Joseph Spiker spikerj
  • Joined on 2025-11-03
spikerj commented on issue spikerj/spikersoft-issues#63 2026-05-05 04:46:42 +00:00
[Medium] TrailValidator does not validate GeoJSON type or coordinate structure

Resolved.

TrailValidator.ValidateGeometry now performs structural GeoJSON validation:

  • Allowlists type against { LineString, MultiLineString }
  • Verifies coordinates is an array with…
spikerj commented on issue spikerj/spikersoft-issues#62 2026-05-05 04:46:38 +00:00
[Medium] AggregateKnowledgeCommandHandler has N+1 queries per domain group

Resolved.

Replaced the per-domain UserKnowledgeProgress.Where(...).ToListAsync() (N queries) with a single up-front load:

var existingProgressByDomain = (await context.UserKnowledg
spikerj commented on issue spikerj/spikersoft-issues#60 2026-05-05 04:46:25 +00:00
[High] Activity/knowledge query handlers load entire UserProfiles/UserActivities tables into memory

Resolved.

All three handlers now push filters into the LINQ query rather than loading full tables:

  • GetChildKnowledgeProgressQueryHandler -- replaced UserProfiles.ToListAsync() +…
spikerj commented on issue spikerj/spikersoft-issues#54 2026-05-05 04:46:24 +00:00
[Critical][Security] IDOR on GET /progress/domain/{domainKey} - any authenticated user can read another user's activity

Resolved.

Added CallerUserId and BypassAuthorization to GetDomainDetailQuery. The handler now:

  • Allows the call when request.UserId == request.CallerUserId (self)
  • Otherwise loads…
spikerj commented on issue spikerj/spikersoft-issues#56 2026-05-05 04:46:23 +00:00
[High] canRun enables Run button while local runtime is still loading (when SignalR is connected)

Resolved.

canRun now branches on activePath first:

  • local -> returns false unless runtimeStatus() === 'ready'
  • otherwise -> returns false unless isConnected()

This fixes the…

spikerj commented on issue spikerj/spikersoft-issues#55 2026-05-05 04:46:22 +00:00
[Critical] Chess: getPossibleMovesForPiece is incomplete (missing castling, en passant, double pawn push) - breaks checkmate/stalemate detection

Resolved.

Introduced getPseudoLegalMovesWithState(piece, state), which dispatches to the existing state-aware getPawnMoves and getKingMoves for pawns and kings (so castling, en-passant,…

spikerj commented on issue spikerj/spikersoft-issues#57 2026-05-05 04:46:21 +00:00
[High] Trail handlers return HTTP 400 instead of 404 for missing trails

Resolved.

Introduced TrailNotFoundException (in SpikerSoft.Business/Domain/Map/Trails/Exceptions/). GetTrailByIdQueryHandler and UpdateTrailCommandHandler now throw it instead of…

spikerj commented on issue spikerj/spikersoft-issues#58 2026-05-05 04:46:20 +00:00
[High] C# free-play CodeExecutionOptions dropped end-to-end on server path

Resolved.

Threaded CodeExecutionOptions end-to-end on the C# server path:

  1. ExecuteCodeCommand -- added Options property
  2. CSharpCodeRunnerController.Run -- now copies `request.Optio…
spikerj commented on issue spikerj/spikersoft-issues#59 2026-05-05 04:46:20 +00:00
[High] Code execution TimeoutSeconds not enforced on worker

Resolved.

CodeExecutionWorkerHostedService now enforces request.TimeoutSeconds per message:

  • Captured stoppingToken into _shutdownToken field at ExecuteAsync start
  • In `OnCodeExecu…
spikerj commented on issue spikerj/spikersoft-issues#61 2026-05-05 04:46:19 +00:00
[High] requestNewAttempt failures are silently swallowed in language-runner

Resolved.

Added attemptErrorSignal to LanguageRunner. requestNewAttempt clears it on entry and sets it to a human-readable message in the catch block. Added retryAttempt() method…

spikerj opened issue spikerj/spikersoft-issues#69 2026-05-05 04:16:23 +00:00
[Medium] Chess test suite asserts the weak move generator, not full legality (stalemate/checkmate gaps)
spikerj opened issue spikerj/spikersoft-issues#68 2026-05-05 04:16:16 +00:00
[Medium] github-snake :host-context(:fullscreen) selector may not match when host enters fullscreen
spikerj opened issue spikerj/spikersoft-issues#67 2026-05-05 04:16:12 +00:00
[Medium] quick-type activity tracking serializes full settings into metadata (privacy/size)
spikerj opened issue spikerj/spikersoft-issues#66 2026-05-05 04:16:06 +00:00
[Medium] FreePlayCodeExecutorFactory silently picks last duplicate registration
spikerj opened issue spikerj/spikersoft-issues#65 2026-05-05 04:16:00 +00:00
[Medium] Dead BSON conversion methods in GetTrailByIdQueryHandler
spikerj opened issue spikerj/spikersoft-issues#64 2026-05-05 04:15:55 +00:00
[Medium] domain-detail route has no auth guard but API requires Authorize
spikerj opened issue spikerj/spikersoft-issues#63 2026-05-05 04:15:49 +00:00
[Medium] TrailValidator does not validate GeoJSON type or coordinate structure
spikerj opened issue spikerj/spikersoft-issues#62 2026-05-05 04:15:43 +00:00
[Medium] AggregateKnowledgeCommandHandler has N+1 queries per domain group
spikerj opened issue spikerj/spikersoft-issues#61 2026-05-05 04:15:33 +00:00
[High] requestNewAttempt failures are silently swallowed in language-runner
spikerj opened issue spikerj/spikersoft-issues#60 2026-05-05 04:15:29 +00:00
[High] Activity/knowledge query handlers load entire UserProfiles/UserActivities tables into memory