# Full Codebase Audit Report
**Date:** 2026-03-24
**Project:** geode-client-rust v0.1.1-alpha.20
**Commit:** 59eb304 (main, after 2nd gap closure)
**Platform:** GitLab
**Languages:** Rust
**Scope:** Entire repository
---
## Domain Results
### Gap Analysis
| Implemented | ~85% of documented API | 85% |
| Partial / Stub | 3 | 10% |
| Not Implemented | 2 | 5% |
**Open gaps:** 8 findings
| GAP-0001 | HIGH | `savepoint()` and `rollback_to()` missing from Connection | client.rs (Savepoint struct exists, no methods dispatch it) | Not Implemented |
| GAP-0002 | MEDIUM | `grpcs://` scheme documented but not implemented | dsn.rs:150-164 only handles `quic://` and `grpc://` | Not Implemented |
| GAP-0003 | MEDIUM | `explain()` and `profile()` return hardcoded empty results | client.rs:1889-1951 (stubs) | Partial |
| GAP-0004 | LOW | `batch()` executes queries sequentially, not batched | client.rs:1990-2005 | Partial (misleading docs) |
| GAP-0005 | MEDIUM | `from_dsn()` ignores `connect_timeout` parameter | client.rs:458 hardcodes 10s | Not Implemented |
| GAP-0006 | MEDIUM | `from_dsn()` ignores mTLS fields (ca_cert, client_cert, client_key, server_name) | dsn.rs:69-72 parsed but client.rs:443-462 never reads them | Not Implemented |
| GAP-0007 | LOW | `tls_enabled` field stored but unused for QUIC transport | client.rs:339 (QUIC always uses TLS by protocol) | Partial |
| GAP-0008 | LOW | PULL `page_size` hardcoded to 1000, not wired to Connection field | client.rs:1478 | Partial |
### Code Quality
| Critical | 0 |
| High | 2 |
| Medium | 6 |
| Low | 5 |
**Top findings:**
| 1 | HIGH | client.rs is 2666 lines — needs decomposition | src/client.rs |
| 2 | HIGH | Duplicated `convert_proto_value` logic between grpc.rs:213 and client.rs:1198 | src/grpc.rs, src/client.rs |
| 3 | MEDIUM | types.rs is 1560 lines — decode_value is a massive match | src/types.rs |
| 4 | MEDIUM | Duplicated `read_proto_quic` / `try_read_proto_quic` (identical frame parsing) | src/client.rs:1106, 1142 |
| 5 | MEDIUM | 6 `#[allow(dead_code)]` annotations for reserved/stub fields | client.rs, types.rs |
| 6 | MEDIUM | `redact_dsn` marked `#[allow(dead_code)]` — only used in tests | client.rs:31 |
| 7 | MEDIUM | dsn.rs:168 `parse_url` and dsn.rs:306 `apply_params` both over 50 lines | src/dsn.rs |
| 8 | LOW | `page_size` field on Connection annotated dead_code, never wired | client.rs:790 |
| 9 | LOW | Hardcoded page_size=1000 in PULL requests | client.rs:1478 |
| 10 | LOW | `session_id.clone()` on every gRPC request | src/grpc.rs:131 |
| 11 | LOW | proto.rs and grpc.rs lack `#[cfg(test)]` modules | src/proto.rs, src/grpc.rs |
| 12 | LOW | `decimal_scale` and `time_value` on Value are dead fields | types.rs:56,62 |
| 13 | INFO | All 367 lib tests pass, 28 proptest, 27 doc tests, 0 clippy warnings, formatting clean | |
### Performance
| P0 | 0 |
| P1 | 2 |
| P2 | 4 |
| P3 | 4 |
**Top findings:**
| 1 | P1 | **Bloated Value struct** — 13 fields all initialized even for Null/Int/Bool, ~4 empty heap allocs per Value | types.rs:50-66 | 5000 unnecessary allocs per 1000-row page |
| 2 | P1 | **HashMap per row without capacity** — no `with_capacity` for known column count | client.rs:1183 | 10,000 HashMap allocs grow dynamically |
| 3 | P2 | **Column name cloned per cell** — `col.name.clone()` for every cell in every row | client.rs:1190 | 50,000 String allocs for 10K rows x 5 cols |
| 4 | P2 | **`type_name.to_uppercase()` per decode_value call** — allocates String per cell | types.rs:516 | 50,000 String allocs; use `eq_ignore_ascii_case()` instead |
| 5 | P2 | **Repeated string literals in proto conversion** — "id", "labels", "properties" freshly allocated per node/edge | client.rs:1229-1263 | Could use `&'static str` |
| 6 | P2 | **All result rows buffered into single Vec** — no streaming/iterator API | client.rs:1450-1519 | 1M row limit prevents OOM but large allocation |
| 7 | P3 | **Decimal-to-f64 via string roundtrip** — `f64::from_str(&d.to_string())` instead of `to_f64()` | types.rs:360-365 | Extra alloc per Decimal conversion |
| 8 | P3 | **`session_id.to_string()` on every query** | client.rs:1290,1313 | One String alloc per query |
| 9 | P3 | **`tokio = "full"` pulls unnecessary features** — only needs rt, net, time, io-util, macros, sync | Cargo.toml:18 | Increased compile time and binary size |
| 10 | P3 | **No `[profile.release]` optimizations** — missing lto, codegen-units=1 | Cargo.toml | Suboptimal release binaries |
### Security
| Critical | 0 |
| High | 2 |
| Medium | 2 |
| Low | 1 |
| Info | 2 |
**Immediate actions needed:** Dependency updates (7 known vulns in Cargo.lock)
| 1 | HIGH | CWE-400 | **HELLO response frame size not bounded** — `connect_quic_once` reads length prefix and allocates without checking MAX_PROTO_FRAME_BYTES; malicious server can trigger ~4GB allocation | client.rs:1052-1053 | 7/10 |
| 2 | HIGH | CWE-1104 | **7 known dependency vulnerabilities** — aws-lc-sys 0.37.0 (4 CVEs, CVSS up to 7.5), quinn-proto 0.11.13 (CVSS 8.7 DoS), rustls-webpki 0.103.9 | Cargo.lock | 8/10 |
| 3 | MEDIUM | CWE-532 | **Dsn struct derives Debug with plaintext password** — if debug-printed, password exposed in logs | dsn.rs:56-62 | 5/10 |
| 4 | MEDIUM | CWE-400 | **try_read_proto_quic frame limit bypass during initial handshake** — same pattern as #1 in connect path | client.rs:1044-1056 | 5/10 |
| 5 | LOW | CWE-693 | **No `#![forbid(unsafe_code)]` crate attribute** — no unsafe exists today but not enforced | src/lib.rs | 2/10 |
| 6 | INFO | — | 3 suppressed advisories in .cargo/audit.toml are documented and reasonable | .cargo/audit.toml | — |
| 7 | INFO | — | .gitleaks.toml well-configured, no secrets detected | .gitleaks.toml | — |
---
## Cross-Domain Summary
| Gap Analysis | 14 | 0 | 1 | 8 | 5 | 0 |
| Quality | 22 | 0 | 5 | 10 | 7 | 0 |
| Performance | 21 | 1 | 7 | 8 | 5 | 0 |
| Security | 12 | 0 | 3 | 4 | 3 | 2 |
| **Total** | **69** | **1** | **16** | **30** | **20** | **2** |
*Includes initial scan + deep analysis findings. Performance uses P0-P3 scale.*
---
## Top 10 Findings (cross-domain, by severity/impact)
| 1 | Security | 7 dependency vulns (quinn-proto DoS CVSS 8.7, aws-lc-sys CVSS 7.5) | HIGH | Cargo.lock |
| 2 | Security | HELLO response frame size unbounded — OOM via malicious server | HIGH | client.rs:1052-1053 |
| 3 | Gap | `savepoint()`/`rollback_to()` documented but not implemented | HIGH | README.md vs client.rs |
| 4 | Quality | client.rs is 2666 lines — needs decomposition into transport modules | HIGH | src/client.rs |
| 5 | Quality | Duplicated `convert_proto_value` between grpc.rs and client.rs | HIGH | grpc.rs:213, client.rs:1198 |
| 6 | Gap | `from_dsn()` ignores mTLS, connect_timeout, grpcs:// | MEDIUM | dsn.rs, client.rs |
| 7 | Security | Dsn struct Debug exposes plaintext password | MEDIUM | dsn.rs:56-62 |
| 8 | Perf | Bloated Value struct — 4 empty heap allocs per Null/Int/Bool | P1 | types.rs:50-66 |
| 9 | Perf | HashMap per row without capacity + column name cloned per cell | P1/P2 | client.rs:1183-1190 |
| 10 | Perf | `type_name.to_uppercase()` allocates per cell — use case-insensitive compare | P2 | types.rs:516 |
---
## Docs Updated
| docs/AUDIT_REPORT.md | All | Created (this file) |
---
## Gap Closure Results
### Closed in this session (3 commits)
| `0cf8ff5` | 4 | Frame size limits, JSON depth, row/page limits, Error::Limit |
| `5a4b4a6` | 6 | HELLO frame check, proto depth limit, Dsn Debug redaction, query/param validation, DSN timeout wiring, forbid(unsafe_code) |
| `e9e2f69` | 7 | Dependency CVE updates (aws-lc-sys, quinn-proto, rustls-webpki) |
**Total closed: 26 findings** (19 code fixes + 7 dependency updates)
### Round 2 closures (commit 59eb304)
| A1: HELLO params ignored | Wired client_name, client_version, conformance, hello_timeout to server |
| A2: try_read_proto_quic 5s timeout | Reduced to 500ms |
| A8: Pool transaction leak | Added in_transaction tracking + rollback-on-drop |
| A9: Dockerfile rust:1.83 | Updated to rust:1.85 |
| A11: No #[inline] annotations | Added to 14 Value functions + is_retryable |
| A16: DSN insecure_skip_verify alias | Added to match arms |
| Perf: No with_capacity | Added Vec/HashMap preallocation in row parsing |
| Perf: tokio "full" | Narrowed to selective features |
| Perf: No [profile.release] | Added lto="thin", codegen-units=1 |
### Round 3 closures (commits 0f3706b, 2422d20, 1d5e4e6, fde6845)
| type_name.to_uppercase() per cell | Replaced with eq_ignore_ascii_case (100K allocs eliminated) |
| grpcs:// scheme missing | Added to DSN parser with TLS forced on |
| savepoint()/rollback_to() missing | Implemented for QUIC transport; gRPC stubs until RPC defined |
| client.rs proto duplication | Extracted shared convert.rs module (175 lines removed, 13 tests added) |
### Remaining (require dedicated PRs)
| Value struct ~250 bytes | Perf/P1 | Breaking public API (pub kind field); needs migration PR |
| QueryBuilder type mismatch | Quality | Breaking API change |
| README examples wrong signatures | Gap | Docs-only |
| gRPC connection pool support | Gap | Architecture change |
| Decimal precision loss in to_proto_value | Quality | Requires proto schema analysis |
| AuthClient empty stub | Gap | Requires server protocol support |
| client.rs still 2600+ lines | Quality | Further decomposition possible |
## Blockers
- GitLab API was not available for direct issue creation (no token configured)
- Integration tests require running Geode server (not tested in this audit)
---
## Additional Findings from Deep Analysis
### Critical New Findings (not in initial scan)
| A1 | Quality | **HELLO handshake ignores configured parameters** — `client_name`, `client_version`, `conformance`, `hello_timeout` are accepted by builder but prefixed with `_` and never sent to server | HIGH | client.rs:887-889, 1026-1032 |
| A2 | Quality | **`try_read_proto_quic` blocks for 5s despite "non-blocking" name** — DDL queries that return schema without data page stall for 5s | MEDIUM | client.rs:1145 |
| A3 | Quality | **QueryBuilder returns `serde_json::Value` params but `query_with_params` expects `Value`** — type mismatch requires manual conversion | HIGH | query_builder.rs:75 vs client.rs:1420 |
| A4 | Quality | **README query examples don't compile** — show `conn.query("...", Some(params))` but actual API is `conn.query(gql)` (single arg) | HIGH | README.md:113 vs client.rs:1377 |
| A5 | Security | **`validate::query()` and `validate::param_name()` are dead code** — never called in query execution path | MEDIUM | client.rs:1377, 1543 |
| A6 | Security | **gRPC `new_grpc` re-serializes password into cleartext String** — defeats SecretString zeroize guarantee | MEDIUM | client.rs:858-864 |
| A7 | Security | **`convert_proto_value_static` has unbounded recursion** — no depth limit like JSON path has | MEDIUM | client.rs:1198-1278 |
| A8 | Security | **Pooled connections returned without transaction rollback** — open transaction leaks to next acquirer | MEDIUM | pool.rs:127-141 |
| A9 | Quality | **Dockerfile uses rust:1.83 but edition 2024 requires 1.85+** — Docker build will fail | HIGH | Dockerfile:4 |
| A10 | Perf | **Value struct is ~240 bytes** — enum-based design would be ~72 bytes (3x reduction) | P0 | types.rs:50-66 |
| A11 | Perf | **No `#[inline]` on any library functions** — cross-crate calls never inlined | P1 | all src/ files |
| A12 | Perf | **Benchmarks never run in CI** — `--no-run` only, no regression detection | P1 | .gitlab-ci.yml:153 |
| A13 | Gap | **AuthClient is empty stub** — README claims "Complete authentication with RBAC and RLS" | MEDIUM | auth.rs:56-63 |
| A14 | Gap | **gRPC `is_healthy()` always returns true** — pool health check bypassed for gRPC | MEDIUM | client.rs:2117-2121 |
| A15 | Gap | **ConnectionPool has no gRPC/DSN support** — hardcodes QUIC transport | MEDIUM | pool.rs:24-36 |
| A16 | Quality | **DSN `insecure_skip_verify` alias documented but not matched** — DSN match arm uses `insecure_tls_skip_verify` | MEDIUM | dsn.rs:113,312 |
| A17 | Quality | **Decimal precision loss in `to_proto_value`** — converts through f64, losing precision for exact decimals | MEDIUM | types.rs:359-372 |
| A18 | Gap | **GitLab issues #1-#16 still OPEN** despite GAP_ANALYSIS marking all as CLOSED | MEDIUM | GAP_ANALYSIS.md vs GitLab |
---
## Recommended Priority Actions
### Immediate (before next release)
1. **Update dependencies** — `cargo update` to pull quinn-proto >=0.11.14, aws-lc-sys >=0.39.0, rustls-webpki >=0.103.10
2. **Fix HELLO frame size check** — add `MAX_PROTO_FRAME_BYTES` guard at client.rs:1052
3. **Fix Dsn Debug** — implement manual Debug that redacts password field
4. **Wire HELLO parameters** — remove `_` prefixes from hello_name/ver/conformance/timeout and send to server
5. **Fix Dockerfile** — update from rust:1.83 to rust:1.85+ for edition 2024 compatibility
### Short-term (next sprint)
6. **Implement savepoint()/rollback_to()** — proto messages already defined
7. **Wire DSN fields to Client** — connect_timeout, mTLS certs, grpcs:// scheme
8. **Refactor client.rs** — extract QUIC transport and gRPC transport into separate modules
9. **Deduplicate convert_proto_value** — single implementation shared by both transports
10. **Wire validate::query() and validate::param_name()** into query execution path
11. **Fix QueryBuilder type mismatch** — return `HashMap<String, Value>` instead of `serde_json::Value`
12. **Fix README examples** — update to match actual API signatures
13. **Add proto recursion depth limit** to `convert_proto_value_static`
14. **Add transaction rollback-on-drop** for pooled connections
### Medium-term (backlog)
15. **Optimize Value struct** — enum-based storage (~240 bytes -> ~72 bytes, 3x reduction)
16. **Add HashMap::with_capacity** for row parsing and use `Arc<str>` for column names
17. **Replace `type_name.to_uppercase()` with precomputed type dispatch enum**
18. **Add `#[inline]` to small public accessor functions** (library crate requirement)
19. **Add `#![forbid(unsafe_code)]` to lib.rs**
20. **Add `[profile.release]` with lto/codegen-units to Cargo.toml**
21. **Narrow tokio features from "full" to specific needed features**
22. **Run benchmarks in CI with regression detection**
23. **Add ConnectionPool::from_dsn() for gRPC support**
24. **Close stale GitLab issues #1-#16** that have already been remediated in code