fix: Resolve P2/P3 technical debt - Code quality improvements #12

2026-06-26T18:24:44+08:00

xiaoxia commented

2026-06-26 18:24:44 +08:00

Summary

This PR resolves P2 and P3 technical debt issues identified in the code audit.

P2 - Medium Priority (Fixed)

P2-1: Code duplication - workspace_member check
- Removed duplicate _require_workspace_member functions from projects.py and upload.py
- Now uses shared require_workspace_member from permissions.py
P2-2: Domain layer dependencies (jwt/bcrypt)
- Created packages/application/auth/jwt_handler.py for JWT operations
- Created packages/application/auth/password_handler.py for password hashing
- Updated jwt_service.py and password_hasher.py to delegate to application layer
P2-3: N+1 query risk
- Added JOIN query to find_by_workspace method in workspace_member_repository.py
- Preloads user data to avoid N+1 queries when listing workspace members
P2-4: Missing type annotations
- Added return type annotations to all functions in dependencies.py
P2-5: File type validation relies on client
- Added server-side MIME type validation in upload.py
- Validates content types against allowed list (video, audio, image)
P2-6: Temp file cleanup
- Updated processor.py to use tempfile.NamedTemporaryFile with cleanup
- Added try-finally block to ensure temp files are cleaned up

P3 - Low Priority (Fixed)

P3-1: Duplicate configuration
- Unified database config in database.py to use centralized config.py Settings
P3-2: Dead code / unused module
- Added documentation to versioning.py explaining how to enable the middleware
P3-3: Docker multi-stage build
- Converted api.Dockerfile to multi-stage build
- Reduces final image size by only including runtime dependencies
P3-4: CI missing frontend checks
- Added frontend-lint job to .gitea/workflows/tests.yml
- Includes ESLint and TypeScript type checking
P3-5: Test coverage insufficient
- Added integration test example in tests/integration/test_auth.py

Files Changed

apps/api/app/api/routes/projects.py
apps/api/app/api/routes/upload.py
apps/api/app/api/routes/assets.py (already had correct imports)
packages/application/auth/jwt_handler.py (new)
packages/application/auth/password_handler.py (new)
packages/domain/auth/jwt_service.py
packages/domain/auth/password_hasher.py
packages/adapters/sqlalchemy_impl/workspace_member_repository.py
apps/api/app/dependencies.py
apps/api/app/core/database.py
apps/api/app/middleware/versioning.py
apps/worker/video_processing/processor.py
infra/docker/api.Dockerfile
.gitea/workflows/tests.yml
tests/integration/test_auth.py (new)
tests/integration/__init__.py (new)

Notes

P1 issues (P1-1 to P1-4) were fixed in a separate PR #11
All changes maintain backward compatibility
No new lint issues introduced

## Summary This PR resolves P2 and P3 technical debt issues identified in the code audit. ### P2 - Medium Priority (Fixed) - **P2-1**: Code duplication - workspace_member check - Removed duplicate `_require_workspace_member` functions from `projects.py` and `upload.py` - Now uses shared `require_workspace_member` from `permissions.py` - **P2-2**: Domain layer dependencies (jwt/bcrypt) - Created `packages/application/auth/jwt_handler.py` for JWT operations - Created `packages/application/auth/password_handler.py` for password hashing - Updated `jwt_service.py` and `password_hasher.py` to delegate to application layer - **P2-3**: N+1 query risk - Added JOIN query to `find_by_workspace` method in `workspace_member_repository.py` - Preloads user data to avoid N+1 queries when listing workspace members - **P2-4**: Missing type annotations - Added return type annotations to all functions in `dependencies.py` - **P2-5**: File type validation relies on client - Added server-side MIME type validation in `upload.py` - Validates content types against allowed list (video, audio, image) - **P2-6**: Temp file cleanup - Updated `processor.py` to use `tempfile.NamedTemporaryFile` with cleanup - Added try-finally block to ensure temp files are cleaned up ### P3 - Low Priority (Fixed) - **P3-1**: Duplicate configuration - Unified database config in `database.py` to use centralized `config.py` Settings - **P3-2**: Dead code / unused module - Added documentation to `versioning.py` explaining how to enable the middleware - **P3-3**: Docker multi-stage build - Converted `api.Dockerfile` to multi-stage build - Reduces final image size by only including runtime dependencies - **P3-4**: CI missing frontend checks - Added `frontend-lint` job to `.gitea/workflows/tests.yml` - Includes ESLint and TypeScript type checking - **P3-5**: Test coverage insufficient - Added integration test example in `tests/integration/test_auth.py` ### Files Changed - `apps/api/app/api/routes/projects.py` - `apps/api/app/api/routes/upload.py` - `apps/api/app/api/routes/assets.py` (already had correct imports) - `packages/application/auth/jwt_handler.py` (new) - `packages/application/auth/password_handler.py` (new) - `packages/domain/auth/jwt_service.py` - `packages/domain/auth/password_hasher.py` - `packages/adapters/sqlalchemy_impl/workspace_member_repository.py` - `apps/api/app/dependencies.py` - `apps/api/app/core/database.py` - `apps/api/app/middleware/versioning.py` - `apps/worker/video_processing/processor.py` - `infra/docker/api.Dockerfile` - `.gitea/workflows/tests.yml` - `tests/integration/test_auth.py` (new) - `tests/integration/__init__.py` (new) ### Notes - P1 issues (P1-1 to P1-4) were fixed in a separate PR #11 - All changes maintain backward compatibility - No new lint issues introduced

xiaoxia added 16 commits 2026-06-26 18:24:45 +08:00

fix(P2-1): Use shared require_workspace_member function in projects.py 6a60ab2fe0

fix(P2-1): Use shared require_workspace_member function in upload.py 3f944508b0

fix(P2-2): Delegate JWT operations to application layer 81b76b1fe6

fix(P2-2): Add JWT handler in application layer f21847d987

fix(P2-2): Add password handler in application layer 66e7b22586

fix(P2-2): Delegate password operations to application layer e7036e2456

fix(P2-3): Add JOIN query to preload user data in find_by_workspace (fixes N+1) f673cb7305

fix(P2-4): Add return type annotations to dependencies.py f2b98aa259

fix(P2-5): Add server-side MIME type validation for file uploads e925d9f43b

fix(P2-6): Use NamedTemporaryFile with cleanup for temp files d85cedef12

fix(P3-1): Unify database config with config.py Settings 36673fd3ff