Dev Portalv0.1
Dev PortaldevtoolsObservability PortalobservabilityDeployment Portaldeploy
MQorb dev · local
Dev Portal

Audit

orb audit · 41 rules · 0.8 s
Errors
2block orb release
Warnings
3−1 since yesterday
Hints
2style and docs
Rules passed
34of 4183%

Findings

what a careful reviewer would flag
  • Ops handler reachable without 2FAops/2fa-required
    internal/app/ops/releases.go:31

    ops.ReleasesCurrent is mounted with session middleware only. Every /ops/* route needs RequireTwoFactor before the platform-role check (ADR-0043).

  • Job has no timeoutjobs/timeout
    internal/jobs/reindex.go:14

    projects.reindex declares no Timeout. River uses the client default (1m); a reindex over 20k rows takes longer and will be retried mid-way.

  • List query without LIMITsql/no-limit
    internal/projects/select_all.go:9

    SELECT projects WHERE org_id = $1 has no LIMIT. Paginate with a cursor like the other list endpoints.

  • Handler over 200 lineshandlers/large
    internal/app/orgs/handlers.go

    orgs handlers are 287 lines. Split invites into their own file, as `orb gen resource` would.

  • Setting declared but never readsettings/unused
    internal/settings/keys.go:22

    projects.max_per_org has no config.Value reader. Either read it in projects.Create or remove it.

  • Template has no text/plain partmail/plaintext
    internal/mail/templates/org_digest.html

    Add org_digest.txt so mail clients that block HTML still show the digest.

  • Operation missing summaryopenapi/summary
    internal/app/ops/audit.go:44

    opsAuditStats has no summary; it shows as its operation ID in the API reference.