backend/controllers/release.controller.js (2)

2-2: 🛠️ Refactor suggestion | 🟠 Major

Unused import: Developer model.

The Developer model is imported but never used. If email notifications are being removed (Option B above), this import should also be removed along with the emailQueue import on line 3.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@backend/controllers/release.controller.js` at line 2, Remove the unused
Developer import (require("../models/Developer")) and the related emailQueue
import (the require on line 3) from release.controller.js since email
notifications were removed; update any leftover references to Developer or
emailQueue in functions like the release creation/notification handlers if
present, and run lint/tests to ensure no unused-vars remain.

---

39-47: ⚠️ Potential issue | 🔴 Critical

Critical: developers is undefined — this will crash at runtime.

The variable developers is referenced but never defined in this function. Based on the AI summary and the relevant code snippets, the code that fetched verified developers from the database was removed, but the email queuing logic that depends on it remains.

This will throw ReferenceError: developers is not defined when an admin attempts to create a release.

Either restore the developer fetch or remove the email queuing logic entirely:

Option A: Restore developer fetch (if email notifications are intended)

         return res.status(400).json({ error: "Missing version, title, or content" });
         }
 
+        const developers = await Developer.find({ isVerified: true });
+
         const newRelease = new Release({ 
             version, 
             title, 

Option B: Remove email queuing (if notifications are no longer needed)

         await newRelease.save();
 
-        const emails = developers.map(dev => dev.email);
-        await Promise.all(emails.map(email => 
-            emailQueue.add('release-email', {
-                email,
-                version,
-                title,
-                content
-            })
-        ));
-
-        res.status(201).json({ 
-            message: "Release published! Emails queued.", 
-            count: emails.length 
-        });
+        res.status(201).json({ 
+            message: "Release published!", 
+            release: newRelease 
+        });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@backend/controllers/release.controller.js` around lines 39 - 47, The code
references developers when building emails for queuing (const emails =
developers.map(...)) but developers is not defined; either restore the DB fetch
that populates developers (e.g., reintroduce the query that finds verified
developers/users and assigns to developers before mapping) or remove the
email-queuing block entirely; locate the email queuing logic in the release
creation handler (the section using const emails = developers.map(...) and
emailQueue.add('release-email', ...)) and either (A) add back the developer
lookup (ensure it retrieves verified developers and handles empty
results/errors) before mapping, or (B) delete the mapping and emailQueue.add
calls so the release flow no longer depends on a nonexistent developers
variable.

backend/middleware/verifyApiKey.js (1)

59-84: ⚠️ Potential issue | 🟡 Minor

Normalize allowedDomains before the wildcard short-circuit.

Line 62 checks allowedDomains.includes('*') on raw values, but Line 73-Line 76 normalize entries later. With denormalized stored values, wildcard behavior can diverge from match behavior.

Proposed patch

-        if (!isSecret) {
-            let allowedDomains = project.allowedDomains || ['*'];
+        if (!isSecret) {
+            const normalizeDomain = (d) => String(d).trim().replace(/\/+$/, '');
+            let allowedDomains = (project.allowedDomains || ['*'])
+                .map(normalizeDomain)
+                .filter(Boolean);
             const origin = req.headers.origin || req.headers.referer;

             if (!allowedDomains.includes('*')) {
                 if (!origin) {
                     return res.status(403).json({ error: "Forbidden: Origin header missing and this key is restricted to specific domains." });
                 }

                 try {
                     const parsedOrigin = new URL(origin);
                     const originUrl = parsedOrigin.origin; 
                     const originHostname = parsedOrigin.hostname;

                     const isAllowed = allowedDomains.some(domain => {
-                        let cleanDomain = domain.trim();
-                        if (cleanDomain.endsWith('/')) {
-                            cleanDomain = cleanDomain.slice(0, -1);
-                        }
+                        const cleanDomain = domain;

                         if (cleanDomain.startsWith('*.')) {
                             const baseDomain = cleanDomain.substring(2);
                             return originHostname === baseDomain || originHostname.endsWith('.' + baseDomain);
                         }

                         return originUrl === cleanDomain || originHostname === cleanDomain;
                     });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@backend/middleware/verifyApiKey.js` around lines 59 - 84, Normalize the
allowedDomains array before the wildcard short-circuit: transform
project.allowedDomains into a cleaned array (trim entries and remove trailing
slashes) assigned to allowedDomains, then check allowedDomains.includes('*') and
proceed; keep the existing matching logic that uses allowedDomains.some(...)
(referencing allowedDomains, origin, parsedOrigin, originUrl, originHostname,
and the isAllowed calculation) so wildcard checks and later per-entry matching
behave consistently for denormalized stored values.