Add full public request audit

2026-06-10 19:04:29 +02:00
parent a2d6951bee
commit 97234179c8
3 changed files with 1229 additions and 0 deletions
--- a/ai/tasks/done/TASK-224-full-application-request-audit.md
+++ b/ai/tasks/done/TASK-224-full-application-request-audit.md
@@ -0,0 +1,167 @@
+---
+id: TASK-224
+title: Full application request audit
+status: done
+type: research
+team: Analista
+supporting_teams:
+  - Backend Senior
+  - Frontend Senior
+  - Arquitecto Python
+  - Arquitecto de Base de Datos
+roadmap_item: foundation
+priority: high
+---
+
+# TASK-224 - Full application request audit
+
+## Goal
+
+Discover, classify, measure and document all relevant public application requests across frontend and backend/API without applying functional fixes.
+
+## Context
+
+Recent public ranking/snapshot optimizations were followed by a regression in `historico-partida.html` and `/api/historical/matches/detail`. Production profiling showed the real bottleneck was storage initialization during a public read path:
+
+- `get_rcon_historical_match_detail()`: 14.193s
+- `get_materialized_rcon_match_detail()`: 14.167s
+- `initialize_postgres_rcon_storage()`: 14.147s
+- `initialize_rcon_materialized_storage()`: 14.133s
+- storage read after initialization: 0.224s
+- payload build: 0.014s
+
+This task audits the complete public request surface to find other endpoints with similar cold-read initialization, DDL/bootstrap, direct live network calls or heavyweight fallback behavior.
+
+## Steps
+
+1. Inspect repository context, architecture notes and relevant orchestrator role guidance.
+2. Review `backend/app/routes.py` and extract all public GET routes.
+3. Review `backend/app/payloads.py` and storage/read-model modules reached by payload builders.
+4. Search backend for `initialize_*`, `ensure_*`, DDL, migration, bootstrap, fallback, direct RCON and external HTTP paths.
+5. Review public frontend HTML and JavaScript request construction.
+6. Create an executable public request audit script using stdlib only.
+7. Run the audit against production when available and document measured results.
+8. Write the full request matrix and prioritized follow-up tasks.
+
+## Files to Read First
+
+- `AGENTS.md`
+- `ai/architecture-index.md`
+- `ai/repo-context.md`
+- `ai/orchestrator/analyst.md`
+- `ai/orchestrator/backend-senior.md`
+- `ai/orchestrator/frontend-senior.md`
+- `backend/app/routes.py`
+- `backend/app/payloads.py`
+- `frontend/*.html`
+- `frontend/assets/js/*.js`
+
+## Expected Files to Modify
+
+- `ai/tasks/done/TASK-224-full-application-request-audit.md`
+- `docs/FULL_APPLICATION_REQUEST_AUDIT.md`
+- `scripts/audit_public_requests.py`
+- `tmp/public_request_audit.json`
+- `tmp/audit_prod_stdout.txt`
+- `tmp/audit_prod_stderr.txt`
+
+## Constraints
+
+- Do not run `ai-platform run`.
+- Do not commit.
+- Do not push.
+- Do not apply functional fixes.
+- Do not optimize production code except for audit tooling.
+- Do not touch weapon assets, clan assets, SVGs or physical images.
+- Do not modify `ai/system-metrics.md`.
+- Do not reactivate Elo/MMR.
+- Do not add unrelated prior changes.
+
+## Validation
+
+Executed:
+
+```powershell
+python -m compileall backend\app
+python -m py_compile scripts\audit_public_requests.py
+cd backend
+python -m unittest tests.test_rcon_materialization_pipeline
+```
+
+Results:
+
+- `python -m compileall backend\app`: passed.
+- `python -m py_compile scripts\audit_public_requests.py`: passed.
+- `python -m unittest tests.test_rcon_materialization_pipeline`: passed, 9 tests in 0.588s. Existing tests emitted `ResourceWarning` for unclosed SQLite connections but did not fail.
+
+Runtime audit:
+
+- Local backend health check against `http://127.0.0.1:8000/health`: unavailable from host, so local endpoint matrix was not launched.
+- Production audit against `https://comunidadhll.devzamode.es`: launched 191 probes and wrote `tmp/public_request_audit.json`.
+- Manual player-dependent probes launched after deriving `player_id=76561198092154180` from ranking data.
+
+Production automatic summary:
+
+- OK: 77
+- WARNING: 110
+- CRITICAL: 4
+- HTTP 200: 187
+- HTTP 500: 1
+- timeout/error without HTTP status: 3
+
+Manual player-dependent summary:
+
+- OK: 0
+- WARNING: 2
+- CRITICAL: 2
+
+Combined measured summary:
+
+- OK: 77
+- WARNING: 112
+- CRITICAL: 6
+
+## Outcome
+
+Created `docs/FULL_APPLICATION_REQUEST_AUDIT.md` with:
+
+- Executive summary.
+- Backend route inventory.
+- Frontend fetch inventory.
+- Full request matrix with public backend routes, frontend fetches, static assets and internal runners.
+- Endpoint severity tables.
+- Initialization-in-read detection.
+- Heavy fallback detection.
+- Frontend loading/error/timeout audit.
+- Top risks and prioritized recommendations.
+- Proposed follow-up tasks.
+- Exact commands to rerun the audit locally, in production and from the backend container.
+
+Created `scripts/audit_public_requests.py` with:
+
+- Configurable base URL and timeout.
+- Representative public GET probes.
+- HTTP status, elapsed time, response size and JSON metadata extraction.
+- Non-fatal endpoint failures.
+- JSON output to `tmp/public_request_audit.json` by default.
+- Static discovery for backend routes, frontend API literals, `fetch(` occurrences and localhost references.
+
+Key findings:
+
+1. `/api/stats/players/search` times out at 30s in production.
+2. `/api/stats/players/{player_id}` weekly/monthly times out at 30s in production.
+3. `/api/current-match/kills` times out or returns 500.
+4. `/api/current-match/players` times out for `comunidad-hispana-01`.
+5. `/api/servers` can spend 4.3s refreshing RCON live data during a public GET.
+6. `/api/historical/matches/detail` responded OK for the known real match in this audit, but still has a static initialization-in-read chain and needs later hardening.
+7. 13 frontend localhost/127.0.0.1 references remain in public HTML/JS, mitigated by `config.js` but still worth hardening.
+
+Next recommended fix:
+
+1. Fix `/api/stats/players/search` and `/api/stats/players/{player_id}` first by making the public read path strict read-only, without `initialize_*` or runtime fallback.
+2. Fix `/api/current-match/kills` and `/api/current-match/players` next.
+3. Harden `/api/historical/matches/detail` after those, unless new profiling shows it regressed again.
+
+## Change Budget
+
+Files changed by this task are audit/documentation/support files only. No product logic files were modified.