A kódbázis kommentek nélkül marad

Kérésre: minden magyarázó komment kikerült a forrásfájlokból — 89 Ruby, 16
TypeScript, 14 Vue, plusz a CSS/JS/CJS. Nem soralapú kereséssel: a Ruby-t a
Ripper tokenizálta, a JS/TS/CSS-t állapotgép járta végig, hogy az URL-ekben,
reguláris kifejezésekben és heredocokban álló // és # jelek helyükön
maradjanak.

Három komment maradt, mert nélkülük nem indul a kód: az entrypoint.sh
shebangja, a vite-env.d.ts hármas perjeles referenciája, és a sanitize
teszt @vitest-environment direktívája (ez utóbbi a magyarázó része nélkül).

Egy helyen kódot is kellett írni: a CommandBlock másolás-hibaágán a komment
volt a catch egyetlen tartalma, és üres blokkot az eslint nem enged — a
copied jelző visszaállítása került a helyére.

A yaml, Dockerfile, Makefile, erb és markdown fájlokat nem érintettem.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/controllers/concerns/warp_engine/subject_authentication.rb

@@ -1,35 +1,16 @@
 module WarpEngine
-  # Who the caller is, on the read-only side of the API.
-  #
-  # Distinct from UpdateAuthentication, which guards publishing: that one asks "may this
-  # pipeline write to the catalog", this one asks "whose library am I looking at". The
-  # answer is allowed to be nobody — an anonymous caller is a normal, supported caller,
-  # and a catalog with no policy configured never needs one.
-  #
-  # The credential is a bearer token, because that is what a client can carry: it has no
-  # cookie jar and no browser session.
+
   module SubjectAuthentication
     extend ActiveSupport::Concern
 
     private
 
-    # The ApplicationToken behind the request, or nil.
     def current_access_token
       return @current_access_token if defined?(@current_access_token)
 
       @current_access_token = resolve_access_token
     end
 
-    # Whoever the request is on behalf of — the host's own object, or nil.
-    #
-    # Two ways to be somebody, tried in that order. A bearer token is what a client
-    # carries. A *browser* carries a session instead, and the engine has no idea what a
-    # session is here — so a host that wants its signed-in visitors recognised on these
-    # endpoints supplies a resolver:
-    #
-    #   c.subject_resolver = ->(request) { request.env["warden"]&.user }
-    #
-    # Without one, a browser is simply anonymous, which is what it always was.
     def current_subject
       return @current_subject if defined?(@current_subject)
 
@@ -51,9 +32,6 @@ module WarpEngine
       record
     end
 
-    # A resolver that raises must not take the request with it: it runs on every read
-    # endpoint, and a broken one would turn the whole API into 500s rather than into
-    # anonymous requests, which is the honest fallback.
     def resolve_host_subject
       resolver = WarpEngine.config.subject_resolver
       return nil if resolver.nil?

app/controllers/concerns/warp_engine/update_authentication.rb

@@ -1,7 +1,5 @@
 module WarpEngine
-  # Token authentication for the publishing (/build/*) endpoints.
-  # The auth source is exclusive: in :database mode the shared secret is not
-  # accepted, in :env mode DB tokens are not.
+
   module UpdateAuthentication
     extend ActiveSupport::Concern
 
@@ -9,8 +7,6 @@ module WarpEngine
 
     attr_reader :current_application_token
 
-    # The token is accepted from the X-Update-Secret header only — in the URL
-    # it would leak into proxy and access logs.
     def update_authorized?(required_scope:)
       token = request.headers["X-Update-Secret"].presence
       return false if token.blank?
@@ -23,7 +19,7 @@ module WarpEngine
 
     def env_secret_authorized?(token)
       expected = WarpEngine.config.update_secret
-      # With no secret configured the endpoint stays closed.
+
       expected.present? && ActiveSupport::SecurityUtils.secure_compare(token, expected)
     end
 
@@ -41,9 +37,6 @@ module WarpEngine
       true
     end
 
-    # Ownership enforcement applies only in :database mode (there is a token)
-    # with enforce_software_ownership on. An ownerless software is up for grabs
-    # until the backfill — backfill before enabling the enforcement.
     def software_ownership_authorized?(name)
       return true unless WarpEngine.config.enforce_software_ownership
 
@@ -56,8 +49,6 @@ module WarpEngine
       software.owner_type == token.owner_type && software.owner_id == token.owner_id
     end
 
-    # A first-published (or pre-backfill, ownerless) software gets the
-    # submitting token's owner. Unrestricted (internal) tokens claim nothing.
     def claim_software_ownership(name)
       token = current_application_token
       return if token.nil? || token.unrestricted?