Repository navigation

Audit fixes: dupe/economy exploits, race conditions, DB bugs, cleanups - #217

Merged

Jakubk15 merged 35 commits into

masterfrom

audit-fixes

Jun 21, 2026

Merged

Audit fixes: dupe/economy exploits, race conditions, DB bugs, cleanups#217
Jakubk15 merged 35 commits into
masterfrom
audit-fixes

Commits on Jun 20, 2026
- Add codebase audit report
  
  Jakubk15
  and
  claude
  committed
  de7e13d
- Fix C1: refund parcel fee when persistence fails
  
  Jakubk15
  and
  claude
  committed
  62c9e4e
- Fix C2: fully roll back a parcel when storage clearing fails
  
  Jakubk15
  and
  claude
  committed
  5ab5f98
- Fix C3: consume the locker item when a locker is created
  
  Jakubk15
  and
  claude
  committed
  3e6df14
- Fix C4: cancel locker break to prevent chest/contents duplication
  
  Jakubk15
  and
  claude
  committed
  364c223
- Fix H1: make parcel collection space-check and delivery race-safe
  
  Jakubk15
  and
  claude
  committed
  9107ab5
- Fix H2: close the locker-fullness TOCTOU race
  
  Jakubk15
  and
  claude
  committed
  11fff9e
- Fix H3: page lockers from the repository, not the partial cache
  
  Jakubk15
  and
  claude
  committed
  ea93d72
- Fix H4: cancel chest interaction in-tick so the vanilla chest stays shut
  
  Jakubk15
  and
  claude
  committed
  113e608
- Fix H6: populate the user cache on read misses
  
  Jakubk15
  and
  claude
  committed
  6a9723c
- Fix H5: detect user conflicts against the database, not just the cache
  
  Jakubk15
  and
  claude
  committed
  9355bf3
- Fix M1: delete the delivery only after the status update succeeds
  
  Jakubk15
  and
  claude
  committed
  dd6289c
- Fix M3: stop mutating the cache from inside its own loader
  
  Jakubk15
  and
  claude
  committed
  abd3fa5
- Fix M4: surface item-storage save failures and return staged items
  
  Jakubk15
  and
  claude
  committed
  5667f23
- Fix M5: fail fast when the item storage table cannot be created
  
  Jakubk15
  and
  claude
  committed
  4f127cd
- Fix M6: rename ambiguous repository wrapper methods
  
  Jakubk15
  and
  claude
  committed
  1a940b6
- Fix M7: make DAO cache population atomic
  
  Jakubk15
  and
  claude
  committed
  73629b0
- Fix M8: make connection pool tuning configurable
  
  Jakubk15
  and
  claude
  committed
  81fdf00
- Fix M2: make domain event firing thread deterministic
  
  Jakubk15
  and
  claude
  committed
  32ca84d
- Fix L1: switch on the DatabaseType enum directly
  
  Jakubk15
  and
  claude
  committed
  0e0523f
- Fix L3: tear down listeners/tasks before closing the datasource
  
  Jakubk15
  and
  claude
  committed
  bfd55ab
- Fix L4: remove misleading stale comment in LockerPlaceController
  
  Jakubk15
  and
  claude
  committed
  054f7d6
- Fix L5: account for stacking in the collection space check
  
  Jakubk15
  and
  claude
  committed
  3da519e
- Refactor D5: collapse duplicate createActiveItem overloads
  
  Jakubk15
  and
  claude
  committed
  cb9c16b
- Refactor D1: extract repository table bootstrap into the base class
  
  Jakubk15
  and
  claude
  committed
  6773e02
- Refactor D2: extract shared paginated-query helper
  
  Jakubk15
  and
  claude
  committed
  779167a
- Refactor D4: share cancel handling via a CancellableEvent base
  
  Jakubk15
  and
  claude
  committed
  d246ff5
- Record audit resolution status in AUDIT.md
  
  Jakubk15
  and
  claude
  committed
  f565a54
- Address PR review feedback (cache/rollback/item-loss edge cases)
  
  Jakubk15
  and
  claude
  committed
  f859387
- Merge branch 'master' into audit-fixes
  Jakubk15
  committed
  7c16c7d
- Address second review round (@claude): cache desyncs + UX
  
  Jakubk15
  and
  claude
  committed
  d6ec8a5
- Update src/main/java/com/eternalcode/parcellockers/user/UserManagerImpl.java
  Jakubk15
  authored
  d5a200f
- Update src/main/java/com/eternalcode/parcellockers/user/UserManagerImpl.java
  Jakubk15
  authored
  0d5463e
Commits on Jun 21, 2026
- Update build configuration and enhance locker item consumption logic
  Jakubk15
  committed
  83b6bdd
- Delete AUDIT.md
  Jakubk15
  authored
  cfcc33f

Commits

Commits on Jun 20, 2026

Commits on Jun 21, 2026