Joseph Spiker

spikerj commented on issue spikerj/spikersoft-issues#615

2026-07-17 01:59:35 +00:00

[Bug][CI][Infra] #584 not fixed — deploy job's git pull runs unprivileged on a root-owned /mnt/infrastructure, so every infra deploy silently ships a stale stack

Updated diagnosis (2026-07-17, from #625 — closing that as a duplicate of this): the pull now runs with sudo in the deploy jobs, which fixed the root-owned-checkout permission error described…

spikerj closed issue spikerj/spikersoft-issues#219

2026-07-17 01:59:16 +00:00

chore: upgrade to Angular v22 + latest Nx

spikerj commented on issue spikerj/spikersoft-issues#219

2026-07-17 01:59:16 +00:00

chore: upgrade to Angular v22 + latest Nx

Done in the 2026-07-16 spikersoft-angular deps pass — PRs #204–#211, landing as batch 6 (PR #211): Angular 22.0.6, Nx 23, TypeScript 6, ESLint 10 (plus ng-packagr 22 and the batch 1–5…

spikerj closed issue spikerj/spikersoft-issues#617

2026-07-17 01:59:15 +00:00

[Bug][Prod][Reader] Every bookmark operation 500s — UserBookmark.UserId is ObjectId but requests are keyed by Keycloak username

spikerj commented on issue spikerj/spikersoft-issues#617

2026-07-17 01:59:15 +00:00

[Bug][Prod][Reader] Every bookmark operation 500s — UserBookmark.UserId is ObjectId but requests are keyed by Keycloak username

Resolved in spikersoft-backend PR #326 (merged to master, 4d22c0bb — PR-0 of the reader plan): UserBookmark re-keyed to Keycloak username strings, all three bookmark endpoints no longer…

spikerj commented on issue spikerj/spikersoft-issues#626

2026-07-17 01:53:25 +00:00

[Bug][Prod][Reader] PDFs never open in the reader — pdf.js fetches /api/book/{id}/file tokenless (401); EPUBs unaffected

Code fix merged: spikersoft-angular PR #216 → master (051258e). Verified: unit tests (41 green), nx build clean, and the prod tokenless-401 repro.

Holding this open for one last check…

spikerj commented on issue spikerj/spikersoft-issues#626

2026-07-17 01:52:38 +00:00

[Bug][Prod][Reader] PDFs never open in the reader — pdf.js fetches /api/book/{id}/file tokenless (401); EPUBs unaffected

Timeline correction (verified via git blame): the [Authorize] on GET /api/book/{id}/file predates #618 — it dates to commit 3a2314d (2026-04-09, "breaking files out"), when file serving…

spikerj opened issue spikerj/spikersoft-issues#626

2026-07-17 01:48:35 +00:00

[Bug][Prod][Reader] PDFs never open in the reader — pdf.js fetches /api/book/{id}/file tokenless (401); EPUBs unaffected

spikerj commented on issue spikerj/spikersoft-issues#623

2026-07-17 01:06:45 +00:00

[CI][Backend] Unit Tests red since Batch S (dcproj NU1105 via Directory.Build.props pins) + ArtPipe per-model images broken since CPM (Dockerfile.model missing Packages.props)

Timeline validated against the full Unit Tests task history: last green run was 9e9a137c (2026-07-16 22:30); the Batch S PR run itself failed (c3dd9a1d, 22:10) and every run since — including…

spikerj commented on issue spikerj/spikersoft-issues#618

2026-07-17 01:04:59 +00:00

[Security][Backend][Books] Private books are listable and downloadable by any authenticated user — /api/book/all and /api/book/{id}/file have no visibility/ownership check

Both vectors are now closed and deployed:

Part 1 — authenticated API leak:

spikersoft-backend #331 (merged): BookAccess.CanRead/ReadableBy guard on every read endpoint (404-no-oracle),…

spikerj commented on issue spikerj/spikersoft-issues#624

2026-07-17 00:53:19 +00:00

[Infra][CI] lesson-video-processor never deploys: swarm service name 67 chars exceeds 63-char limit (stack+service name doubled)

Verified against the live swarm: the service is absent (99 services running, none matching lesson/video) — lesson-video transcoding has never been deployed via CI. Fix PR: spikersoft-infrastru…

spikerj opened issue spikerj/spikersoft-issues#625

2026-07-17 00:50:38 +00:00

[Infra][CI] every deploy job's /mnt/infrastructure git pull fails under sudo (no credentials) — #584 stale-checkout guard is decorative

spikerj opened issue spikerj/spikersoft-issues#624

2026-07-17 00:50:38 +00:00

[Infra][CI] lesson-video-processor never deploys: swarm service name 67 chars exceeds 63-char limit (stack+service name doubled)

spikerj opened issue spikerj/spikersoft-issues#623

2026-07-17 00:50:13 +00:00

[CI][Backend] Unit Tests red since Batch S (dcproj NU1105 via Directory.Build.props pins) + ArtPipe per-model images broken since CPM (Dockerfile.model missing Packages.props)

spikerj closed issue spikerj/spikersoft-issues#618

2026-07-17 00:28:58 +00:00

[Security][Backend][Books] Private books are listable and downloadable by any authenticated user — /api/book/all and /api/book/{id}/file have no visibility/ownership check

spikerj commented on issue spikerj/spikersoft-issues#618

2026-07-17 00:28:54 +00:00

[Security][Backend][Books] Private books are listable and downloadable by any authenticated user — /api/book/all and /api/book/{id}/file have no visibility/ownership check

Resolved across two vectors, all PRs now merged to master. Closing.

Vector 1 — authenticated API (the reported hole): book read-authorization is centralized in `SpikerSoft.Business/Domain/B…

spikerj closed issue spikerj/spikersoft-issues#622

2026-07-16 23:51:28 +00:00

Blueprint diagram: connection wires broken on Angular 22 — rete-angular-plugin injects removed ComponentFactoryResolver (flaky e2e tools-walk failure)

spikerj commented on issue spikerj/spikersoft-issues#622

2026-07-16 23:51:28 +00:00

Blueprint diagram: connection wires broken on Angular 22 — rete-angular-plugin injects removed ComponentFactoryResolver (flaky e2e tools-walk failure)

Resolved in spikersoft-angular PR #214 (merged to master, merge commit fcd0c169). Patched rete-angular-plugin@2.7.1 via pnpm patch to stop injecting the removed-in-Angular-22 `ComponentFactoryR…

spikerj opened issue spikerj/spikersoft-issues#622

2026-07-16 23:23:16 +00:00

Blueprint diagram: connection wires broken on Angular 22 — rete-angular-plugin injects removed ComponentFactoryResolver (flaky e2e tools-walk failure)

spikerj commented on issue spikerj/spikersoft-issues#618

2026-07-16 23:16:47 +00:00

[Security][Backend][Books] Private books are listable and downloadable by any authenticated user — /api/book/all and /api/book/{id}/file have no visibility/ownership check

Update on part 1 (authenticated API). After the audit against the intended parent-approval model (see epic #621 for what's actually built vs. aspirational), the authenticated-API vector is…