[Review] Daily Deep Review — 2026-05-27: PostGIS feature merged, map editor live, CI mostly green

[evan-zhang11]

Repository Status (2026-05-27)

Last commit: 2026-05-25 (828e69b) — Merge PR #260 (PostGIS modal click fix)
Repo activity: ✅ Active — 20+ commits since 2026-05-19

Recent Changes Summary

Major features merged since last review (2026-05-11):

• PostGIS integration: Auto-discovery API, cascade selection UI, connection/test/browse/import flow
• Map editor: CRUD, symbolization wizard, OL rendering, classification wizard, color ramps
• New files: map_handlers.rs (435 lines), LayerStylePanel.jsx (1644 lines), MapEditor.jsx (701 lines), styleJsonToOl.js (713 lines)

CI Status

• Mostly green on main! 🎉 (Previously fully broken since April)
• Core checks passing: fmt, clippy, tests, postgis integration, frontend unit, e2e
• ❌ binaries (windows) — build failure (needs investigation)
• ❌ docker_smoke — build failure (may be related)

Open PRs: 2 (unchanged)

• feat: 从服务器导入文件（引用模式） #173: feat: file import (still has merge conflicts)
• chore(deps): bump tower-sessions from 0.14.0 to 0.15.0 #65: chore(deps): tower-sessions 0.15.0

New Issues Found

1. 🟡 Frontend: LayerStylePanel.jsx at 1644 lines

A single component handling 1644 lines of style configuration logic. Should be split into smaller sub-components (e.g., fill editor, stroke editor, label editor, classification panel).

2. 🟡 Frontend: App.jsx grew to 2186 lines (was 2111)

Continuing to grow with map editor integration. Issue #230 already tracks this.

3. 🟡 Backend: db.rs at 1798 lines (was 1763)

Still growing. Issue #244 already tracks this.

4. 🟢 Security: PostGIS passwords encrypted at rest ✅

AES-256-GCM encryption with app_secret. Proper implementation.

5. 🟢 Security: SQL injection via quote_ident() ✅

All dynamic SQL uses quote_ident() for identifier escaping with proper tests.

6. 🟡 PostGIS: NoTls hardcoded, ssl_mode always "disable"

Validated in MVP but should support SSL modes (require, verify-ca, verify-full) before production. Currently rejects anything other than "disable".

7. 🟡 CI: Windows build failing

binaries (windows-latest) and docker_smoke both failing. Blocks release artifacts for Windows users.

8. 🔴 DefaultBodyLimit::disable() still active

Tracked in #219 — all endpoints have no request body size limit.

Duplicate Documentation Issues

Issues #249, #251, #256, #258 all report missing behaviors.md documentation with significant overlap. These should be consolidated into a single tracking issue.

Recommendations

1. Fix Windows build — likely a dependency or toolchain issue
2. Split LayerStylePanel.jsx — before it becomes unmaintainable
3. Consolidate duplicate docs issues (Documentation gaps: 4 undocumented API endpoints #249, docs: behaviors.md missing icon management API and other endpoints #251, docs: behaviors.md missing icon API, tile zoom, font delete, and workspace endpoints #256, docs: behaviors.md missing icon API, tile zoom update, and other undocumented endpoints #258 → one issue)
4. Plan SSL support for PostGIS connections before production