marcel
0 Followers · 0 Following
  • Joined on 2026-03-17
Repositories
3
 Projects Packages Public Activity Starred Repositories
marcel commented on pull request marcel/familienarchiv#622 2026-05-19 07:16:45 +02:00
perf(document): EAGER→LAZY migration with @EntityGraph + @BatchSize (#467)

🚀 Tobias Wendt — DevOps & Platform Engineer

Verdict: ✅ Approved

This is a pure application-layer change — no Compose file, no CI workflow, no infrastructure config was modified. My…

marcel commented on pull request marcel/familienarchiv#617 2026-05-19 07:16:43 +02:00
feat(security): CSRF protection, session revocation, login rate limiting (#524)

👨‍💻 Felix Brandt — Senior Fullstack Developer

Verdict: ⚠️ Approved with concerns

Solid feature work. The architecture is clean, TDD evidence is present throughout, and the naming is…

marcel commented on pull request marcel/familienarchiv#618 2026-05-19 07:16:33 +02:00
security(import): validate PDF magic bytes before S3 upload

🧪 Sara Holt (@saraholt) — Senior QA Engineer

Verdict: ⚠️ Approved with concerns

The test coverage for the magic-byte feature itself is solid. Four regression tests cover the essential…

marcel commented on pull request marcel/familienarchiv#622 2026-05-19 07:16:31 +02:00
perf(document): EAGER→LAZY migration with @EntityGraph + @BatchSize (#467)

🔒 Nora "NullX" Steiner — Application Security Engineer

Verdict: ✅ Approved

This PR touches the persistence layer, entity serialization, and transaction boundaries. From a security…

marcel commented on pull request marcel/familienarchiv#622 2026-05-19 07:16:15 +02:00
perf(document): EAGER→LAZY migration with @EntityGraph + @BatchSize (#467)

🧪 Sara Holt — QA Engineer & Test Strategist

Verdict: ⚠️ Approved with concerns

The test coverage for the targeted code paths is solid — query-count assertions in `DocumentRepositoryTes…

marcel commented on pull request marcel/familienarchiv#617 2026-05-19 07:16:12 +02:00
feat(security): CSRF protection, session revocation, login rate limiting (#524)

🔐 Nora "NullX" Steiner — Application Security Engineer

Verdict: ✅ Approved

This is a well-executed security hardening PR. All three vectors (CSRF, session revocation, rate limiting)…

marcel commented on pull request marcel/familienarchiv#618 2026-05-19 07:16:02 +02:00
security(import): validate PDF magic bytes before S3 upload

🏛️ Markus Keller (@mkeller) — Senior Application Architect

Verdict: ⚠️ Approved with concerns

The implementation is correct in its layering — validation happens in the service before…

marcel commented on pull request marcel/familienarchiv#622 2026-05-19 07:15:42 +02:00
perf(document): EAGER→LAZY migration with @EntityGraph + @BatchSize (#467)

🏛️ Markus Keller — Application Architect

Verdict: ⚠️ Approved with concerns

The fetch-strategy migration is architecturally sound. The two-tier strategy (entity graph + @BatchSize)…

marcel commented on pull request marcel/familienarchiv#618 2026-05-19 07:15:36 +02:00
security(import): validate PDF magic bytes before S3 upload

👨‍💻 Felix Brandt — Senior Fullstack Developer

Verdict: ⚠️ Approved with concerns

Clean implementation overall. The backend logic is well-structured, the test coverage is meaningful,…

marcel commented on pull request marcel/familienarchiv#622 2026-05-19 07:15:21 +02:00
perf(document): EAGER→LAZY migration with @EntityGraph + @BatchSize (#467)

👨‍💻 Felix Brandt — Senior Fullstack Developer

Verdict: ⚠️ Approved with concerns

Solid execution of a real performance problem. The two-tier strategy (entity graph + @BatchSize) is…

marcel commented on pull request marcel/familienarchiv#618 2026-05-19 07:15:06 +02:00
security(import): validate PDF magic bytes before S3 upload

🔐 Nora "NullX" Steiner — Application Security Engineer

Verdict: ⚠️ Approved with concerns

This PR directly addresses a real attack vector: an attacker crafting a disguised executable…

marcel commented on pull request marcel/familienarchiv#617 2026-05-18 22:34:13 +02:00
feat(security): CSRF protection, session revocation, login rate limiting (#524)

Review concerns addressed (round 2)

All open concerns from the second review cycle have been resolved. Here's what was done per reviewer, with commit references.

Felix Brandt —…

marcel pushed to feat/issue-524-csrf-session-rate-limit at marcel/familienarchiv 2026-05-18 22:33:41 +02:00
0514622f39 devops(deps): add bucket4j-core to Renovate package rules
24c85c29e4 test(login): add browser component test for rate-limited login UI state
Compare 2 commits »
marcel commented on pull request marcel/familienarchiv#617 2026-05-18 22:31:44 +02:00
feat(security): CSRF protection, session revocation, login rate limiting (#524)

All round-3 reviewer concerns have been addressed. Here's a summary:

marcel pushed to feat/issue-524-csrf-session-rate-limit at marcel/familienarchiv 2026-05-18 22:31:26 +02:00
778402fec7 test(auth): add integration-level CSRF rejection test; fix SessionRevocationPort wiring
6db5c2d1c4 test(user): add CSRF failure tests for changePassword and forceLogout endpoints
2f981ef69d refactor(test): use static imports for verify/assertThat in controller and rate-limiter tests
7074c9e4ad docs(architecture): update CSRF section and add CSRF_TOKEN_MISSING / TOO_MANY_LOGIN_ATTEMPTS error codes
8eced9c9da refactor(auth): replace @Autowired(required=false) with SessionRevocationPort + constructor injection
Compare 5 commits »
marcel commented on pull request marcel/familienarchiv#622 2026-05-18 22:27:20 +02:00
perf(document): EAGER→LAZY migration with @EntityGraph + @BatchSize (#467)

Round 2 review concerns addressed

Six commits pushed addressing every blocker and actionable suggestion from the second review cycle.

@Felix / @Sara — Blocker: `findById_loadsSenderR…

82e81e159a docs(backend): document @Transactional(readOnly=true) exception in CLAUDE.md
cabcf6a6ca docs(adr): add ADR-022 for EAGER→LAZY fetch strategy with @EntityGraph
befecc9864 refactor(document): extract factory helpers in DocumentLazyLoadingTest
57259e4195 test(document): add query-count assertion for findAll(Spec) non-paginated path
3356e27273 test(document): assert non-empty result in receiverSort lazy-loading test
Compare 6 commits »
marcel commented on pull request marcel/familienarchiv#618 2026-05-18 21:59:53 +02:00
security(import): validate PDF magic bytes before S3 upload

🎨 Leonie Voss — UI/UX Design Lead & Accessibility Strategist

Verdict: ⚠️ Approved with concerns

The choice of native <details>/<summary> is excellent — built-in keyboard support…

marcel commented on pull request marcel/familienarchiv#618 2026-05-18 21:59:34 +02:00
security(import): validate PDF magic bytes before S3 upload

🧪 Sara Holt — QA Engineer & Test Strategist

Verdict: ⚠️ Approved with concerns

Test coverage for the new feature is solid. I have one behavior-change concern that lacks a specific…

marcel commented on pull request marcel/familienarchiv#618 2026-05-18 21:59:17 +02:00
security(import): validate PDF magic bytes before S3 upload

🔐 Nora "NullX" Steiner — Application Security Engineer

Verdict: ⚠️ Approved with concerns

This PR directly addresses a file upload security concern (CWE-434: Unrestricted Upload of…