Audit fixes: dupe/economy exploits, race conditions, DB bugs, cleanups#217

Merged

Jakubk15 merged 35 commits into

Jun 21, 2026

Commits on Jun 20, 2026

Add codebase audit report

Jakubk15
and
claude
committed
Fix C1: refund parcel fee when persistence fails

Jakubk15
and
claude
committed
Fix C2: fully roll back a parcel when storage clearing fails

Jakubk15
and
claude
committed
Fix C3: consume the locker item when a locker is created

Jakubk15
and
claude
committed
Fix C4: cancel locker break to prevent chest/contents duplication

Jakubk15
and
claude
committed
Fix H1: make parcel collection space-check and delivery race-safe

Jakubk15
and
claude
committed
Fix H2: close the locker-fullness TOCTOU race

Jakubk15
and
claude
committed
Fix H3: page lockers from the repository, not the partial cache

Jakubk15
and
claude
committed
Fix H4: cancel chest interaction in-tick so the vanilla chest stays shut

Jakubk15
and
claude
committed
Fix H6: populate the user cache on read misses

Jakubk15
and
claude
committed
Fix H5: detect user conflicts against the database, not just the cache

Jakubk15
and
claude
committed
Fix M1: delete the delivery only after the status update succeeds

Jakubk15
and
claude
committed
Fix M3: stop mutating the cache from inside its own loader

Jakubk15
and
claude
committed
Fix M4: surface item-storage save failures and return staged items

Jakubk15
and
claude
committed
Fix M5: fail fast when the item storage table cannot be created

Jakubk15
and
claude
committed
Fix M6: rename ambiguous repository wrapper methods

Jakubk15
and
claude
committed
Fix M7: make DAO cache population atomic

Jakubk15
and
claude
committed
Fix M8: make connection pool tuning configurable

Jakubk15
and
claude
committed
Fix M2: make domain event firing thread deterministic

Jakubk15
and
claude
committed
Fix L1: switch on the DatabaseType enum directly

Jakubk15
and
claude
committed
Fix L3: tear down listeners/tasks before closing the datasource

Jakubk15
and
claude
committed
Fix L4: remove misleading stale comment in LockerPlaceController

Jakubk15
and
claude
committed
Fix L5: account for stacking in the collection space check

Jakubk15
and
claude
committed
Refactor D5: collapse duplicate createActiveItem overloads

Jakubk15
and
claude
committed
Refactor D1: extract repository table bootstrap into the base class

Jakubk15
and
claude
committed
Refactor D2: extract shared paginated-query helper

Jakubk15
and
claude
committed
Refactor D4: share cancel handling via a CancellableEvent base

Jakubk15
and
claude
committed
Record audit resolution status in AUDIT.md

Jakubk15
and
claude
committed
Address PR review feedback (cache/rollback/item-loss edge cases)

Jakubk15
and
claude
committed
Merge branch 'master' into audit-fixes
Jakubk15
committed
Address second review round (@claude): cache desyncs + UX

Jakubk15
and
claude
committed
Update src/main/java/com/eternalcode/parcellockers/user/UserManagerImpl.java
Jakubk15
authored
Update src/main/java/com/eternalcode/parcellockers/user/UserManagerImpl.java
Jakubk15
authored

Commits on Jun 21, 2026