stream the XML content from S3
const body = await response.Body.transformToString();
return new Response(body, {

1
src/routes/api/auth/email-login-callback.ts
View File

@@ -20,7 +20,6 @@ export async function GET(event: APIEvent) {
"emailLogin",
(caller, params) => caller.auth.emailLogin(params),
(error) => {
// Check for token expiration
const message = error instanceof Error ? error.message : "";
const isTokenError =
message.includes("expired") || message.includes("invalid");

4
src/routes/api/auth/email-verification-callback.ts
View File

@@ -62,17 +62,14 @@ export async function GET(event: APIEvent) {
}
try {
// Create tRPC caller to invoke the emailVerification procedure
const caller = await createServerCaller(event);
// Call the email verification handler
const result = await caller.auth.emailVerification({
email,
token
});
if (result.success) {
// Show success page
return new Response(
`
<!DOCTYPE html>
@@ -136,7 +133,6 @@ export async function GET(event: APIEvent) {
} catch (error) {
console.error("Email verification callback error:", error);
// Check if it's a token expiration error
const errorMessage =
error instanceof Error ? error.message : "server_error";
const isTokenError =

4
src/routes/api/downloads/[filename].ts
View File

@@ -24,7 +24,6 @@ export async function GET(event: APIEvent) {
});
}
// Validate filename format (only allow Gaze or InputHalo files)
const validPrefixes = ["Gaze", "InputHalo"];
const isValidPrefix = validPrefixes.some((prefix) => filename.startsWith(prefix));
if (
@@ -70,12 +69,10 @@ export async function GET(event: APIEvent) {
});
}
// Get content type based on file extension
const contentType = filename.endsWith(".dmg")
? "application/x-apple-diskimage"
: "application/octet-stream";
// Stream the file content from S3
const body = await response.Body.transformToByteArray();
console.log(`✓ Serving ${filename} (${body.length} bytes)`);
@@ -93,7 +90,6 @@ export async function GET(event: APIEvent) {
} catch (error) {
console.error(`Failed to fetch ${filename} from S3:`, error);
// Check if it's a not found error
if (error instanceof Error && error.name === "NoSuchKey") {
return new Response("File not found in storage", {
status: 404,

5
src/routes/api/lineage/_lib.ts
View File

@@ -58,8 +58,3 @@ export function bearerToken(event: APIEvent): string | null {
const m = auth.match(/^Bearer\s+(.+)$/i);
return m?.[1]?.trim() ?? null;
}
/** Parse the JSON request body. */
export async function jsonBody<T = any>(event: APIEvent): Promise<T> {
return await event.request.json();
}

5
src/routes/downloads.tsx
View File

@@ -17,7 +17,6 @@ function MainDownloadsPage() {
const [gazeText, setGazeText] = createSignal("Gaze");
const [inputHaloText, setInputHaloText] = createSignal("InputHalo");
// Track loading states for each download button
const [loadingState, setLoadingState] = createSignal<Record<string, boolean>>(
{
lineage: false,
@@ -32,10 +31,8 @@ function MainDownloadsPage() {
// Prevent multiple rapid clicks
if (loadingState()[assetName]) return;
// Set loading state
setLoadingState((prev) => ({ ...prev, [assetName]: true }));
// Call the tRPC endpoint directly
import("~/lib/api").then(({ api }) => {
api.downloads.getDownloadUrl
.query({ asset_name: assetName })
@@ -45,11 +42,9 @@ function MainDownloadsPage() {
})
.catch((error) => {
console.error("Download error:", error);
// Optionally show user a message
alert("Failed to initiate download. Please try again.");
})
.finally(() => {
// Reset loading state regardless of success/failure
setLoadingState((prev) => ({ ...prev, [assetName]: false }));
});
});

352
src/routes/login/index.tsx
View File

@@ -57,7 +57,6 @@ export const route = {
load: () => checkAuth()
};
// Helper to convert expiry string to human-readable format
function expiryToHuman(expiry: string): string {
const value = parseInt(expiry);
if (expiry.endsWith("m")) {
@@ -77,7 +76,6 @@ export default function LoginPage() {
const register = () => searchParams.mode === "register";
const usePassword = () => searchParams.auth === "password";
// Load server data using createAsync
const loginData = createAsync(() => getLoginData(), {
deferStream: true
});
@@ -149,6 +147,180 @@ export default function LoginPage() {
}
});
const isRateLimited = (errorCode: string | undefined, message: string) =>
errorCode === "TOO_MANY_REQUESTS" || message.includes("Too many attempts");
const submitRegister = async () => {
if (!emailRef || !passwordRef || !passwordConfRef) {
setError("Please fill in all fields");
return;
}
const email = emailRef.value;
const password = passwordRef.value;
const passwordConf = passwordConfRef.value;
if (!isValidEmail(email)) {
setError("Invalid email address");
return;
}
const passwordValidation = validatePassword(password);
if (!passwordValidation.isValid) {
setError(passwordValidation.errors[0] || "Invalid password");
return;
}
if (password !== passwordConf) {
setError("passwordMismatch");
return;
}
const response = await fetch("/api/trpc/auth.emailRegistration", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
email,
password,
passwordConfirmation: passwordConf
})
});
const result = await response.json();
if (response.ok && result.result?.data) {
navigate("/account", { replace: true });
return;
}
const errorMsg =
result.error?.message ||
result.result?.data?.message ||
"Registration failed";
const errorCode = result.error?.data?.code;
if (isRateLimited(errorCode, errorMsg)) {
setError(errorMsg);
} else if (
errorMsg.includes("duplicate") ||
errorMsg.includes("already exists")
) {
if (errorMsg.includes("sign in and add a password")) {
setError("provider_exists");
} else {
setError("duplicate");
}
} else {
setError(errorMsg);
}
};
const submitPasswordLogin = async () => {
if (!emailRef || !passwordRef || !rememberMeRef) {
setError("Please fill in all fields");
return;
}
const email = emailRef.value;
const password = passwordRef.value;
const rememberMe = rememberMeRef.checked;
const response = await fetch("/api/trpc/auth.emailPasswordLogin", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ email, password, rememberMe })
});
const result = await response.json();
if (response.ok && result.result?.data?.success) {
setShowPasswordSuccess(true);
revalidateAuth(); // Refresh auth state globally
setTimeout(() => {
navigate("/account", { replace: true });
}, 500);
return;
}
const errorMessage = result.error?.message || "";
const errorCode = result.error?.data?.code;
if (isRateLimited(errorCode, errorMessage)) {
setError(errorMessage);
} else if (
errorCode === "FORBIDDEN" ||
errorMessage.includes("Account locked") ||
errorMessage.includes("Account is locked")
) {
setError(errorMessage);
} else {
setShowPasswordError(true);
}
};
const submitEmailLink = async () => {
if (!emailRef || !rememberMeRef) {
setError("Please enter your email");
return;
}
const email = emailRef.value;
const rememberMe = rememberMeRef.checked;
if (!isValidEmail(email)) {
setError("Invalid email address");
return;
}
const response = await fetch("/api/trpc/auth.requestEmailLinkLogin", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ email, rememberMe })
});
const result = await response.json();
if (response.ok && result.result?.data?.success) {
setEmailSent(true);
// Set countdown directly - cookie might not be readable immediately
const expirationTime = new Date(
Date.now() + COOLDOWN_TIMERS.EMAIL_LOGIN_LINK_MS
);
startCountdown(expirationTime);
return;
}
const errorMsg =
result.error?.message ||
result.result?.data?.message ||
"Failed to send email";
const errorCode = result.error?.data?.code;
if (
isRateLimited(errorCode, errorMsg) ||
errorMsg.includes("countdown not expired")
) {
setError(
errorMsg.includes("countdown")
? "Please wait before requesting another email link"
: errorMsg
);
// Start the countdown timer when rate limited
const timer = getClientCookie("emailLoginLinkRequested");
if (timer) {
try {
startCountdown(timer);
} catch (e) {
console.error("Failed to start countdown from cookie:", e);
}
}
} else {
setError(errorMsg);
}
};
const formHandler = async (e: Event) => {
e.preventDefault();
setLoading(true);
@@ -158,181 +330,11 @@ export default function LoginPage() {
try {
if (register()) {
if (!emailRef || !passwordRef || !passwordConfRef) {
setError("Please fill in all fields");
setLoading(false);
return;
}
const email = emailRef.value;
const password = passwordRef.value;
const passwordConf = passwordConfRef.value;
if (!isValidEmail(email)) {
setError("Invalid email address");
setLoading(false);
return;
}
const passwordValidation = validatePassword(password);
if (!passwordValidation.isValid) {
setError(passwordValidation.errors[0] || "Invalid password");
setLoading(false);
return;
}
if (password !== passwordConf) {
setError("passwordMismatch");
setLoading(false);
return;
}
const response = await fetch("/api/trpc/auth.emailRegistration", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
email,
password,
passwordConfirmation: passwordConf
})
});
const result = await response.json();
if (response.ok && result.result?.data) {
navigate("/account", { replace: true });
} else {
const errorMsg =
result.error?.message ||
result.result?.data?.message ||
"Registration failed";
const errorCode = result.error?.data?.code;
if (
errorCode === "TOO_MANY_REQUESTS" ||
errorMsg.includes("Too many attempts")
) {
setError(errorMsg);
} else if (
errorMsg.includes("duplicate") ||
errorMsg.includes("already exists")
) {
if (errorMsg.includes("sign in and add a password")) {
setError("provider_exists");
} else {
setError("duplicate");
}
} else {
setError(errorMsg);
}
}
await submitRegister();
} else if (usePassword()) {
if (!emailRef || !passwordRef || !rememberMeRef) {
setError("Please fill in all fields");
setLoading(false);
return;
}
const email = emailRef.value;
const password = passwordRef.value;
const rememberMe = rememberMeRef.checked;
const response = await fetch("/api/trpc/auth.emailPasswordLogin", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ email, password, rememberMe })
});
const result = await response.json();
if (response.ok && result.result?.data?.success) {
setShowPasswordSuccess(true);
revalidateAuth(); // Refresh auth state globally
setTimeout(() => {
navigate("/account", { replace: true });
}, 500);
} else {
const errorMessage = result.error?.message || "";
const errorCode = result.error?.data?.code;
if (
errorCode === "TOO_MANY_REQUESTS" ||
errorMessage.includes("Too many attempts")
) {
setError(errorMessage);
} else if (
errorCode === "FORBIDDEN" ||
errorMessage.includes("Account locked") ||
errorMessage.includes("Account is locked")
) {
setError(errorMessage);
} else {
setShowPasswordError(true);
}
}
await submitPasswordLogin();
} else {
if (!emailRef || !rememberMeRef) {
setError("Please enter your email");
setLoading(false);
return;
}
const email = emailRef.value;
const rememberMe = rememberMeRef.checked;
if (!isValidEmail(email)) {
setError("Invalid email address");
setLoading(false);
return;
}
const response = await fetch("/api/trpc/auth.requestEmailLinkLogin", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ email, rememberMe })
});
const result = await response.json();
if (response.ok && result.result?.data?.success) {
setEmailSent(true);
// Set countdown directly - cookie might not be readable immediately
const expirationTime = new Date(
Date.now() + COOLDOWN_TIMERS.EMAIL_LOGIN_LINK_MS
);
startCountdown(expirationTime);
} else {
const errorMsg =
result.error?.message ||
result.result?.data?.message ||
"Failed to send email";
const errorCode = result.error?.data?.code;
if (
errorCode === "TOO_MANY_REQUESTS" ||
errorMsg.includes("countdown not expired") ||
errorMsg.includes("Too many attempts")
) {
setError(
errorMsg.includes("countdown")
? "Please wait before requesting another email link"
: errorMsg
);
// Start the countdown timer when rate limited
const timer = getClientCookie("emailLoginLinkRequested");
if (timer) {
try {
startCountdown(timer);
} catch (e) {
console.error("Failed to start countdown from cookie:", e);
}
}
} else {
setError(errorMsg);
}
}
await submitEmailLink();
}
} catch (err: any) {
console.error("Login error:", err);

1
src/routes/test.tsx
View File

@@ -863,7 +863,6 @@ export default function TestPage() {
setErrors({ ...errors(), [key]: "" });
try {
// Get input - either from edited JSON or sample
let input = endpoint.sampleInput;
const editedInput = inputEdits()[key];
if (editedInput) {