Chore/update docker pulls metrics

[evil0119]

No description provided.

[cubic-dev-ai]

11 issues found across 282 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="docs/API/端點.md">

<violation number="1" location="docs/API/端點.md:33">
P2: REST docs repeat the `/api/v1` prefix in both Base URL and endpoint paths, leading to inconsistent URL construction (double `/api/v1`).</violation>
</file>

<file name="docs/Docker組合配置/README.md">

<violation number="1" location="docs/Docker組合配置/README.md:94">
P2: OCR built-in language list (7 items) conflicts with the stated default count (8), creating a documentation inconsistency.</violation>
</file>

<file name="docs/配置設定/環境變數.md">

<violation number="1" location="docs/配置設定/環境變數.md:42">
P2: Inconsistent default value for PDFMATHTRANSLATE_MODELS_PATH between quick reference and detailed section.</violation>
</file>

<file name="api-server/src/config.rs">

<violation number="1" location="api-server/src/config.rs:33">
P1: Hardcoded fallback JWT secret allows the server to run with a predictable signing key when JWT_SECRET is unset, enabling token forgery if configuration is missed.</violation>
</file>

<file name="Dockerfile.full">

<violation number="1" location="Dockerfile.full:29">
P2: Base image uses the mutable `latest` tag, which breaks reproducible builds and increases supply-chain risk. Pin to a specific version or digest.</violation>
</file>

<file name="api-server/src/auth.rs">

<violation number="1" location="api-server/src/auth.rs:142">
P1: Avoid falling back to a hardcoded JWT secret. If JWT_SECRET is missing, authentication becomes predictable and tokens can be forged with the default key. Fail fast with an internal error instead.</violation>
</file>

<file name="docs/功能說明/OCR.md">

<violation number="1" location="docs/功能說明/OCR.md:166">
P3: Inconsistent built-in OCR language count in the same doc (7 vs 8) can mislead users; align the count or clarify auto-detection mode separately.</violation>
</file>

<file name="api-server/Dockerfile">

<violation number="1" location="api-server/Dockerfile:97">
P2: Healthcheck uses curl but the runtime image never installs curl, so the container healthcheck will always fail (`curl: not found`).</violation>
</file>

<file name="docs/功能說明/多語言介面.md">

<violation number="1" location="docs/功能說明/多語言介面.md:116">
P2: The Southeast Asia section header says 7 languages, but the table lists 8, creating a documentation inconsistency.</violation>

<violation number="2" location="docs/功能說明/多語言介面.md:146">
P2: Section count claims 3 languages but lists 4, causing documentation inconsistency.</violation>
</file>

<file name=".github/UPSTREAM_SYNC.md">

<violation number="1" location=".github/UPSTREAM_SYNC.md:170">
P2: Smoke test docs curl localhost without publishing container port, so host curl will not reach the container.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Hardcoded fallback JWT secret allows the server to run with a predictable signing key when JWT_SECRET is unset, enabling token forgery if configuration is missed.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At api-server/src/config.rs, line 33:

<comment>Hardcoded fallback JWT secret allows the server to run with a predictable signing key when JWT_SECRET is unset, enabling token forgery if configuration is missed.</comment>

<file context>
@@ -0,0 +1,75 @@
+            port: env::var("API_PORT")
+                .unwrap_or_else(|_| "3001".to_string())
+                .parse()?,
+            jwt_secret: env::var("JWT_SECRET")
+                .unwrap_or_else(|_| "your-super-secret-jwt-key-change-in-production".to_string()),
+            upload_dir: env::var("UPLOAD_DIR")
</file context>

[cubic-dev-ai]

P1: Avoid falling back to a hardcoded JWT secret. If JWT_SECRET is missing, authentication becomes predictable and tokens can be forged with the default key. Fail fast with an internal error instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At api-server/src/auth.rs, line 142:

<comment>Avoid falling back to a hardcoded JWT secret. If JWT_SECRET is missing, authentication becomes predictable and tokens can be forged with the default key. Fail fast with an internal error instead.</comment>

<file context>
@@ -0,0 +1,287 @@
+
+    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
+        // Get the JWT secret from environment or use default
+        let jwt_secret = std::env::var("JWT_SECRET")
+            .unwrap_or_else(|_| "your-super-secret-jwt-key-change-in-production".to_string());
+
</file context>

Suggested change

	let jwt_secret = std::env::var("JWT_SECRET")
	.unwrap_or_else(|_| "your-super-secret-jwt-key-change-in-production".to_string());
	let jwt_secret = std::env::var("JWT_SECRET")
	.map_err(|_| AuthError(ApiError::InternalError("JWT_SECRET must be set".into())))?;

[cubic-dev-ai]

P2: REST docs repeat the /api/v1 prefix in both Base URL and endpoint paths, leading to inconsistent URL construction (double /api/v1).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/API/端點.md, line 33:

<comment>REST docs repeat the `/api/v1` prefix in both Base URL and endpoint paths, leading to inconsistent URL construction (double `/api/v1`).</comment>

<file context>
@@ -0,0 +1,261 @@
+
+### 引擎管理
+
+#### `GET /api/v1/engines`
+
+列出所有可用的轉換引擎。
</file context>

[cubic-dev-ai]

P2: OCR built-in language list (7 items) conflicts with the stated default count (8), creating a documentation inconsistency.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/Docker組合配置/README.md, line 94:

<comment>OCR built-in language list (7 items) conflicts with the stated default count (8), creating a documentation inconsistency.</comment>

<file context>
@@ -0,0 +1,94 @@
+
+> 💡 內建 OCR 語言：英文、繁體中文、簡體中文、日文、韓文、德文、法文
+>
+> 翻譯引擎支援 15 種語言，但 OCR 預設只內建 8 種
</file context>

[cubic-dev-ai]

P2: Inconsistent default value for PDFMATHTRANSLATE_MODELS_PATH between quick reference and detailed section.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/配置設定/環境變數.md, line 42:

<comment>Inconsistent default value for PDFMATHTRANSLATE_MODELS_PATH between quick reference and detailed section.</comment>

<file context>
@@ -0,0 +1,299 @@
+| 變數                           | 說明     | 預設值    |
+| ------------------------------ | -------- | --------- |
+| `PDFMATHTRANSLATE_SERVICE`     | 翻譯服務 | `google`  |
+| `PDFMATHTRANSLATE_MODELS_PATH` | 模型路徑 | `/models` |
+
+---
</file context>

[cubic-dev-ai]

P2: Healthcheck uses curl but the runtime image never installs curl, so the container healthcheck will always fail (curl: not found).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At api-server/Dockerfile, line 97:

<comment>Healthcheck uses curl but the runtime image never installs curl, so the container healthcheck will always fail (`curl: not found`).</comment>

<file context>
@@ -0,0 +1,101 @@
+EXPOSE 3001/tcp
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD curl -f http://localhost:3001/health || exit 1
+
</file context>

[cubic-dev-ai]

P2: Section count claims 3 languages but lists 4, causing documentation inconsistency.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/功能說明/多語言介面.md, line 146:

<comment>Section count claims 3 languages but lists 4, causing documentation inconsistency.</comment>

<file context>
@@ -0,0 +1,186 @@
+| `sq` | 阿爾巴尼亞 | Shqip    |
+| `el` | 希臘文     | Ελληνικά |
+
+### 非洲語言（3 種）
+
+| 代碼 | 語言       | 原生名稱  |
</file context>

Suggested change

	### 非洲語言（3 種）
	### 非洲語言（4 種）

[cubic-dev-ai]

P2: The Southeast Asia section header says 7 languages, but the table lists 8, creating a documentation inconsistency.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/功能說明/多語言介面.md, line 116:

<comment>The Southeast Asia section header says 7 languages, but the table lists 8, creating a documentation inconsistency.</comment>

<file context>
@@ -0,0 +1,186 @@
+| `ne` | 尼泊爾文   | नेपाली   |
+| `si` | 僧伽羅文   | සිංහල    |
+
+### 東南亞語言（7 種）
+
+| 代碼  | 語言     | 原生名稱         |
</file context>

Suggested change

	### 東南亞語言（7 種）
	### 東南亞語言（8 種）

[cubic-dev-ai]

P2: Smoke test docs curl localhost without publishing container port, so host curl will not reach the container.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/UPSTREAM_SYNC.md, line 170:

<comment>Smoke test docs curl localhost without publishing container port, so host curl will not reach the container.</comment>

<file context>
@@ -0,0 +1,280 @@
+
+```bash
+# 啟動 container 並等待 healthcheck 回應
+docker run -d --name convertx-test $IMAGE
+curl http://localhost:3000/healthcheck
+```
</file context>

Suggested change

	docker run -d --name convertx-test $IMAGE
	docker run -d --name convertx-test -p 3000:3000 $IMAGE