simple-instant-stream/TODO.md

TODO

Audit findings from ponytail-audit (ranked biggest cut first). Net: ~-300 lines, -5 deps possible.

Deletions

• Delete Dockerfile.aarch64 — merge into Dockerfile with ARG TARGETARCH (buildx sets it); both files are 90% identical except the dep-copy block. [Dockerfile.aarch64]
• Delete entity dead methods: update_username, update_password, change_stream_key_limit, find_by_user_id, get_stream_session, get_all_active_sessions. Zero callers; scaffolding for the unbuilt admin panel. [crates/entity/src/users.rs:77, crates/entity/src/auth_session.rs:43, crates/entity/src/stream_session.rs:53]
• Delete /api/health, /api/uptime, /api/version + HealthResponse/UptimeResponse — all subsets of /api/stats; also kills serde_json (only used by version_handler). [crates/server/src/http.rs:497]
• Delete SessionCookie extractor — its value is only debug-logged, never used; kill the extractor + 2 logs. [crates/server/src/http.rs:213]
• Delete WebrtcProxy::local_addr() (no callers), dead let _ = x_port ^ … stmt, and single-field WebRtcProxyConfig struct → pass u16 (also fixes i32 port type). [crates/server/src/webrtc_proxy.rs:167, crates/server/src/webrtc_proxy.rs:139]
• Delete webrtc.rs mid binding from add_media + _hint_mid param — passed straight into an underscore. [crates/server/src/webrtc.rs:142]
• Delete stream_key is_active/is_unlisted columns — never read anywhere; create() hardcodes is_active=false and is_unlisted is always passed false. Drop param + column (migration, expand-contract). [crates/entity/src/stream_key.rs:45]
• Delete rtmp.rs redundant stream_id var (warn can use current_stream_key_id), warn!("") empty-log on parse error, and parse_video_codec's Result<_, Box<dyn Error>> → Option. [crates/server/src/rtmp.rs:206, crates/server/src/rtmp.rs:369]
• Delete catalog_handler's get_all_active_sessions query — result only feeds a debug!; kills the entity method too. [crates/server/src/http.rs:185]
• Delete commented-out routes/code (admin/server_stats, duplicate whip route, .max_age, fs::File) + #[axum::debug_handler]. [crates/server/src/http.rs:109]
• Delete StreamSession.active_clients — written 0, never read; drops AtomicU32 import. [crates/server/src/main.rs:65]
• Delete webrtc_ingest _connected flag — set true, never read. [crates/server/src/webrtc_ingest.rs:363]
• Delete users.rs let user = …; user pointless binding in find_by_username. [crates/entity/src/users.rs:70]
• Delete meow_handler + route — joke endpoint, zero consumers. [crates/server/src/http.rs:492]
• Delete index.html prevStats — assigned, never read. [index.html:57]
• Delete deps — server: futures, rand; entity: rand, argon2 (hashing lives in server crate now); serde_json (with health/uptime/version cut). [crates/server/Cargo.toml, crates/entity/Cargo.toml]

Shrinks

• Extract shared "remove session + finish_stream_session" fn — closure duplicated 3× (rtmp.rs cleanup, webrtc_ingest detach cleanup, whip DELETE handler). Also lets handle_whip_injest drop its manual err() closure for Result<HttpError> like its siblings. [crates/server/src/rtmp.rs:141, crates/server/src/webrtc_ingest.rs:338, crates/server/src/webrtc_ingest.rs:34]
• Extract fixup_answer_sdp() — whip_sdp_probe.rs re-encodes the SDP string-fixups verbatim; probe drops ~30 lines. [crates/server/tests/whip_sdp_probe.rs:66]
• Derive thiserror on AudioParseError instead of hand-rolled Display+Error impls (~15 lines). [crates/server/src/audio.rs:66]
• Collapse webrtc.rs four near-identical channel re-subscribe blocks (is_none/is_closed × video/audio) → one helper. [crates/server/src/webrtc.rs:336]

Out of scope (correctness — route to normal review)

• Local::now() vs Utc::now() inconsistency in session creation
• KEY_RE {1,67} vs MAX_LABEL_LEN = 64 mismatch
• index.html hardcoded port 5000
• /api/stream/{slug} unauthenticated