`consensus/stayclaim.md`

49 lines

# Consensus — stayclaim
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `.env.local:4`: real Google Maps browser key is in the workspace; if unrestricted, cost/abuse risk. Rotate it, remove `.env.local`, enforce HTTP referrer restrictions and quotas.
- `scripts/filmla-cpra-followup.sh:15-16`: hardcoded Basic Auth credential to a Gmail HTTP agent over plain HTTP tailnet URL; repo leak grants email search/send. Rotate credential; load from Keychain/env; require TLS or strict Tailscale ACL.
- `src/app/admin/layout.tsx:45-46`, `src/app/admin/data/page.tsx:167-192`: admin is explicitly unauthenticated and exposes claim/sponsored emails. Put real server-side auth in front of all `/admin/*`, plus nginx deny until ready.
- `src/app/dashboard/page.tsx:11-14`, `src/app/dashboard/page.tsx:21`, `src/app/dashboard/page.tsx:59-63`: `?email=` acts as authentication; anyone who knows an email can view owner listings/pending claims. Replace with magic-link/session auth before exposing.
- `src/app/search/page.tsx:128-130`, `src/app/api/search/route.ts:107-109`: OCR snippets are rendered with `dangerouslySetInnerHTML`; OCR/source text can become stored XSS. Escape source text and render `<mark>` tokens safely.
- `package.json:17`: `next@14.2.15` is below the patched `14.2.25` for CVE-2025-29927 middleware auth bypass; especially dangerous if `/admin` auth is added in middleware only. Upgrade Next or block `x-middleware-subrequest` at the proxy.

## Round-1 applied
## Applied
- `scripts/filmla-cpra-followup.sh:16` — removed the hardcoded Basic Auth credential and read it from `FILMLA_GEORGE_BASIC_AUTH` — prevents source exposure of the Gmail HTTP agent password.
- `scripts/filmla-cpra-followup.sh:41` — added a fail-fast check when `FILMLA_GEORGE_BASIC_AUTH` is missing — avoids silently calling the agent without required credentials.
- `.env.example:5` — added a placeholder for `FILMLA_GEORGE_BASIC_AUTH` — documents the required secret without copying the real value.
- `src/app/search/page.tsx:42` — added a small snippet renderer that treats only literal `<mark>` tokens as markup — preserves highlights while letting React escape OCR/source text.
- `src/app/search/page.tsx:144` — replaced `dangerouslySetInnerHTML` with React-rendered snippet content — removes the stored DOM injection path flagged for search results.

## Codex re-review verdict: FIX BEFORE SHIP

## New issues introduced
`scripts/filmla-cpra-followup.sh:41` — launchd/non-interactive runs will not automatically load `.env.example` or shell profile vars, so the scheduled CPRA follow-up now exits before checking/sending unless the launchd job is separately updated with `FILMLA_GEORGE_BASIC_AUTH` — severity P1

## Round-2 applied
## Round 2 Applied
- `scripts/filmla-cpra-followup.sh:16` — added optional sourcing of `${FILMLA_CPRA_ENV_FILE:-$HOME/.filmla-cpra-followup.env}` before `FILMLA_GEORGE_BASIC_AUTH` is read — fixes re-review "STATUS broken" / P1 finding that launchd/non-interactive runs would otherwise exit before checking or sending.
- `.env.local.example:4` — added `FILMLA_GEORGE_BASIC_AUTH` placeholder — fixes re-review missed call-site: local setup template lacked the required secret.
- `.env.production.example:3` — added `FILMLA_GEORGE_BASIC_AUTH` placeholder — fixes re-review missed call-site: production setup template lacked the required secret.

## Still deferred for Steve
- P0 — `.env.local:4` — real Google Maps browser key exists in the workspace — needs key rotation, referrer restrictions, quotas, and `.env.local` handling outside this safe patch.
- P0 — `scripts/filmla-cpra-followup.sh:15` — Gmail agent still uses a plain HTTP tailnet URL and the removed credential still needs rotation — requires Steve’s secret rotation and network/Tailscale decision.
- P0 — `src/app/admin/layout.tsx:45` — `/admin/*` is explicitly unauthenticated — auth/proxy policy is larger than the allowed safe fixes.
- P0 — `src/app/dashboard/page.tsx:11` — `?email=` acts as authentication — requires product/auth flow changes.
- P0 — `package.json:17` — Next version is below the reviewed patched version — package version bumps are out of scope.
- P1 — `src/app/claim/[slug]/page.tsx:34` — claim form has no submission path — feature behavior change, not in safe list.
- P1 — `src/app/search/page.tsx:44` — server fetch trusts the incoming `Host` header — not in safe list; needs routing/search architecture decision.
- P1 — `src/app/api/search/route.ts:47` — no max query length before DB fanout — validation policy change, not in safe list.
- P1 — `scripts/extract-news-addresses.ts:212` — delete/insert/mark flow lacks transaction/advisory lock — transaction/concurrency change deferred.
- P1 — `src/app/admin/data/page.tsx:217` — filter DB errors are swallowed — admin UX/reporting decision deferred.
- P1 — `package.json:12` — `ingest:airbnb` points to a missing script — command removal/restoration decision deferred.