Digital signage

The ledger separates what the audit changed, what was kept on purpose, and what has not run in production yet.

1. Fixed in the templates

   • The refresh timer that never fires The player fetched the playlist through a callback that closed over the current slide index, and the interval effect listed that callback in its dependencies. Every slide change tore down the interval and started a new one.
   • A side effect inside a state updater Playlist reconciliation ran inside a setAds(prev => …) updater, and called setCurrentIndex from within it. React may invoke an updater more than once for the same base state; a nested state write then fires twice.
   • active meaning two different things Soft delete set active: false — the same field the admin form's Active toggle writes — and the list query filtered on neither. A deleted ad appeared in the library as merely paused, and toggling it back on resurrected it.
   • A list cap that silently truncated playlists Playlist resolution fetched "the 200 newest ads" and filtered them by membership. Once a venue's library passed 200 items, older ads disappeared from playback with no error, no warning, and nothing in the admin UI to suggest it.
   • An unordered query behind a fallback A device polling without a screen id got "the location's first display" from a query with no orderBy. Which screen that was could change between deploys.
   Show 5 moreShow fewer

   • Tenant scope unchecked on [id] routes Collection routes derived the location from the staff session, but the [id] routes did not re-check it — so any admin could read, edit, or permanently delete another venue's ads and screens by id. A scope helper existed in the codebase and was used on two other modules; signage simply missed it.
   • Storage objects orphaned forever A delete helper was written, exported, and never called. Every permanent delete and every file replacement left its object in storage — up to 10 MB each, billed indefinitely, with no way to tell which were still referenced.
   • Dangling playlist references Removing an ad left its id in every playlist that referenced it. The player dropped unresolvable ids silently, so loops quietly got shorter.
   • One token for every screen, handed out for a PIN A single deployment-wide token lived in an environment variable. The pairing endpoint returned it verbatim to anyone who guessed a 4–6 digit venue PIN, with no rate limiting, and it granted access to every venue's playlist. Revoking one screen meant rotating the variable and re-pairing all of them.
   • No validation Request bodies were cast (as AdInput) with no runtime checking, and a helper existed purely to strip undefined values the database would reject. A schema validator was already a project dependency, used elsewhere.