`malden-house/review.md`

35 lines
## Snapshot
- Static “Victory Stays” LA 2028 rental microsite generator/dashboard for host listings.
- Stack: HTML, CSS, vanilla browser JS, Node-only smoke script; runtime browser/static server; datastore `localStorage`.
- How it's run: manual/static file server; `network.html` implies local `:8787`, no config.
- Status: live prototype; updated Apr 2026, no deploy metadata.

## Top Risks (P0 — fix this week)
- [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:217): email verification is hardcoded `verified: true`; anyone can “claim” any address/email locally. Fix with server-side account creation, signed email tokens, and address ownership rules.
- [rental.js](/Users/stevestudio2/Projects/malden-house/rental.js:735): guest inquiries are saved to the visitor’s own `localStorage`, not the host’s inbox; production inquiries silently disappear. Fix with a backend endpoint/email delivery and explicit failure UI.
- [network.js](/Users/stevestudio2/Projects/malden-house/network.js:33): public source exposes Tailscale IPs, public server IPs, hostnames, service names, and ports. Remove `network.html/js` from public builds or gate behind auth/VPN-only hosting.
- [dashboard.js](/Users/stevestudio2/Projects/malden-house/dashboard.js:30), [browse.js](/Users/stevestudio2/Projects/malden-house/browse.js:35), [rental.js](/Users/stevestudio2/Projects/malden-house/rental.js:374): trusted `localStorage`/geocoder fields are rendered through template `innerHTML`; malicious stored records can execute markup/script-like payloads. Build DOM nodes with `textContent` or sanitize all interpolated fields.
- [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:263): demo seed includes Steve’s real-looking email/phone/address in source and UI. Replace with fake fixtures before any public repo/deploy.

## Notable Issues (P1 — fix this month)
- [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:219): slug collision overwrites existing rentals silently (`all[slug] = record`). Detect duplicates and append stable suffixes or block duplicate claims server-side.
- [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:9), [rental.js](/Users/stevestudio2/Projects/malden-house/rental.js:3): schema mismatch wipes all stored rentals/photos/inquiries without confirmation. Add migration code and backup/export before destructive changes.
- [dashboard.js](/Users/stevestudio2/Projects/malden-house/dashboard.js:220): photo uploads are stored as base64 in `localStorage`; quota errors are uncaught and can lose the edit session. Use IndexedDB/object storage and handle quota failures visibly.
- [schedule.js](/Users/stevestudio2/Projects/malden-house/schedule.js:5): venue data is duplicated from `signup.js`; drift will produce inconsistent pricing/schedule pages. Extract a shared data module or generated JSON.
- [test-e2e.js](/Users/stevestudio2/Projects/malden-house/test-e2e.js:12): smoke test depends on live Nominatim calls and sleeps; flaky/offline by design. Mock geocode responses for deterministic CI.
- [network.js](/Users/stevestudio2/Projects/malden-house/network.js:28): `no-cors` polling treats opaque responses as success, so health indicators can be false green. Use a same-origin health proxy or remove misleading status.

## Polish (P2 — when convenient)
- No `README`, `package.json`, or run/deploy instructions observed.
- No CSP/meta security policy; useful once external embeds and `innerHTML` are reduced.
- Several product claims exceed implementation: email verify, permanent URLs, email inquiries, registrar checkout.

## Strengths
- Clear static architecture: easy to serve, inspect, and demo without build tooling.
- Pricing/geocoding/venue logic is concentrated in [signup.js](/Users/stevestudio2/Projects/malden-house/signup.js:21), making extraction to a backend straightforward.
- UI has useful owner workflows already sketched: signup, browse, dashboard, photo library, inquiries, schedule.

## Open questions for the owner
- Is this intended to be public, or only a local demo/prototype?
- Should guest inquiries email Steve/hosts now, or wait for a real backend?
- Should `network.html` live in this repo at all?