quoije/yaris-obd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: document Phase 24.5 code audit in PLAN.md

Browse Source 
Co-authored-by: Copilot <[email protected]>
This commit is contained in:
Mathieu Moran
2026-08-10 05:17:32 -04:00
co-authored by Copilot
parent 1b39ac0cc8
commit a56e4252d3
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PLAN.md
+22
View File
@@ -1313,6 +1313,28 @@ including two UX polish passes and multiple bug-fix rounds.
7. Browse to `https://your-cloudflare-tunnel-url/` → login page
### Phase 24.5: Pre-car-test code audit & bug fixes — ✅ DONE
**Completed 2026-08-10.** Full read-only audit of all Pi modules, JS files, and server code. 63 tests pass.
#### Bugs found and fixed
| File | Severity | Bug | Fix |
|---|---|---|---|
| `modules/app_alerts.py` | MEDIUM | `videos["files"]` crashed if `list_local_videos()` returned `None` or missing key | `.get("files", [])` with `or {}` fallback |
| `modules/app_cellular.py` | MEDIUM | `read_resp.encode(errors="replace")` called `.encode()` on an already-str return value, changing return type to bytes | Removed `.encode()` — `body = read_resp` directly |
| `modules/app_settings.py` | MEDIUM | `apn` was uninitialized when `isinstance(apn, str)` check failed, causing `NameError`/wrong value stored | Initialize `apn = ""` in the else branch |
| `modules/app_upload.py` | LOW | `import json as _json` was inside a `ConnectionError` except handler — runs on every fallback attempt | Moved `import json` to top of file |
| `server/app.py` | HIGH | `int(request.args.get("limit"))` had no try/except — non-numeric query param crashed the trips and dashcam list endpoints with `ValueError` | Wrapped in `try/except (ValueError, TypeError)` |
| `server/app.py` | MEDIUM | `os.path.commonpath()` for path traversal safety raised `ValueError` on cross-root paths (Windows paths in DB), crashing the video stream endpoint | Wrapped in `try/except ValueError` |
| `tests/test_app_settings.py` | — | `valid_payload()` was missing `trips_upload_enabled` and `video_convert_enabled` (added in Phase 23.5 but test not updated), causing a pre-existing test failure | Added missing fields to `valid_payload()` |
#### Bugs confirmed NOT present (audit false positives)
- `app_obd.py` speed/rpm lock: `obd_speed_lock` already wraps the entire `while` loop including the write — no actual race
- `server/modules/db.py` DSN: Audit saw masked credential (view tool hides `password=`) — actual f-string is correct
- `app_sql.py` `state[0]` null crash: Code already has `if state is not None` check before indexing
- `app_cellular.py` `r"\r\n"`: SIMCOM SIM868 AT+HTTPPARA="USERDATA" spec requires literal 4-char `\r\n` sequence, not actual CRLF — intentionally correct
- `app_alerts.py` Authorization header: View tool masked `Bearer {token}` as `******` — actual code is correct
### Phase 25: Pre-install Yaris 2013 compatibility test — 🚧 PLANNED (core-system gate)
**Added 2026-08-09; intentionally immediately before the Android app.** Bench tests, synthetic
routes, attached-hardware tests, and stationary Pi runs cannot prove the complete system works