`consensus/VictoryStays.md`

44 lines

# Consensus — VictoryStays
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- [server.js](/Users/stevestudio2/Projects/VictoryStays/server.js:51): `express.static(__dirname)` publishes the whole repo, including `data/victorystays.db`, source, lockfiles, generated datasets, and future `data/claims.jsonl`. Fix: serve a dedicated `public/` dir and explicitly block `/data`, scripts, DB/WAL/SHM, logs.
- [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:81): `GET /api/claim?admin=1` returns every claim, PII, and verification codes with no auth. Fix: require operator auth/session or remove public route.
- [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:103): unauthenticated `PATCH /api/claim` can mark any claim verified/rejected; code check is optional. Fix: authenticate operator actions and require code for verification.
- [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:72), [home.html](/Users/stevestudio2/Projects/VictoryStays/home.html:434): claim submission returns the postcard verification code to the claimant, defeating the mail-based proof. Fix: never return the code; only store/print/mail it.
- [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:27): unbounded JSON body plus sync append lets anyone fill disk with claims. Fix: `express.json({limit})`, rate-limit/IP throttle, validate field lengths.

## Round-1 applied
## Applied
- templates/city.html:454 — added a small `escapeHTML` helper and used it for user-entered street text, API parcel fields, assessor links, and error messages before rendering with `innerHTML` — prevents DOM injection while preserving the existing markup.
- search.html:121 — added the same local `escapeHTML` helper and escaped query text, parcel/assessment fields, permit rows, assessor links, and error messages before `innerHTML`/`insertAdjacentHTML` rendering — fixes the flagged client-side XSS risk without changing customer-facing copy.

## Codex re-review verdict: FIX BEFORE SHIP

## New issues introduced
none observed

## Round-2 applied
## Round 2 Applied
- beverly-hills.html:21958 — added local `escapeHTML` helper and escaped street text, parcel fields, assessor link URL, and lookup error before `innerHTML` rendering — fixes CODEX_REREVIEW "Missed call-sites" at beverly-hills.html:21968 and beverly-hills.html:21997, plus the template-generation "STATUS concern".
- burbank.html:15058 — added local `escapeHTML` helper and escaped street text, parcel fields, assessor link URL, and lookup error before `innerHTML` rendering — fixes CODEX_REREVIEW "Missed call-sites" at burbank.html:15068 and burbank.html:15097, plus the template-generation "STATUS concern".
- west-hollywood.html:28490 — added local `escapeHTML` helper and escaped street text, parcel fields, assessor link URL, and lookup error before `innerHTML` rendering — fixes CODEX_REREVIEW "Missed call-sites" at west-hollywood.html:28500 and west-hollywood.html:28529, plus the template-generation "STATUS concern".

## Still deferred for Steve
- P0 — server.js:51 — `express.static(__dirname)` publishes the repo tree — deferred because changing the public asset root/routing is broader than the approved safe fixes and could break live paths.
- P0 — api-claim.js:81 — admin claim firehose exposes claims/PII/codes without auth — deferred because it needs an operator auth/session decision.
- P0 — api-claim.js:103 — unauthenticated claim status updates and optional verification code — deferred because it needs auth and verification workflow decisions.
- P0 — api-claim.js:72 — claim submission returns the postcard verification code — deferred because removing it changes the operator/claim API contract.
- P0 — api-claim.js:27 — unbounded JSON body and synchronous append can fill disk/block the process — deferred because rate limits, field limits, and storage behavior need product/runtime choices.
- P1 — api-claim.js:17 — admin/list lookups synchronously parse the full JSONL file — deferred because the recommended SQLite move touches persistence design.
- P1 — api-claim.js:120 — PATCH rewrites the full claims file without locking/atomic rename — deferred because concurrency-safe persistence changes need more validation.
- P1 — api-property.js:75 — ArcGIS `LIKE` query allows broad wildcard-heavy searches — deferred because input policy changes were outside the approved safe list.
- P1 — api-build-status.js:15 — status API opens the production SQLite DB read/write and changes WAL mode — deferred because DB access-mode changes were outside the approved safe list.
- P1 — scripts/enrich-listings-worker.js:95 — transient API failures permanently mark listings failed — deferred because retry state/backoff changes affect worker behavior and likely persistence.