Nestor G Pestelos Jr · Print PDF
Codebase readiness read
Ninthgreen
Executive summary
Members book classes, groups, dining, tee times, and events. The app still boots. The stack is past official support. Join, book, and mail go through a background worker. Cross-site request forgery protection is commented out.
Fix first
- Turn request-forgery protection back on.
- Run the job worker next to the web process. Join and book enqueue mail.
- Keep the current Ruby and Rails pins. Do not mass-upgrade the lockfile.
Leave
- The leftover seed after the demo users.
- Old skin classes on events, tee times, and group show.
- Club timezone hardcoded to one zone.
Decision: pin-and-run. A version climb is a later fixed-scope modernization sprint, not this week.
Scope and method
One primary repository at SHA 6b4d2a5. Read-only. Local compose, not staging. No production traffic. Case-study intake, not a client questionnaire.
| Area | Result |
|---|---|
| Architecture | Reviewed. One app. Person STI. None above Low. |
| Test trust | Reviewed. Estate integration tests exist. Full suite not re-run. None above Low this pass. |
| Hot paths | Reviewed. Clinic book, dining reserve, group join enqueue jobs. See High: worker. |
| Dependency health | Reviewed. Ruby 2.6.6 / Rails 5.0.7.2. High: past support. |
| Error handling | Reviewed. High: forgery protection off. |
| Deploy basics | Reviewed. Procfile web + worker. Worker is load-bearing. |
Out of scope: penetration test, compliance certificate, a second service, ongoing monitoring. Member and tax-roll dumps in the tree were not used as evidence.
Findings
High Request-forgery protection is off
app/controllers/application_controller.rb comments out protect_from_forgery. A TODO says to put it back.
Impact — Book, join, and reserve posts have no Rails CSRF check.
Fix direction — Restore protect_from_forgery with: :exception. Recheck the mobile calendar exceptions in app/controllers/calendar/app_controller.rb.
High Join, book, and mail need the job worker
config/application.rb sets the Active Job adapter to Sidekiq. Creating a group membership calls deliver_later. Clinic book and dining reserve do the same.
Impact — Without Redis and a worker process, join and book can error or drop mail.
Fix direction — Run the worker process from Procfile next to web. Do not create memberships in seed without skipping that callback.
High Runtime is past official support
Ruby 2.6.6 (Gemfile, .ruby-version). Rails 5.0.7.2 (Gemfile.lock).
Impact — No official security patches. That is age, not a counted advisory list.
Fix direction — Stay pinned until a planned climb. Do not treat lockfile noise as a product upgrade.
Medium Leftover seed after the demo block
db/seeds.rb creates demo users, then more people and groups. Adding members fires the join callback.
Impact — A full db:seed is not a safe one-shot.
Fix direction — Keep a narrow demo path. Do not run the rest.
Medium Old skin classes on later surfaces
app/views/events/index.html.erb and the tee-time and group-show templates still use the old class set.
Impact — Those pages look broken if the old CSS engine is gone.
Fix direction — Restyle when a buyer cares. Not this week’s operability.
Low Club timezone is one hard-coded zone
TimezoneMonitor#club_time_zone returns a single zone. Clinics, tee times, and several jobs repeat that string.
Impact — An operator in another zone sees the wrong calendar day.
Fix direction — One config value. Leave until geography changes.
Roadmap
- This week (S). Restore CSRF. Run web and worker. Keep demo seed only.
- Before any Rails minor (M). Run the estate test pack. List gems that block 5.1.
- Later sprint (L). Ruby, then Rails. Not a lockfile sweep.
- Do not. Mass-upgrade gems. Restore the old CSS engine. Publish this tree.
Assumptions and limits
- Local compose. Not their staging.
- No production traffic.
- Security here is posture and dependency age, not a pentest and not an advisory count.
- In-tree member and tax-roll files were not opened as evidence.
- The club name on this page is fictional.