Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Epic: Production readiness review

Abierto
  • ¿Algo no está bien?
#38 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Refactorización
Claridad
Necesita aclaración
Estado de actividad
Activo
Stack tecnológico
azure
Área
backend, ci-cd, cloud, databases, observability, security, testing

Línea de trabajo

Lee los servicios y las entidades de LearnStack.Core, la aplicación Blazor Server, las 38 pruebas unitarias y el flujo de trabajo de despliegue de Azure, utilizando los hallazgos escalonados como lista de comprobación para la revisión. Empieza dividiendo el epic en subissues que se puedan verificar de forma independiente; terminado significa que cada riesgo operativo tiene evidencias, un alcance acordado y una ruta de verificación clara.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

Overview

Full static review of the solution — LearnStack.Core (7 entities, 5 services), the Blazor Server app (14 pages, Identity + passkeys, 5 languages), 38 unit tests, and the Azure deployment workflow — to identify what is needed before opening the app to real users.

[!NOTE]
This review is static analysis only: the code was read, not built or executed. Each sub-issue records the evidence (file + line) it is based on so it can be verified independently.

Verdict: the product surface is in good shape (resources, content ideas, friends, shared collections, Pulse, PWA, i18n). What is missing is almost entirely the operational layer — transactional email, data-protection key persistence, observability, database indexes, rate limiting and CI gates. Roughly five items will cause real problems on the first day of real traffic.

Nothing here is committed work — this epic is a backlog to triage.

Tier 1 — Release blockers
Area Problem
Auth / email Email sender is a no-op: password reset and email confirmation silently do nothing
Data Protection No key persistence — every restart or scale-out logs every user out
Migrations MigrateAsync() on startup rethrows and races across instances
CI Tests never gate the deploy; no PR build workflow exists
Deploy No staging slot, smoke test or rollback; publish-profile secret instead of OIDC
Observability No health checks, no telemetry, no structured logging
Tier 2 — Scale, security and cost
Area Problem
Thumbnails Up to 5 MB blobs on the resource row, base64-inlined into every render
Indexes No index on UserId on any user-owned table
Pagination Whole library loaded into memory, then filtered and paged in the component
Rate limiting Nothing throttled — auth, public share pages, or the metadata fetcher
SSRF Redirects bypass the private-IP check; unbounded response body
Edge hardening No security headers, AllowedHosts: "*", no forwarded headers
Config LocalDB connection string committed as the production default
Concurrency No RowVersion; concurrent edits overwrite each other silently
Tier 3 — Correctness and polish
Area Problem
Account deletion Likely FK failure for users with linked ideas or shared collections (GDPR-facing)
DisplayName Settable but never displayed; email local-part shown instead
Dead code CultureMiddleware never registered
Localization ro offered but has no resource file; ~56 strings untranslated in de/es/fr/it
Timezones Everything UTC — relative dates and Pulse charts are wrong outside UTC
Repo hygiene build_err.txt committed, leaking local paths
Tests 38 tests, Core services only — no authorization-boundary or component tests
Supply chain No Dependabot, CodeQL or secret scanning
Tier 4 — Feature ideas

Categories/tags as first-class entities, browser extension and PWA share target, import from Pocket/Raindrop/bookmarks, digest email, AI assist on resources, full-text search, offline PWA, public profile pages, share analytics, admin dashboard, streaks and goals on Pulse.

Suggested sequencing
  1. Week 1 — cannot launch without: real email sender + confirmed accounts, Data Protection keys, migrations out of startup, PR CI that actually gates, health checks + telemetry.
  2. Week 2 — survives users: thumbnails out of SQL, indexes + server-side pagination, rate limiting, security headers, redirect-aware SSRF fix.
  3. Week 3 — trust: fix account deletion, authorization-boundary tests, staging slot + swap, Dependabot/CodeQL, finish the translations.
  4. Then features: browser extension / share target and import first — they address the biggest friction in the current flow.
Lenguaje dominante
HTML
Estrellas
10
Forks
0
Merge medio
2 h 35 min
PR fusionados (30 d)
21

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de kasuken/LearnStack

Todos los issues de kasuken/LearnStack

Issues similares

Más issues de Backend & API Design

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.