# Sellio QA Review — 2026-06-07

Post–use-statement refactor pass. Manual review against `_development/QA-reviewer.md` checklist.

## Executive summary

- **Overall readiness:** **Needs work** (High security addressed; marketplace docs improving)
- **Critical:** 0 | **High:** 0 | **Medium:** 1 | **Low:** 4
- **Automated tests:** PHPUnit **259/259**; Playwright admin **48/48** — see `TEST_PASS_2026-06-07.md`

---

## Section scores (1–15)

| # | Area | Status | Notes |
|---|------|--------|-------|
| 1 | Namespace / imports | **Pass** | Executable FQCN refactor merged; docblocks still use FQCN (acceptable) |
| 2 | Controllers | **Partial** | Service layer used well; some controllers still heavy (bookings, checkout) |
| 3 | Models | **Partial** | Modern casts/accessors; `@property` docblocks incomplete on some models |
| 4 | Routes | **Pass** | Organized admin/web/api; install redirect logic in `public/index.php` |
| 5 | Requests / validation | **Partial** | Form Requests widely used; spot-check vertical-specific rules ongoing |
| 6 | Services / helpers | **Partial** | `helpers.php` is large but namespaced functions; `setting()` uses cache (improved) |
| 7 | Security | **Partial** | XSS on blog/product/page content fixed; demo creds documented; API throttles in place |
| 8 | Blade / frontend | **Partial** | CMS/page builder sanitized; dynamic CMS view added |
| 9 | Database / seeders | **Pass** | Migrations indexed; seeders idempotent patterns; demo data documented in seeder output |
| 10 | Packages | **Pass** | `composer audit` + NPM audit clean; see package/demo image audit docs |
| 11 | Installer / deploy | **Pass** | Lock + redirect; `display_errors` gated by lock + `INSTALLER_DEBUG`; README + finished step document removal |
| 12 | API quality | **Partial** | Rate limiters in place; `whenLoaded()` sweep on top public/partner resources |
| 13 | Performance | **Partial** | Dashboard caching exists; listing eager loads expanded for API resources |
| 14 | Code standards | **Pass** | No `dd()`/`dump()` in `app/`; imports normalized in recent commit |
| 15 | Marketplace readiness | **Partial** | README demo creds + root `CHANGELOG.md` added |

---

## Findings

### [High] Unescaped rich HTML in blog detail view

- **Status:** **Fixed** (2026-06-07) — `sanitize_rich_html()` helper; Blog model mutator; Blade output hardened.

---

### [High] Unescaped product description

- **Status:** **Fixed** (2026-06-07) — Product `description` mutator + Blade uses `sanitize_rich_html()`.

---

### [High] Demo credentials in seeders (marketplace expectation)

- **Status:** **Fixed** (2026-06-07) — `README.md` §4–§5; installer `finished.php` lists partner/buyer demo accounts and password rotation warning.

---

### [High] `/public/install` remains accessible until manually removed

- **Status:** **Mitigated** (2026-06-07) — Runtime block via `installed.lock`; README post-install checklist + expanded installer security panel.

---

### [Medium] Admin page builder stores/renders raw HTML

- **Status:** **Fixed** (2026-06-07) — Page builder routes gated to `super-admin`; `Page` html/css mutators use `sanitize_rich_html()` / `sanitize_page_builder_css()`; storefront `frontend/pages/dynamic.blade.php` sanitizes on output.

---

### [Medium] `{!! page_content() !!}` outputs admin-editable HTML

- **Status:** **Fixed** (2026-06-07) — `PageContent` value mutator uses `sanitize_rich_html()` (inline tags for text/textarea; extended tags for `editor`). Trust model noted in README §5.

---

### [Medium] Installer enables `display_errors`

- **Status:** **Fixed** (2026-06-07) — `configure_installer_error_reporting()` disables browser error output when `installed.lock` exists; active install output gated by `INSTALLER_DEBUG` (auto `false` on remote, `true` on local). Unit tests in `InstallerErrorReportingTest`.

---

### [Medium] API rate limiting is sparse

- **Status:** **Fixed** (2026-06-07) — Named limiters `api`, `api-auth`, `api-write` in `AppServiceProvider`; global `throttle:api` on API middleware; targeted limits on auth, cart, orders, tickets, and profile writes.

---

### [Medium] API resources — N+1 exposure (carried forward)

- **Status:** **Mitigated** (2026-06-07) — Removed lazy-load fallbacks in `PropertyResource` / `AutoResource`; hardened booking/inquiry/ticket message resources with `whenLoaded()`; expanded eager loads on public listing services and partner booking controllers. Residual: nested `favoritable` polymorphic loads still depend on caller.

---

### [Medium] `{!! $menuitem->title !!}` in footer

- **Status:** **Fixed** (2026-06-07) — Social footer uses `{{ __($menuitem->title) }}`; `MenuItem` title mutator strips markup on save.

---

### [Medium] README missing explicit demo credential block

- **Status:** **Fixed** (2026-06-07) — See `apps/backend/README.md` §4–§5.

---

### [Low] Docblock FQCN still used widely

- **File:** Many controllers/services
- **Why it matters:** Not a rejection issue; slightly hurts IDE consistency after import refactor.
- **Recommendation:** Optional pass to shorten `@param` types to imported short names.

---

### [Low] Inline `{!! nl2br(e($text)) !!}` pattern

- **Files:** Event/service/auto detail partials
- **Why it matters:** Safe pattern (escaped then nl2br) — **good**. Keep as standard for plain-text descriptions.

---

### [Low] No project CHANGELOG at repo root

- **Status:** **Fixed** (2026-06-07) — Root `CHANGELOG.md` with semver and `[Unreleased]` / `1.0.0` sections.

---

### [Low] `LOG_LEVEL=debug` in `.env.example`

- **File:** `apps/backend/.env.example`
- **Line:** 18
- **Why it matters:** Fine for example; ensure comments say set `info` or `error` in production.

---

### [Low] Namespace import blocks — resolved

- **File:** 120 files in commit `e9d5e84`
- **Why it matters:** Was a PSR-12 / readability issue for reviewers.
- **Status:** **Resolved** in latest commit.

---

## Resolved since last review

| Item | Status |
|------|--------|
| Inline FQCN in executable PHP | Fixed — commit `e9d5e84` |
| Blog/product stored XSS | Fixed — `sanitize_rich_html()` |
| Page content CMS XSS | Fixed — `PageContent` mutator + README trust note |
| Footer menu title escaping | Fixed — Blade + `MenuItem` title sanitizer |
| Root CHANGELOG | Fixed — `/CHANGELOG.md` |
| Package/license audit | Fixed — `PACKAGE_AUDIT_2026-06-07.md`; composer deps bumped |
| API resource N+1 hardening | Mitigated — `whenLoaded()` sweep + eager loads |
| Page builder XSS / access | Fixed — super-admin gate + sanitizers |
| Demo credentials documentation | Fixed — README §4 + installer finished step |
| Demo image / NPM asset audit | Fixed — Unsplash removed from `apps/`; audit docs + lockfile bumps |
| PHPUnit + Playwright admin pass | Fixed — 259/259 PHPUnit; 48/48 admin browser — `TEST_PASS_2026-06-07.md` |
| API rate limiting | Fixed — `api` / `api-auth` / `api-write` limiters |
| Split / duplicate `use` blocks in changed files | Normalized |
| `catch (\Exception)` inconsistency in touched files | Aligned with `use Exception` |
| Route import conflict in `routes/admin.php` | Fixed — Admin vertical controller imports restored |
| `CheckRenewals` unused imports | Cleaned |

---

## Manual verification still needed

- [ ] Fresh install on clean server (installer + `installed.lock` flow)
- [ ] Browser pass: admin + storefront critical paths
- [ ] Payment webhooks (Stripe/PayPal) in sandbox
- [x] `composer audit` / license scan — see `PACKAGE_AUDIT_2026-06-07.md`
- [x] Demo image provenance + `npm audit` — see `DEMO_IMAGE_AUDIT_2026-06-07.md`, `NPM_AUDIT_2026-06-07.md`
- [ ] Storefront theme QA (see `THEME_QA_AUDIT_REPORT.md`)
- [x] PHPUnit full suite — 259/259 pass (`TEST_PASS_2026-06-07.md`)
- [x] Admin Playwright — 48/48 pass (installer uses separate config)

---

## Next review focus

When re-running QA reviewer, prioritize:

1. Storefront theme QA (`THEME_QA_AUDIT_REPORT.md`)
2. Fresh install + payment webhook sandbox verification