Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Epic: Production readiness review

Aperta
  • Qualcosa non va?
#38 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Refactoring
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
azure
Ambito
backend, ci-cd, cloud, databases, observability, security, testing

Direzione di ricerca

Leggi i servizi e le entità di LearnStack.Core, l'app Blazor Server, i 38 test unitari e il workflow di deployment Azure, usando i risultati suddivisi per livello come checklist per la review. Inizia suddividendo l'epic in sotto-issue verificabili indipendentemente; completato significa che ogni rischio operativo ha delle evidenze, un ambito concordato e un percorso di verifica chiaro.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement

Overview

Full static review of the solution — LearnStack.Core (7 entities, 5 services), the Blazor Server app (14 pages, Identity + passkeys, 5 languages), 38 unit tests, and the Azure deployment workflow — to identify what is needed before opening the app to real users.

[!NOTE]
This review is static analysis only: the code was read, not built or executed. Each sub-issue records the evidence (file + line) it is based on so it can be verified independently.

Verdict: the product surface is in good shape (resources, content ideas, friends, shared collections, Pulse, PWA, i18n). What is missing is almost entirely the operational layer — transactional email, data-protection key persistence, observability, database indexes, rate limiting and CI gates. Roughly five items will cause real problems on the first day of real traffic.

Nothing here is committed work — this epic is a backlog to triage.

Tier 1 — Release blockers
Area Problem
Auth / email Email sender is a no-op: password reset and email confirmation silently do nothing
Data Protection No key persistence — every restart or scale-out logs every user out
Migrations MigrateAsync() on startup rethrows and races across instances
CI Tests never gate the deploy; no PR build workflow exists
Deploy No staging slot, smoke test or rollback; publish-profile secret instead of OIDC
Observability No health checks, no telemetry, no structured logging
Tier 2 — Scale, security and cost
Area Problem
Thumbnails Up to 5 MB blobs on the resource row, base64-inlined into every render
Indexes No index on UserId on any user-owned table
Pagination Whole library loaded into memory, then filtered and paged in the component
Rate limiting Nothing throttled — auth, public share pages, or the metadata fetcher
SSRF Redirects bypass the private-IP check; unbounded response body
Edge hardening No security headers, AllowedHosts: "*", no forwarded headers
Config LocalDB connection string committed as the production default
Concurrency No RowVersion; concurrent edits overwrite each other silently
Tier 3 — Correctness and polish
Area Problem
Account deletion Likely FK failure for users with linked ideas or shared collections (GDPR-facing)
DisplayName Settable but never displayed; email local-part shown instead
Dead code CultureMiddleware never registered
Localization ro offered but has no resource file; ~56 strings untranslated in de/es/fr/it
Timezones Everything UTC — relative dates and Pulse charts are wrong outside UTC
Repo hygiene build_err.txt committed, leaking local paths
Tests 38 tests, Core services only — no authorization-boundary or component tests
Supply chain No Dependabot, CodeQL or secret scanning
Tier 4 — Feature ideas

Categories/tags as first-class entities, browser extension and PWA share target, import from Pocket/Raindrop/bookmarks, digest email, AI assist on resources, full-text search, offline PWA, public profile pages, share analytics, admin dashboard, streaks and goals on Pulse.

Suggested sequencing
  1. Week 1 — cannot launch without: real email sender + confirmed accounts, Data Protection keys, migrations out of startup, PR CI that actually gates, health checks + telemetry.
  2. Week 2 — survives users: thumbnails out of SQL, indexes + server-side pagination, rate limiting, security headers, redirect-aware SSRF fix.
  3. Week 3 — trust: fix account deletion, authorization-boundary tests, staging slot + swap, Dependabot/CodeQL, finish the translations.
  4. Then features: browser extension / share target and import first — they address the biggest friction in the current flow.
Lingua principale
HTML
Stelle
10
Fork
0
Merge medio
2h 35m
PR unite (30g)
21

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di kasuken/LearnStack

Tutte le issue di kasuken/LearnStack

Issue simili

Altre issue su Backend & API Design

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.