From 56b6a83b3497b01cfb4fa288c9f67dc1b421bdd5 Mon Sep 17 00:00:00 2001 From: ghassan Date: Wed, 21 Oct 2026 00:33:10 +0300 Subject: [PATCH] docs: audit remediation plan (7 phases) Checklist across security, performance/DOM, feeds/search/trending, watch page, Shorts, channel/studio/live, and admin/a11y. Branch per phase; backup tag backup/pre-audit-2026-10-21 at 5058eaf. Co-Authored-By: Claude Opus 4.7 (1M context) --- docs/audit-remediation-plan.md | 88 ++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 docs/audit-remediation-plan.md diff --git a/docs/audit-remediation-plan.md b/docs/audit-remediation-plan.md new file mode 100644 index 0000000..8cc8cb6 --- /dev/null +++ b/docs/audit-remediation-plan.md @@ -0,0 +1,88 @@ +# YouTube-parity audit remediation plan + +Branch per phase. Feature tests per fix. STOP for approval between phases. + +**Safety tag:** `backup/pre-audit-2026-10-21` at commit `5058eaf` on `full-screen-data`. +**Stashed WIP:** `stash@{0}` — pre-audit WIP on `full-screen-data` (recover with `git stash pop` on that branch). + +--- + +## Phase 1 — Security & data integrity +Branch: `fix/phase-1-security` + +- [ ] Wrap `sendEmailVerificationNotification` + `NewCommentNotification` mail in try/catch; move to a queued notification channel; log failures. Document `.env` for Gmail app password + Mailgun/Postmark fallback. +- [ ] `php artisan app:resend-verification {--user=}` command. +- [ ] Reserved-name blocklist (`admin`, `superadmin`, `takeone`, `support`, `root`, …) via `App\Rules\ReservedIdentifier` wired into `RegisteredUserController`. +- [ ] Harden login throttling to `5,1` with lockout message; log repeated failures and alert super admins. +- [ ] Confirm `email_verified_at` is not mass-assignable; only the signed-URL verification route flips it. +- [ ] Comment dedupe: raise 5s → 60s window, add client idempotency key header, server reject on duplicate. Disable submit button on first click. +- [ ] `php artisan comments:dedupe --dry-run` cleanup command. +- [ ] Owner-view exclusion in `VideoController@trackProgress`; dedupe by `device_hash` within 30 min. +- [ ] Feature tests for each item. + +## Phase 2 — Performance & DOM +Branch: `fix/phase-2-perf` + +- [ ] One shared `#globalEditModal` + `#globalCardMenu` per page; populated via `GET /videos/{id}/edit-payload`. Owner-only items gated server-side. +- [ ] Lazy-render reply/edit boxes (template clone on open). +- [ ] Match highlights panel rendered once. +- [ ] `href="javascript:void(0)"` → real `