TREK - Moses Yebei

The Problem

Travel planning tools are either fragmented SaaS services or static check‑lists that cannot be edited collaboratively in real time. Teams that need on‑premise control—travel agencies, corporate travel desks, or privacy‑concerned families—must stitch together separate maps, budgets, and itinerary editors, each with its own data store and auth layer.

What This Does

The TREK repo delivers a self‑hosted, full‑stack travel planner. It bundles four independent projects:

shared – 1 117 files (i18n types, helpers, UI primitives) that are imported across client and server.
client – a React + Vite SPA (client/src/App.tsx) with Tailwind UI, offline‑first PWA support, and end‑to‑end tests under client/e2e/.
server – an Express‑style NestJS API (server/src/nest/app.module.ts) handling auth, DB access, and real‑time sync.
plugin‑sdk – a small extensibility surface (plugin-sdk/src/index.ts) for third‑party plugins.

Together they provide drag‑and‑drop day planning, interactive maps, budgets, packing lists, a journal, and an AI‑powered assistant, all behind SSO and stored in a PostgreSQL container.

How It Is Wired

Execution starts when Docker Compose launches the client and server containers defined in docker‑compose.yml.

Browser → client – client/index.html loads the Vite bundle; the root React component in client/src/App.tsx mounts the router and i18n (client/src/i18n/index.ts).
Client → server – API calls go to Nest’s HTTP layer (server/src/nest/app.module.ts). This module imports 45 other Nest modules (high instability 0.96) and wires controllers, services, and guards such as jwt-auth.guard.ts (used by 32 modules).
Server → shared – Core types like shared/src/i18n/types.ts are imported by 707 modules, making it the largest hub; any change propagates widely.
Server → DB – server/src/db/database.ts creates the TypeORM connection and is referenced by 44 modules (part of a circular import with airportService.ts).
Real‑time sync – WebSocket gateways in server/src/nest broadcast updates that the React UI consumes via hooks in client/src/components.

The import graph contains 1 500 internal modules and only two circular dependencies, but the hub modules (shared/src/i18n/types.ts, server/src/db/database.ts) carry the biggest blast radius for refactoring.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/TREK
cd TREK

# Build and start all services
docker compose up --build -d

The Dockerfile builds the Node runtime (node:24-alpine) for both client and server.
Environment variables required by Nest (e.g., DATABASE_URL) are read at container start; they are documented in server/README.md (not shown here).
After containers are healthy, open http://localhost:3000 to reach the SPA.
Run the test suite locally with npm test inside client/ or server/; CI currently does not invoke these tests (see health issues).

Real‑World Use

A corporate travel desk can deploy TREK behind its VPN, connect the API to an internal PostgreSQL, and enable SSO via Azure AD. Employees create itineraries in the React UI; the server persists each day plan, broadcasts changes over WebSocket, and the UI updates instantly for all participants. Plugins added through plugin-sdk can inject custom cost‑center validation without touching core code.

Code Health & Issues

HIGH – Pin GitHub Action versions to commit SHAs (.github/workflows/*).
HIGH – CI never runs the test suite; add a npm test step.
HIGH – continue-on-error in lint-prettier.yml masks failures.
HIGH – Docker workflow pushes directly to main; switch to PR‑based deployment.
HIGH – plugin-sdk/src/index.ts uses eval on runtime data.
MEDIUM – No Dependabot/Renovate config.
MEDIUM – Base images in Dockerfile are unpinned; use digests.
MEDIUM – No dependency‑vulnerability scan in CI.
MEDIUM – Large binaries (admin1.geojson.gz, DayItineraryRemovePlaceByButton.gif) should be stored via LFS or external storage.
MEDIUM – Checkout step keeps credentials; set persist-credentials: false.
MEDIUM – Empty catch {} blocks in server/src/db/database.ts and server/src/demo/demo-reset.ts.
MEDIUM – Import cycles involving server/src/db/database.ts and server/src/services/airportService.ts.
MEDIUM – Duplicated i18n help blocks across 44 language files.
MEDIUM – High branching density in several helper modules; consider refactoring.
MEDIUM – Deep nesting (depth 7) in client/src/components/OAuth/ScopeGroupPicker.tsx.

All findings are derived from static analysis; no additional issues were observed.

The Bottom Line

TREK offers a complete, on‑premise travel‑planning stack with modern React UI and NestJS backend, ready for container deployment. The codebase is sizable but well‑structured; however, hub modules and a few architectural smells (import cycles, duplicated i18n) make large‑scale changes risky. CI gaps and security‑hardening items should be addressed before production use. Suitable for teams that need full data control and are comfortable maintaining Docker‑based Node services.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

2,792 files

TypeScript2120
TSX354
Markdown112
YAML23
JSON16
JavaScript7

ReactExpressTailwindDockerKubernetes

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high5

medium6

low1

Pin third-party GitHub Actions to a commit SHAhigh4 occurrences

.github/workflows

docker/setup-buildx-action@v3, docker/login-action@v3, docker/build-push-action@v6, stefanprodan/helm-gh-pages@v1.7.0

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Make CI invoke the test suite it hashigh597 occurrences

.github/workflows

597 test files, no test command in the 4 workflows read

A green check that never executed an assertion is worse than no check, because reviewers trust it.

Fix: Add a test step to the existing workflow rather than a new workflow.

Remove continue-on-error from steps that gate correctnesshigh

.github/workflows/lint-prettier.yml

line 21 on a correctness step

A failing test suite reports a green check, which is precisely the path this audit exists to close.

Fix: Delete continue-on-error, or move a genuinely advisory step into a separate non-required job.

Open a pull request instead of pushing to the default branchhigh

.github/workflows/docker.yml

git push origin main --follow-tags

Automated commits land on the branch that deploys, with no test having run against the result.

Fix: Push to a bot branch and open a pull request, or restrict the push to a tag ref.

Remove eval over a runtime valuehigh

plugin-sdk/src/index.ts

exec() over a computed value

eval executes whatever the string contains, so wherever that string came from is now able to run code in the process, and the distance between the input and the eval is usually the only thing making it look safe.

Fix: Parse the value into the type you expect, with json.loads or ast.literal_eval.

Enable Dependabot or Renovatemedium

5 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium5 occurrences

Dockerfile

golang:1.25-alpine, node:24-alpine, node:24-alpine

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium2 occurrences

server/assets/atlas/admin1.geojson.gz

2 blobs over 5MB: admin1.geojson.gz 14.1MB, DayItineraryRemovePlaceByButton.gif 8.7MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/lint-prettier.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/docker-dev.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.