fix: remaining 2026-07-15 audit items (GIN tag search, XFF hardening, code-blob over-fetch, CoC)

CODE_OF_CONDUCT.md

@@ -0,0 +1,130 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances
+  of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement by opening an
+issue on this repository or via the contact options listed on
+[anyplot.ai](https://anyplot.ai). All complaints will be reviewed and
+investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+<https://www.contributor-covenant.org/version/2/1/code_of_conduct.html>.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+<https://www.contributor-covenant.org/faq>. Translations are available at
+<https://www.contributor-covenant.org/translations>.
+
+[homepage]: https://www.contributor-covenant.org
+[Mozilla CoC]: https://github.com/mozilla/inclusion

api/mcp/server.py

@@ -90,17 +90,18 @@ async def list_specs(limit: int = 100, offset: int = 0) -> list[dict[str, Any]]:
     session = await get_mcp_db_session()
     try:
         repo = SpecRepository(session)
-        # `impl.code is not None` below requires the code column on every impl
-        # of every spec in the page — use the eager-loaded variant.
-        specs = await repo.get_all_with_code()
+        specs = await repo.get_all()
+        # `code` is deferred (multi-MB across the catalog); library_count only
+        # needs code *presence*, so probe the non-NULL ids instead of loading blobs.
+        ids_with_code = await ImplRepository(session).get_ids_with_code()
 
         # Apply pagination
         paginated_specs = specs[offset : offset + limit]
 
         # Convert to SpecListItem format
         result = []
         for spec in paginated_specs:
-            impl_count = len([impl for impl in spec.impls if impl.code is not None])
+            impl_count = len([impl for impl in spec.impls if impl.id in ids_with_code])
             item = SpecListItem(
                 id=spec.id, title=spec.title, description=spec.description, tags=spec.tags, library_count=impl_count
             )
@@ -179,10 +180,10 @@ async def search_specs_by_tags(
         # Flatten filter values into a single tag list for repository search
         tag_values: list[str] = [tag for tags in filters.values() for tag in tags]
 
-        # Search by spec-level tags. The fallback path (no tag filter) still
-        # iterates spec.impls below and reads impl.code, so use the
-        # eager-loaded variant — `search_by_tags` already undefers code.
-        specs = await repo.search_by_tags(tag_values) if tag_values else await repo.get_all_with_code()
+        # Search by spec-level tags. `code` stays deferred on both paths —
+        # the loops below only need code *presence*, probed via non-NULL ids.
+        specs = await repo.search_by_tags(tag_values) if tag_values else await repo.get_all()
+        ids_with_code = await ImplRepository(session).get_ids_with_code()
 
         # Apply impl-level filtering if needed
         if library or dependencies or techniques or patterns or dataprep or styling:
@@ -191,7 +192,7 @@ async def search_specs_by_tags(
                 # Check if spec has implementations matching impl-level filters
                 matching_impls = []
                 for impl in spec.impls:
-                    if impl.code is None:
+                    if impl.id not in ids_with_code:
                         continue
 
                     # Filter by library
@@ -228,7 +229,7 @@ async def search_specs_by_tags(
         # Convert to SpecListItem format
         result = []
         for spec in specs:
-            impl_count = len([impl for impl in spec.impls if impl.code is not None])
+            impl_count = len([impl for impl in spec.impls if impl.id in ids_with_code])
             item = SpecListItem(
                 id=spec.id, title=spec.title, description=spec.description, tags=spec.tags, library_count=impl_count
             )

api/routers/feedback.py

@@ -38,11 +38,31 @@
 
 
 def _client_ip(request: Request) -> str:
-    """Resolve the client IP, preferring x-forwarded-for (Cloud Run + CF)."""
+    """Resolve the client IP for rate-limit / dup-suppression keying.
+
+    Trust order (client → Cloudflare → Cloud Run):
+    1. `cf-connecting-ip` — Cloudflare overwrites any client-supplied value on
+       proxied traffic, so browsers on anyplot.ai cannot spoof it.
+    2. Rightmost non-empty `x-forwarded-for` entry — appended by the trusted
+       infrastructure hop. The *leftmost* entry (used here previously) is
+       client-controlled: spoofing it evaded the rate limit and allowed
+       poisoning another user's bucket to lock them out. Empty entries from
+       malformed headers ("1.2.3.4, ") are skipped so a caller can't force
+       everyone into one shared empty-string bucket.
+    3. `request.client.host` as the last resort.
+
+    A caller bypassing Cloudflare via the run.app URL can still forge
+    `cf-connecting-ip`, but that only scatters its *own* submissions across
+    buckets — no better than rotating source IPs, and it can no longer
+    impersonate a victim's bucket.
+    """
+    cf_ip = request.headers.get("cf-connecting-ip", "").strip()
+    if cf_ip:
+        return cf_ip
     forwarded = request.headers.get("x-forwarded-for", "")
-    if forwarded:
-        # x-forwarded-for can be a comma-separated chain; the first entry is the original client.
-        return forwarded.split(",")[0].strip()
+    for entry in reversed(forwarded.split(",")):
+        if entry.strip():
+            return entry.strip()
     return request.client.host if request.client else ""
 
 

api/routers/libraries.py

@@ -8,7 +8,7 @@
 from api.exceptions import raise_not_found
 from core.config import settings
 from core.constants import LIBRARIES_METADATA, SUPPORTED_LIBRARIES
-from core.database import LibraryRepository, SpecRepository
+from core.database import ImplRepository, LibraryRepository
 from core.database.connection import get_db_context
 from core.utils import strip_noqa_comments
 
@@ -97,23 +97,23 @@ async def get_library_images(library_id: str, db: AsyncSession = Depends(require
     if cached:
         return cached
 
-    repo = SpecRepository(db)
-    specs = await repo.get_all_with_code()
-
-    images = []
-    for spec in specs:
-        for impl in spec.impls:
-            if impl.library_id == library_id and impl.preview_url:
-                images.append(
-                    {
-                        "spec_id": spec.id,
-                        "library": impl.library_id,
-                        "language": impl.language_id,
-                        "url": impl.preview_url,
-                        "html": impl.preview_html,
-                        "code": strip_noqa_comments(impl.code),
-                    }
-                )
+    # Single-library query with code undeferred — fetching all specs with
+    # code loaded every other library's blobs just to filter them out here.
+    repo = ImplRepository(db)
+    impls = await repo.get_by_library_with_code(library_id)
+
+    images = [
+        {
+            "spec_id": impl.spec_id,
+            "library": impl.library_id,
+            "language": impl.language_id,
+            "url": impl.preview_url,
+            "html": impl.preview_html,
+            "code": strip_noqa_comments(impl.code),
+        }
+        for impl in impls
+        if impl.preview_url
+    ]
 
     result = {"library": library_id, "images": images}
     set_cache(key, result)