veza/veza-docs/audit/AUDIT_01_INVENTAIRE.md

AUDIT_01_INVENTAIRE.md -- Inventaire Complet du Code Existant

Date : 2026-03-11 Auditeur : Claude Opus 4.6 (audit automatise du code source)

---

1. VUE D'ENSEMBLE DU MONOREPO

Composant	Technologie	Fichiers source	Fichiers test	Migrations SQL
Backend API	Go 1.24 + Gin	867 .go	328 _test.go	134 .sql
Frontend Web	React + TypeScript + Vite	1,927 .ts/.tsx	~574 test+stories	-
Stream Server	Rust	131 .rs	~25 avec #[test]	-
Design System	TypeScript	1 (minimal)	-	-
Total		2,926 source	~927 test	134

Structure racine

veza/
+-- apps/web/                    # Frontend React + TypeScript + Vite
+-- packages/design-system/      # Design system SUMI (minimal)
+-- veza-backend-api/            # Go API (Gin, PostgreSQL, Redis, RabbitMQ)
+-- veza-stream-server/          # Rust stream server (audio HLS)
+-- veza-common/                 # Shared utilities (Rust + Go)
+-- veza-docs/ORIGIN/            # Specifications (READ-ONLY)
+-- docker/                      # Dockerfiles
+-- infra/                       # Infrastructure configs
+-- k8s/                         # Kubernetes manifests
+-- scripts/                     # Utility scripts
+-- tests/                       # E2E tests (Playwright)
+-- loadtests/                   # k6 load tests
+-- proto/                       # gRPC protobuf definitions
+-- .github/workflows/           # CI/CD pipelines (10 workflows)
+-- make/                        # Makefile includes
+-- config/                      # Shared configs

---

2. BACKEND API (Go)

2.1 Architecture

veza-backend-api/
+-- cmd/server/              # Entry point
+-- internal/
|   +-- api/                 # Route registration (30+ route files)
|   +-- core/                # Domain modules (auth, track, feed, discover, analytics, moderation, etc.)
|   +-- handlers/            # HTTP handlers (~100 handler files)
|   +-- middleware/           # Middlewares (~40 files)
|   +-- models/              # Data models (~40 files)
|   +-- services/            # Business logic (~130 service files)
|   +-- config/              # Configuration
|   +-- database/            # DB connection
|   +-- elasticsearch/       # Search service
|   +-- websocket/chat/      # WebSocket handlers
|   +-- testutils/           # Test utilities
+-- pkg/apierror/            # Standardized error package
+-- migrations/              # SQL migrations (134 files)
+-- tests/                   # Integration tests

2.2 Route Files (Endpoints)

Route File	Domain	Key Endpoints
routes_auth.go	Authentication	register, login, logout, refresh, verify-email, forgot-password, reset-password, 2FA
routes_users.go	Users	CRUD, profile, avatar, settings, sessions, privacy
routes_tracks.go	Tracks	CRUD, upload, stream, waveform, HLS, lyrics, stems
routes_playlists.go	Playlists	CRUD, collaboration, export, import, share
routes_social.go	Social	follow/unfollow, block, groups, reposts, likes
routes_feed.go	Feed	Chronological feed, suggestions
routes_search.go	Search	Fulltext, autocomplete, unified search
routes_discover.go	Discovery	Genre browse, tag browse, trending (ethical)
routes_tag.go	Tags	CRUD tags, genres
routes_marketplace.go	Marketplace	Products, orders, checkout, downloads, reviews, promo codes
routes_subscription.go	Subscriptions	Plans, upgrade, downgrade, cancel
routes_analytics.go	Analytics	Creator analytics, heatmap, comparison, audience
routes_moderation.go	Moderation	Reports, moderation queue, strikes, spam detection
routes_admin_platform.go	Admin	Platform metrics, user management, content, payments
routes_live.go	Livestream	Start/stop, RTMP callbacks, HLS live
routes_co_listening.go	Co-listening	WebSocket sessions, sync
routes_distribution.go	Distribution	Submit to platforms, track status, royalties
routes_education.go	Education	Courses, modules, lessons, certificates, video
routes_gear.go	Gear/Equipment	Inventory CRUD, warranty, documents
routes_cloud.go	Cloud storage	File sync, backup, sharing
routes_queue.go	Queue	Playback queue management
routes_developer.go	Developer API	API keys, rate limits
routes_webhooks.go	Webhooks	Payment webhooks (Hyperswitch)
routes_core.go	Core	Health, metrics, feature flags, config

2.3 Key Handlers (sample)

• Auth: auth.go, oauth_handlers.go, two_factor_handler.go, password_reset_handler.go
• User: profile_handler.go, avatar_handler.go, settings_handler.go, privacy_handler.go
• Track: track_crud_handler.go, track_upload_handler.go, track_hls_handler.go, track_social_handler.go, track_search_handler.go, track_waveform_handler.go, track_analytics_handler.go, track_stem_handler.go
• Chat: chat_handler.go, chat_websocket_handler.go, chat_reaction_handler.go, chat_search_handler.go, chat_attachment_handler.go
• Marketplace: marketplace_handler.go, sell_handler.go, payout_handler.go
• Analytics: creator_handler.go, advanced_handler.go, playback_analytics_handler.go
• Admin: admin/handler.go, admin_transfer_handler.go, announcement_handler.go
• Moderation: moderation/handler.go, report_handler.go
• Notifications: notification_handlers.go
• Live: live_stream_handler.go, live_stream_callback.go
• Education: education_handler.go, distribution_handler.go
• GDPR: gdpr_export_handler.go, account_deletion_handler.go
• Other: gear_handler.go, cloud_handler.go, co_listening_handler.go, queue_handler.go, social_group_handler.go, presence_handler.go

2.4 Services (130+ files)

Major services include:

• Core: jwt_service.go, user_service.go, session_service.go, password_service.go, email_service.go, email_verification_service.go, oauth_service.go, totp_service.go, rbac_service.go, permission_service.go
• Track: track_upload_service.go, track_validation_service.go, track_search_service.go, track_like_service.go, track_repost_service.go, track_share_service.go, track_stem_service.go, track_history_service.go, track_recommendation_service.go, track_export_service.go, track_version_service.go
• Audio: hls_service.go, hls_transcode_service.go, hls_streaming_service_enhanced.go, hls_playlist_generator.go, hls_cleanup_service.go, audio_transcode_service.go, bitrate_adaptation_service.go, bandwidth_detection_service.go, buffer_monitor_service.go, waveform_service.go, stream_service.go, video_transcode_service.go
• Playlist: playlist_service.go, playlist_analytics_service.go, playlist_follow_service.go, playlist_share_service.go, playlist_duplicate_service.go, playlist_version_service.go, playlist_recommendation_service.go, playlist_notification_service.go
• Chat: chat_service.go, chat_pubsub.go, co_listening_service.go
• Social: social_service.go, comment_service.go, comment_moderation_service.go
• Analytics: analytics_service.go, creator_analytics_service.go, advanced_analytics_service.go, analytics_aggregation_service.go, playback_analytics_service.go, playback_heatmap_service.go, playback_comparison_service.go, playback_export_service.go, playback_filter_service.go, playback_segmentation_service.go, playback_alerts_service.go, playback_retention_service.go
• Marketplace: core/marketplace/service.go, royalty_service.go, stripe_connect_service.go, track_download_license.go
• Distribution: core/distribution/service.go
• Education: core/education/service.go
• Subscription: core/subscription/service.go
• Moderation: moderation_service.go
• Notifications: notification_service.go, notification_service_enhanced.go, notification_digest_worker.go, push_service.go
• Storage: s3_storage_service.go, image_service.go, image_service_enhanced.go, cdn_service.go, cloud_service.go, cloud_backup.go, backup_service.go
• Infrastructure: cache_service.go, circuit_breaker.go, monitoring_alerting_service.go, job_service.go, webhook_service.go, feature_flag_service.go, crypto_service.go, token_blacklist.go, refresh_token_service.go
• GDPR: data_export_service.go, gdpr_export.go
• Payments: hyperswitch/client.go, hyperswitch/provider.go, hyperswitch/webhook.go
• Gear: gear_service.go, gear_document_service.go, gear_warranty_notifier.go

2.5 Middleware (40+ files)

• Security: auth.go, rbac_middleware.go, security_headers.go, csrf.go, cors.go, metrics_protection.go, stream_callback_auth.go, webhook_api_key.go
• Rate limiting: rate_limiter.go, ratelimit.go, ratelimit_redis.go, endpoint_limiter.go, user_rate_limiter.go
• Observability: request_logger.go, request_id.go, tracing.go, metrics.go, monitoring.go, audit.go
• Resilience: recovery.go, sentry_recover.go, timeout.go, error_handler.go, maintenance.go
• Other: cache_headers.go, response_cache.go, context_propagation.go, validation.go, versioning.go, playlist_permission.go, ccpa.go

2.6 Migrations SQL (134 files)

Range: 000_mark_consolidated.sql to 960_performance_indexes_v0124.sql

Key migration groups:

• 000-050: Core schema (auth, users, sessions, files, streaming, analytics, follows, notifications, search indexes)
• 051-095: Chat, stats, audit, jobs, groups, social, webhooks, gear, live streams, payments, API keys, playlists
• 096-134: Products, marketplace, seller balances, promo codes, chat reactions, mentions, search, threads, attachments, invitations, data exports, collaborative rooms, editorial playlists, quiet hours, notification grouping, digest prefs
• 900-960: Triggers, audit logs, performance indexes, foreign keys, deletion fields, reports, announcements, feature flags, OAuth, co-listening, stems, creator analytics, advanced analytics, moderation, marketplace, subscriptions, distribution, education, performance indexes v0.12.4

2.7 Dependencies (Go)

Key dependencies: gin-gonic/gin, golang-jwt/jwt/v5, lib/pq (PostgreSQL), redis/go-redis/v9, aws-sdk-go-v2 (S3/MinIO), rabbitmq/amqp091-go, prometheus/client_golang, getsentry/sentry-go, go-playground/validator/v10, pquerna/otp (TOTP), SherClockHolmes/webpush-go, coder/websocket, dhowden/tag (audio metadata), disintegration/imaging, go-pdf/fpdf, DATA-DOG/go-sqlmock, fsnotify/fsnotify

---

3. FRONTEND WEB (React + TypeScript)

3.1 Architecture

apps/web/
+-- src/
|   +-- app/                 # App entry point
|   +-- components/          # Shared UI components (30+ dirs)
|   +-- features/            # Feature modules (35 modules)
|   +-- hooks/               # Global custom hooks
|   +-- services/api/        # API client + interceptors
|   +-- stores/              # State management (Zustand)
|   +-- router/              # Route definitions
|   +-- schemas/             # Zod validation schemas
|   +-- types/               # TypeScript types + generated OpenAPI types
|   +-- locales/             # i18n translations
|   +-- mocks/               # MSW mocks
|   +-- providers/           # Context providers
|   +-- styles/              # Global styles
|   +-- stories/             # Storybook stories
|   +-- lib/                 # Utility libraries
|   +-- utils/               # Utility functions
|   +-- config/              # Frontend config
|   +-- context/             # React contexts (audio-context)
|   +-- test/                # Test setup

3.2 Feature Modules (35)

Module	Description	Has Pages	Has Tests
admin	Admin dashboard, moderation, platform	Yes	-
analytics	Creator analytics views	Yes	Yes
auth	Login, register, sessions, 2FA, OAuth	Yes	Yes
chat	Chat rooms, DMs, reactions, search	Yes	Yes
checkout	Cart, checkout flow	Yes	-
cloud	Cloud storage management	Yes	-
dashboard	User dashboard	Yes	-
developer	API key management	Yes	-
discover	Genre/tag browsing	Yes	-
distribution	Platform distribution	Yes	-
education	Course catalog, learning	Yes	-
error	Error pages (404, 500)	Yes	-
feed	Chronological feed	Yes	-
inventory	Gear/equipment management	Yes	-
library	Track library, playlists	Yes	-
live	Livestream viewer/broadcaster	Yes	-
marketplace	Product listing, buying	Yes	-
notifications	Notification center, preferences	Yes	-
player	Audio player, queue	Yes	Yes
playlists	Playlist management, collaboration	Yes	Yes
presence	Online status, rich presence	-	-
profile	User profile view/edit	Yes	-
purchases	Purchase history	Yes	-
roles	Role management	Yes	-
search	Fulltext search	Yes	-
seller	Seller dashboard	Yes	-
sessions	Active sessions management	-	-
settings	User settings (account, security, data, etc.)	Yes	-
social	Follow, groups	Yes	-
streaming	Audio streaming hooks/services	-	-
subscription	Plan management	Yes	-
tracks	Track detail, upload	Yes	Yes
upload	File upload	-	-
user	User components	-	-

3.3 Shared Components

• UI primitives: accordion, avatar-upload, content-transition, context-menu, data-list, date-picker, dialog, dropdown-menu, feature-highlight, file-upload, hover-card, lazy-component, optimized-image, select, tabs, tooltip, virtualized-list
• Domain: admin, analytics, auth, base, charts, commerce, dashboard, data, demo, developer, feedback, filters, forms, inventory, keyboard, layout, library, live, marketplace, modals, monitoring, navigation, notifications, player, pwa, search, seller, settings, share, social, theme, upload, user

3.4 State Management

• Zustand stores in src/stores/
• Feature-specific stores in features/auth/store/, features/chat/store/, features/player/store/

3.5 Testing

• Unit tests: Vitest
• E2E tests: Playwright (multiple configs: standard, mocks, visual regression)
• Visual regression: Playwright visual comparison
• MSW for API mocking
• 574 test + stories files

---

4. STREAM SERVER (Rust)

4.1 Architecture

veza-stream-server/
+-- src/
|   +-- main.rs
|   +-- lib.rs
|   +-- config/
|   +-- handlers/
|   +-- services/
|   +-- models/
|   +-- middleware/
|   +-- routes/
|   +-- audio/           # Audio processing (HLS, transcoding)
|   +-- storage/          # S3 integration
|   +-- monitoring/       # Metrics, health
+-- Cargo.toml

• 131 Rust source files
• 25 files with #[test] blocks
• Handles: audio streaming, HLS segment serving, transcoding, S3 storage integration, metrics

---

5. INFRASTRUCTURE & DEVOPS

5.1 Docker

• docker-compose.yml (production)
• docker-compose.dev.yml (development: Postgres, Redis, RabbitMQ, ClamAV, MinIO)
• docker-compose.staging.yml
• docker-compose.prod.yml
• docker-compose.test.yml
• Dockerfiles in docker/

5.2 CI/CD (GitHub Actions - 10 workflows)

Workflow	Description
ci.yml	Main CI pipeline
backend-ci.yml	Go tests, lint, build
frontend-ci.yml	TypeScript checks, Vitest, ESLint
rust-ci.yml	Cargo test, clippy, fmt
stream-ci.yml	Stream server CI
cd.yml	Continuous deployment
security-scan.yml	Security scanning
sast.yml	Static analysis
container-scan.yml	Container vulnerability scan
load-test-nightly.yml	Nightly k6 load tests
storybook-audit.yml	Storybook validation

5.3 Kubernetes

• Manifests in k8s/ directory

5.4 Makefile

• Comprehensive Makefile with make/ includes (build.mk, tools.mk, etc.)
• Key targets: dev, build, test, lint, doctor, infra-up-dev, migrate-up, etc.

5.5 Load Tests

• k6 load test scripts in loadtests/

5.6 Monitoring

• Prometheus metrics via Go middleware
• Sentry error tracking integration

---

6. DOCUMENTATION

6.1 ORIGIN Specs (24 files)

Complete specification suite in veza-docs/ORIGIN/:

• Architecture, features registry, API spec, security framework, business logic, UI/UX system
• Code standards, testing strategy, performance targets, error patterns, error prevention guide
• Quality metrics, feature validation, deployment guide, development phases
• Database schema, technical stack, implementation tasks, revision summary

6.2 Existing Audit Reports

• 103_audit_global_features_states.md
• 103_RAPPORT_ETAT_FEATURES_2026_02_16.md
• AUDIT_TECHNIQUE_2026-02-22.md
• AUDIT_TECHNIQUE_VEZA_2026-03-04.md
• ORIGIN_GAP_ANALYSIS_2026-03-04.md
• PENTEST_REPORT_VEZA_v0.12.6.md
• REMEDIATION_MATRIX_v0.12.6.md
• ASVS_CHECKLIST_v0.12.6.md

6.3 Other docs

• docs/adr/ - Architecture Decision Records
• docs/ENV_VARIABLES.md
• docs/SECRETS_AUDIT.md
• CHANGELOG.md, CONTRIBUTING.md, README.md
• VEZA_VERSIONS_ROADMAP.md - Version tracking (source of truth)

---

7. CODE HEALTH INDICATORS

Metric	Value	Notes
TODO/FIXME in backend+rust	2	Very clean
TODO/FIXME in frontend	43	Acceptable
Banned code traces (AI/ML/Web3/Gamification)	0	Clean
Go test files	328 (38% of Go files)	Good coverage
Frontend test+stories files	574 (30% of TS/TSX files)	Acceptable
SQL migrations	134	Comprehensive schema
CI workflows	10	Including security scans
Middleware files	40+	Very comprehensive

---

Fin de l'inventaire Phase 1