What's pending across every project
8 open · sorted by priority then due-date
Filtered by tag core-service clear
todo
urgent
Lock down core service: require auth, especially /db/execStoredProc, /deletefile, /uploadfile, /purgeStageData, /insertdb
crypto538-core-service is deployed --allow-unauthenticated. Options: make it private (IAM invoker = web-service SA + Scheduler SA) and have the webapp go through web-service only; or add an API-key/OIDC check on admin/write routes. Ties to the item about the webapp calling core directly.
crypto538-core-service/main.go:486-532crypto538-core-service/cloudbuild.yaml
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The core service needs no authentication, including /db/execStoredProc, /insertdb, /uploadfile, /deletefile.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
blocker
urgent
Lock down core-service /db/execStoredProc: public, no auth, runs any schema.function as postgres
The crypto538-core-service-production endpoint is reachable by anyone: Cloud Run ingress is "all" and allUsers has run.invoker. The handler (stored_proc.go handleExecStoredProc) has no authentication and no allowlist. It accepts any "schema.function" name plus arguments and runs it on the shared Cloud SQL instance as postgres, which is also used by AdaptiveSAT, Vajra and CitrineOS. That includes the dynamic-DDL routines (table_creation_package, tb_*_generator, sp_initialdata_generator). Not exploited or tested. Suggested fix: allowlist the procs actually used plus a shared-secret or IAM check, or remove the route if unused. Validate callers first, per the cleanup rule.
crypto538-core-service/stored_proc.go:135crypto538-core-service/main.go:494
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
6d ago
10-20 12:44
10-20 12:44
todo
high
Replace log.Fatalf in core-service request paths and goroutines with returned errors
insertDataIntoDB and other handlers call log.Fatalf on upstream/DB errors, which kills the whole Cloud Run instance (CODE_REVIEW #7, #17). Return errors and let the handler respond 500.
crypto538-core-service/main.go::insertDataIntoDBcrypto538-core-service/CODE_REVIEW.md
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The core service calls log.Fatalf inside request paths, which kills the whole process on any upstream error.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
high
PR "Coin Roster": make cryptomaster the only coin list; onboard any coin with dbo.onboard_coin()
8 steps, one PR per layer: DB onboarding function; DB collection; DB readers; core-service roster cache; ml-core-service; webapp; ml-training Batch task count; end-to-end proof with a new coin. Full instructions: cointrends/plans/PR-coin-roster.md (also in the project docs as claude/PR-coin-roster.md). Open questions: ship before or after Locked Door (#129); how DDL gets executed; which repo holds DB migrations.
plans/PR-coin-roster.md#129#118
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
💬 2 comments
6d ago
10-20 12:53
10-20 12:53
todo
high
Re-enable stopped feeds: news, Fear & Greed, gainers/losers, trade recommendations
fetchCryptoNews, insertFearAndGreedHandler commented out in core insertDataIntoDB; recommendations stopped 2025-03; gainers 2025-10-13. Uncomment / re-schedule, refresh provider keys (via Secret Manager). Brings Market Insights back to life. Gap-fill #1.
crypto538-core-service/main.go
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
💬 1 comment
5d ago
10-22 02:44
10-22 02:44
todo
Work through open CODE_REVIEW.md issues in core-service (timeouts, goroutines, bounds checks, double Close, T-SQL @ID)
April 2026 review lists 20 open issues. Highlights: no HTTP client timeouts (#6), unbounded goroutines in fetchCryptoNews (#8), Choices[0] with no bounds check (#3), double db.Close() in UpdateCryptoNewsExtractByURL (#4), T-SQL @ID syntax in IsNewsExtractNull fails on Postgres (#5), no MaxBytesReader (#11), rows.Err() unchecked (#12).
crypto538-core-service/CODE_REVIEW.md
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The April code review's 20 issues are still open (timeouts, goroutines, Choices[0], double Close, T-SQL @ID).
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Use one shared DB connection pool in core-service instead of a new pool per call
getDbConnection() → connectWithConnector() builds a new sql.DB (and Cloud SQL dialer) on nearly every call, with defer db.Close(). Create one pool at startup and reuse it; set pool limits once.
crypto538-core-service/main.go:570-650
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: A new connection pool is created on almost every call, instead of one shared pool.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
low
Remove deprecated Razorpay code from core-service (marked in PR #70)
Delete razorpay_webhook.go, razorpay_webhook_test.go and the /webhooks/razorpay route; also the dead /users and /payments handlers. Zero traffic in 30 days of Cloud Run logs. Deprecation comments merged 2026-10-16 (c3ef045).
↗ HopewellPartners/crypto538-core-service#70crypto538-core-service/razorpay_webhook.gocrypto538-core-service/main.go:490
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: Razorpay we dont use it - just add comments above the code blocks and do not delete. we will do it later.
claude: Deprecation notes merged in PR #70; removal tracked as a later cleanup.
10d ago
10-16 19:10
10-16 19:10