portal-api/project.md

Performance & Production Readiness Audit

Date: 2026-01-27 Auditor: Antigravity (AI) Target: Laravel 10 / PHP 8.1+ / MySQL / Redis

---

1. CRITICAL PERFORMANCE RISKS (Must fix before production)

🔴 Synchronous vCenter Calls in Livewire

File: app/Http/Livewire/VPSReinstallModal.php Description: The getIPFromVCenter() method calls vCenterService->loginServer() and GetIPAddressVirtualMachine synchronously during component initialization (loadOsData). Risk: If vCenter is slow (common) or down, the user's browser will hang indefinitely/timeout when opening the modal. This blocks the PHP-FPM worker. Fix:

• Move vCenter lookup to a background Queue Job.
• Use wire:poll or Echo to check for the IP status after the modal opens.
• Immediate: Wrap the call in a short timeout or remove it from the read path if not strictly necessary for the initial view.

🔴 Self-Calling HTTP Requests (Loopback)

File: app/Http/Livewire/VPSReinstallModal.php Description: confirmReinstall uses Http::withoutVerifying()->post(route('service.reinstall.vm')...) to trigger logic. Risk:

1. Ineufficiency: It consumes an extra PHP-FPM worker for the loopback request (Request A waits for Request B).
2. Security: withoutVerifying() bypasses SSL checks. Fix: Refactor the logic inside ServiceController::reinstallVM into a ReinstallService and call it directly from the Livewire component.

🔴 Job-within-Job Synchronous Execution

File: app/Jobs/VirtualMachine/ProcessOrderPaymentJob.php Description: ProcessOrderPaymentJob instantiates CreateVirtualMachineJob and calls $vmJob->handle(...) directly. Risk: If CreateVirtualMachineJob takes long (e.g., 2 minutes for vCenter), ProcessOrderPaymentJob might timeout (default 60s/90s). If creating 5 VMs, it will surely fail. Fix:

• Dispatch CreateVirtualMachineJob::dispatch(...) to the queue.
• Let ProcessOrderPaymentJob only initiate the process or use a Batch to monitor progress.

---

2. DATABASE PERFORMANCE REVIEW

⚠️ Select * in Repositories

File: app/Repositories/BaseCachedRepository.php Description: getAll() uses parent::getAll() which likely does $model->all(). Risk: Tables like vps (with text description) or user_logs will eventually destroy memory when getAll() is called and cached. Fix:

• Remove getAll() from BaseCachedRepository.
• Implement paginate() by default.
• Use select(['id', 'name', ...]) for lists.

⚠️ Missing Explicit Indices

File: database/migrations/2026_01_27_151851_update_forigin_key_module_ip_table.php Description: FKs added to module_host_id and module_network_id. While MySQL often indexes FKs, explicit indexing ensures query performance for where('module_host_id', $id). Fix: Verify indices exist or add $table->index('module_host_id').

---

3. LIVEWIRE & FRONTEND PERFORMANCE

⚠️ Heavy Mount Logic

File: app/Http/Livewire/VPSReinstallModal.php Description: loadOsData performs multiple DB queries (VPS::with, OsGroup::with with closures) and checking Invoice items. Fix: Use Lazy Loading (wire:init or lazy attribute in Livewire 3) to load heavy data after the modal opens.

---

4. QUEUE, REDIS & BACKGROUND JOBS

⚠️ Queue Blocking

Description: ProcessOrderPaymentJob combines "Payment Logic" (fast) with "VM Creation" (slow). Fix:

• Separate queues: queue:work --queue=high,default,low.
• Put CreateVirtualMachineJob on low or provisioning queue.
• Keep ProcessOrderPaymentJob on high to update payment status quickly.

---

5. CACHING STRATEGY REVIEW

🔴 Dangerous 'getAll' Cache

File: app/Repositories/BaseCachedRepository.php Description: Caches the entire table result of getAll(). Risk: Redis memory exhaustion. Fix:

• Delete getAll caching logic.
• Cache individual items by ID (find($id) is fine).
• Cache configuration/settings, not transactional data lists.

---

6. SECURITY & PRODUCTION CONFIG CHECK

⚠️ SSL Verification Disabled

File: app/Http/Livewire/VPSReinstallModal.php Description: Http::withoutVerifying() is used. Fix: Fix the root cause (self-signed certs?) or use internal service calls instead of HTTP loopbacks.

⚠️ Sensitive Logging

File: app/Jobs/VirtualMachine/ProcessOrderPaymentJob.php Description: Sends detailed error logs to Telegram. Risk: Ensure trace or message doesn't contain API keys / credit card info (unlikely in exception message, but possible).

---

7. SCALABILITY BOTTLENECKS

At 1k Users

• BaseCachedRepository::getAll() will start causing 500 errors (OOM).

At 10k Users

• Synchronous vCenter calls will cause "No child processes" in PHP-FPM during traffic spikes.
• Redis will fill up if getAll isn't removed.

---

8. FINAL PRODUCTION CHECKLIST

Must Fix Before Launch

• Refactor: Remove Http::withoutVerifying() loopback in VPSReinstallModal.
• Async: Move getIPFromVCenter to background or make it lazy/optional.
• Cache: Disable getAll() caching in BaseCachedRepository.
• Queue: Decouple CreateVirtualMachineJob from ProcessOrderPaymentJob (dispatch don't call handle).

Should Fix Soon

• Database: Add explicit indices for searching fields in vps and orders.
• Refactor: Move logic from Controllers/Livewire to Services to avoid loopback HTTP calls.