Issues

• [Security 🟡] permission.service.ts isSuperAdmin 與 isAdmin 角色字串不一致，產生不對稱權限邊界

  code-review
  daodaoedu/daodao-server#692 · Filter by author vincentxuu opened on Nov 8, 2026

• [Quality 🟡] server.ts 重複註冊 error handler 與 404 handler，產生死碼

  code-review
  daodaoedu/daodao-server#691 · Filter by author vincentxuu opened on Nov 8, 2026

• [Performance 🔴] admin-tracking.service.ts 多個 findMany 無 take 上限，全表掃描風險

  code-review
  daodaoedu/daodao-server#690 · Filter by author vincentxuu opened on Nov 8, 2026

• [Security 🔴] practice.routes.ts 五個路由缺少擁有者驗證，任意用戶可修改/刪除他人練習記錄

  code-review
  daodaoedu/daodao-server#689 · Filter by author vincentxuu opened on Nov 8, 2026

• [Performance 🟡] comment.service.ts getComments 每筆 comment 各自呼叫 convertToExternalId，N+1 DB round-trip

  code-review
  daodaoedu/daodao-server#551 · Filter by author vincentxuu opened on Oct 18, 2026

• [Architecture 🟢] BACKEND_URL 未列入環境變數範本，未設定時 email 連結指向 localhost

  code-review
  daodaoedu/daodao-server#537 · Filter by author vincentxuu opened on Oct 11, 2026

• [Architecture 🟢] JWT_EXPIRATION 環境變數設定後無效，實際 token 有效期硬編碼為 7 天

  code-review
  daodaoedu/daodao-server#536 · Filter by author vincentxuu opened on Oct 11, 2026

• [Quality 🟡] admin-events.service.ts $queryRawUnsafe 字串插值模式，有未來引入 SQL injection 的風險

  code-review
  daodaoedu/daodao-server#535 · Filter by author vincentxuu opened on Oct 11, 2026

• [Performance 🟡] GET /api/v1/db-info N+1 查詢：每個 table 執行 5 次獨立 DB 查詢

  code-review
  daodaoedu/daodao-server#534 · Filter by author vincentxuu opened on Oct 11, 2026

• [Security 🟡] resendVerificationEmail 回傳 404 導致 email 枚舉攻擊

  code-review
  daodaoedu/daodao-server#533 · Filter by author vincentxuu opened on Oct 11, 2026
  1

• [Quality 🟡] admin-learning.service.ts bulkIssueCertificate 以字串插值組 SQL VALUES，應改為 unnest 參數化寫法

  code-review
  daodaoedu/daodao-server#509 · Filter by author vincentxuu opened on Oct 4, 2026

• [Security 🟡] POST /api/v1/email/password-reset 無速率限制，任何人可無限寄送密碼重設信

  code-review
  daodaoedu/daodao-server#508 · Filter by author vincentxuu opened on Oct 4, 2026
  2

• [Security 🔴] .env.prod_temp / .env.dev_temp 包含真實 DB 認證與 hostname 被 commit 至 git repo

  code-review
  daodaoedu/daodao-server#507 · Filter by author vincentxuu opened on Sep 27, 2026
  1

• [Quality 🟢] template-resolver.service.ts in-process cache 無法跨 replica 失效，多實例環境下 5 分鐘內仍送舊模板

  code-review
  daodaoedu/daodao-server#505 · Filter by author vincentxuu opened on Sep 20, 2026

• [Architecture 🟡] permission.middleware.ts 忽略 JWT claims 每次都查 DB，與 authenticateWithOptions 雙軌不一致

  code-review
  daodaoedu/daodao-server#504 · Filter by author vincentxuu opened on Sep 20, 2026

• [Performance 🟡] 公開列表端點 pageSize 無上限，未認證用戶可觸發全表掃描

  code-review
  daodaoedu/daodao-server#503 · Filter by author vincentxuu opened on Sep 20, 2026

• [Performance 🟡] note.service.ts 每筆 note 各自查詢作者 tags，N+1 DB round-trip

  code-review
  daodaoedu/daodao-server#502 · Filter by author vincentxuu opened on Sep 20, 2026

• [Security 🟡] resource-review.service.ts 硬編碼 UUID 觸發 debug 資料洩漏至 API 回應

  code-review
  daodaoedu/daodao-server#501 · Filter by author vincentxuu opened on Sep 20, 2026

• [Security 🔴] note.service.ts updateNote / deleteNote 未驗證擁有者，任意用戶可修改/刪除他人便利貼

  code-review
  daodaoedu/daodao-server#500 · Filter by author vincentxuu opened on Sep 20, 2026
  1

• [Review] space.service.ts listMembers/listSpacePractices 未設 take 上限，大空間可能全表掃描

  code-review
  daodaoedu/daodao-server#444 · Filter by author vincentxuu opened on Aug 30, 2026

• [Review] space.service.ts updateBlock() 在迴圈中逐筆 create 連結，應改用 createMany

  code-review
  daodaoedu/daodao-server#443 · Filter by author vincentxuu opened on Aug 30, 2026

• [Review] space.validators.ts 資源連結與活動 URL 欄位未驗證 scheme，允許 javascript: URI 儲存

  code-review
  daodaoedu/daodao-server#442 · Filter by author vincentxuu opened on Aug 30, 2026

• 共同挑戰 & 主頁 layout 修改

  daodaoedu/daodao-server#420 · Filter by author peggy1213-create opened on Aug 19, 2026

• cohort network

  daodaoedu/daodao-server#418 · Filter by author peggy1213-create opened on Aug 18, 2026

• [Architecture 🟡] OpenAPI spec 和 Swagger UI 無需認證即可存取，完整 API 路由結構對外公開

  code-review
  daodaoedu/daodao-server#417 · Filter by author vincentxuu opened on Aug 16, 2026