# Performance & Production Readiness Audit

**Date:** 2026-01-27
**Auditor:** Antigravity (AI)
**Target:** Laravel 10 / PHP 8.1+ / MySQL / Redis

---

## 1. CRITICAL PERFORMANCE RISKS (Must fix before production)

### 🔴 Synchronous vCenter Calls in Livewire
**File:** `app/Http/Livewire/VPSReinstallModal.php`
**Description:** The `getIPFromVCenter()` method calls `vCenterService->loginServer()` and `GetIPAddressVirtualMachine` **synchronously** during component initialization (`loadOsData`).
**Risk:** If vCenter is slow (common) or down, the user's browser will hang indefinitely/timeout when opening the modal. This blocks the PHP-FPM worker.
**Fix:**
- Move vCenter lookup to a background Queue Job.
- Use `wire:poll` or Echo to check for the IP status after the modal opens.
- **Immediate:** Wrap the call in a short timeout or remove it from the read path if not strictly necessary for the initial view.

### 🔴 Self-Calling HTTP Requests (Loopback)
**File:** `app/Http/Livewire/VPSReinstallModal.php`
**Description:** `confirmReinstall` uses `Http::withoutVerifying()->post(route('service.reinstall.vm')...)` to trigger logic.
**Risk:** 
1.  **Ineufficiency:** It consumes an extra PHP-FPM worker for the loopback request (Request A waits for Request B).
2.  **Security:** `withoutVerifying()` bypasses SSL checks.
**Fix:** Refactor the logic inside `ServiceController::reinstallVM` into a `ReinstallService` and call it directly from the Livewire component.

### 🔴 Job-within-Job Synchronous Execution
**File:** `app/Jobs/VirtualMachine/ProcessOrderPaymentJob.php`
**Description:** `ProcessOrderPaymentJob` instantiates `CreateVirtualMachineJob` and calls `$vmJob->handle(...)` directly.
**Risk:** If `CreateVirtualMachineJob` takes long (e.g., 2 minutes for vCenter), `ProcessOrderPaymentJob` might timeout (default 60s/90s). If creating 5 VMs, it will surely fail.
**Fix:** 
- Dispatch `CreateVirtualMachineJob::dispatch(...)` to the queue.
- Let `ProcessOrderPaymentJob` only *initiate* the process or use a `Batch` to monitor progress.

---

## 2. DATABASE PERFORMANCE REVIEW

### ⚠️ `Select *` in Repositories
**File:** `app/Repositories/BaseCachedRepository.php`
**Description:** `getAll()` uses `parent::getAll()` which likely does `$model->all()`.
**Risk:** Tables like `vps` (with `text` description) or `user_logs` will eventually destroy memory when `getAll()` is called and cached.
**Fix:** 
- Remove `getAll()` from `BaseCachedRepository`.
- Implement `paginate()` by default.
- Use `select(['id', 'name', ...])` for lists.

### ⚠️ Missing Explicit Indices
**File:** `database/migrations/2026_01_27_151851_update_forigin_key_module_ip_table.php`
**Description:** FKs added to `module_host_id` and `module_network_id`. While MySQL often indexes FKs, explicit indexing ensures query performance for `where('module_host_id', $id)`.
**Fix:** Verify indices exist or add `$table->index('module_host_id')`.

---

## 3. LIVEWIRE & FRONTEND PERFORMANCE

### ⚠️ Heavy Mount Logic
**File:** `app/Http/Livewire/VPSReinstallModal.php`
**Description:** `loadOsData` performs multiple DB queries (`VPS::with`, `OsGroup::with` with closures) and checking Invoice items.
**Fix:** Use **Lazy Loading** (`wire:init` or `lazy` attribute in Livewire 3) to load heavy data *after* the modal opens.

---

## 4. QUEUE, REDIS & BACKGROUND JOBS

### ⚠️ Queue Blocking
**Description:** `ProcessOrderPaymentJob` combines "Payment Logic" (fast) with "VM Creation" (slow).
**Fix:**
- Separate queues: `queue:work --queue=high,default,low`.
- Put `CreateVirtualMachineJob` on `low` or `provisioning` queue.
- Keep `ProcessOrderPaymentJob` on `high` to update payment status quickly.

---

## 5. CACHING STRATEGY REVIEW

### 🔴 Dangerous 'getAll' Cache
**File:** `app/Repositories/BaseCachedRepository.php`
**Description:** Caches the *entire table result* of `getAll()`.
**Risk:** Redis memory exhaustion.
**Fix:** 
- **Delete** `getAll` caching logic.
- Cache *individual* items by ID (`find($id)` is fine).
- Cache configuration/settings, not transactional data lists.

---

## 6. SECURITY & PRODUCTION CONFIG CHECK

### ⚠️ SSL Verification Disabled
**File:** `app/Http/Livewire/VPSReinstallModal.php`
**Description:** `Http::withoutVerifying()` is used.
**Fix:** Fix the root cause (self-signed certs?) or use internal service calls instead of HTTP loopbacks.

### ⚠️ Sensitive Logging
**File:** `app/Jobs/VirtualMachine/ProcessOrderPaymentJob.php`
**Description:** Sends detailed error logs to Telegram.
**Risk:** Ensure `trace` or `message` doesn't contain API keys / credit card info (unlikely in exception message, but possible).

---

## 7. SCALABILITY BOTTLENECKS

### At 1k Users
- `BaseCachedRepository::getAll()` will start causing 500 errors (OOM).

### At 10k Users
- Synchronous vCenter calls will cause "No child processes" in PHP-FPM during traffic spikes.
- Redis will fill up if `getAll` isn't removed.

---

## 8. FINAL PRODUCTION CHECKLIST

### Must Fix Before Launch
- [ ] **Refactor**: Remove `Http::withoutVerifying()` loopback in `VPSReinstallModal`.
- [ ] **Async**: Move `getIPFromVCenter` to background or make it lazy/optional.
- [ ] **Cache**: Disable `getAll()` caching in `BaseCachedRepository`.
- [ ] **Queue**: Decouple `CreateVirtualMachineJob` from `ProcessOrderPaymentJob` (dispatch don't call handle).

### Should Fix Soon
- [ ] **Database**: Add explicit indices for searching fields in `vps` and `orders`.
- [ ] **Refactor**: Move logic from Controllers/Livewire to Services to avoid loopback HTTP calls.