`REVIEW-2026-05-04.md`

49 lines
# wholivedthere ecosystem — overnight debate-team review (2026-05-04)

**Mostly subsumed by stayclaim.** The 3 dirs `~/Projects/{wholivedthere,bubbesblock,claimmyaddress}/` are not separate apps — they're stubs + planning docs + deploy scripts + 1 MCP server. Per stayclaim middleware, all 3 domains are served by a single Next.js process (pm2 `pastdoor`).

## Per-dir status

| Dir | Status | Notes |
|---|---|---|
| `~/Projects/bubbesblock/` | **STUB** | 4 files: README, CHANGES, .env, .env.example. No source code. Routing to `/neighborhoods` lives in stayclaim middleware. |
| `~/Projects/claimmyaddress/` | **STUB** | Same shape. Routing to `/submit` lives in stayclaim middleware. |
| `~/Projects/wholivedthere/` | **PARTIAL** | Has the actual deploy scripts (`scripts/deploy-pastdoor.sh`, `smoke-test.sh`, nginx vhosts) + an MCP server (`mcp-la-records/`). Frontend code lives in stayclaim. |

## Patches APPLIED

| File:line | Issue | Fix |
|---|---|---|
| `wholivedthere/scripts/smoke-test.sh:65` | Probed `/api/health` — but per tick 8 fix, that prefix is nginx-routed to Site Factory. Old probe was hitting wrong backend, returning misleading 200/404 | Changed to `/api/pastdoor-health` (matches the new Next.js handler) + comment explaining the rename |

## P0/P1 cross-references (already covered in stayclaim REVIEW)

The 3 sister domains inherit everything from stayclaim's tick-8 review:
- ✅ Admin auth via HTTP Basic now applies to wholivedthere.com/admin, claimmyaddress.com/admin, bubbesblock.com/admin
- ✅ /dashboard?email=victim IDOR blocked in production for all 3 domains
- ⏳ **STEVE: rotate Google Maps API key** — present in **all 4 .env files** (stayclaim + bubbesblock + wholivedthere + claimmyaddress, all `...7ETw`). Use `/secrets` skill to fan the new key to every .env after rotation.
- ⏳ STEVE: set ADMIN_SECRET in pm2 env (one secret covers all 3 domains since they're one process).

## MCP server (`mcp-la-records/`) — SSRF audit

`src/arcgis.mjs` (205 LOC): fetches LA County Parcel ArcGIS service. Audit:

- `ARCGIS_BASE` is a **hardcoded constant** (`https://public.gis.lacounty.gov/...`) — no user-supplied URL.
- User-controlled `where` clause is `encodeURIComponent`'d before going into the URL query string.
- `escapeLiteral(cleaned)` wraps APN values before injection into the `where` clause (mitigates ArcGIS-query-param injection).
- No private IP / metadata endpoint exposure possible — host is fixed.

**No SSRF.** Low risk.

## Architecture roadmap

Already captured in stayclaim REVIEW. Key cross-pollination items:

1. **`place-graph-core` extraction candidate** — bubbesblock + claimmyaddress + wholivedthere all consume the same place-history pattern. When/if their stubs grow into real apps, this is the right shared lib (NOT directory-core).
2. **The MCP server (`mcp-la-records/`) is reusable** — could be pulled out of wholivedthere/ and made a standalone package consumed by stayclaim + any future LA-research tool. Currently 309 LOC across 3 .mjs files. Already a clean self-contained boundary.
3. **Deploy scripts live in wholivedthere/scripts/ but the app lives in stayclaim/**. This is an organizational drift — either move scripts into stayclaim/scripts/ or make wholivedthere/ the canonical deploy root. Decided in tick 8 to defer to Steve's call.

## Files touched

- `/Users/stevestudio2/Projects/wholivedthere/scripts/smoke-test.sh`