fix: address PR review blockers — remove cache endpoint, fix casts, revert ThreadLocal

Review fixes for PR #3:

BLOCKER 1: Remove POST /api/cache/invalidate endpoint — violates
read-only serving architecture and has no auth (DoS vector via cache
stampede). Cache invalidation now only happens on server restart.

BLOCKER 2: Add blank-string filter to countDistinctFiles() Cypher
query (AND n.filePath <> '') to match the Java-side behavior it
replaced.

MUST FIX: Revert PARSER.remove() deletion in
AbstractJavaParserDetector — the finally block is the correct
ThreadLocal cleanup pattern to prevent memory leaks with pooled
threads.

MEDIUM: Replace unchecked (String) casts with String.valueOf() in
computeLanguageStats, computeFrameworkStats, computeAuthStats,
computeConnectionStats, and computeInfraStats for robustness.

LOW: Read node_count/edge_count from already-computed graph sub-map
in QueryService.getStats() instead of re-querying graphStore.count()
and countEdges().

All 1395 tests pass (0 failures, 0 errors).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: aksOps

src/main/java/io/github/randomcodespace/iq/api/GraphController.java

@@ -2,7 +2,6 @@
 
 import io.github.randomcodespace.iq.config.CodeIqConfig;
 import io.github.randomcodespace.iq.query.QueryService;
-import org.springframework.cache.CacheManager;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -32,14 +31,11 @@ public class GraphController {
 
     private final QueryService queryService;
     private final CodeIqConfig config;
-    private final CacheManager cacheManager;
 
     public GraphController(@org.springframework.beans.factory.annotation.Autowired(required = false) QueryService queryService,
-                           CodeIqConfig config,
-                           @org.springframework.beans.factory.annotation.Autowired(required = false) CacheManager cacheManager) {
+                           CodeIqConfig config) {
         this.queryService = queryService;
         this.config = config;
-        this.cacheManager = cacheManager;
     }
 
     @GetMapping("/stats")
@@ -248,21 +244,6 @@ public ResponseEntity<String> readFile(
         }
     }
 
-    @PostMapping("/cache/invalidate")
-    public Map<String, Object> invalidateCache() {
-        int cleared = 0;
-        if (cacheManager != null) {
-            for (String name : cacheManager.getCacheNames()) {
-                var cache = cacheManager.getCache(name);
-                if (cache != null) {
-                    cache.clear();
-                    cleared++;
-                }
-            }
-        }
-        return Map.of("status", "ok", "caches_cleared", cleared);
-    }
-
     // POST /api/analyze removed — API/MCP server is read-only.
     // Analysis is done locally via CLI: code-iq analyze / code-iq index
     // Data is loaded into Neo4j on serve startup (auto-enrich).

src/main/java/io/github/randomcodespace/iq/detector/java/AbstractJavaParserDetector.java

@@ -29,6 +29,8 @@ protected Optional<CompilationUnit> parse(DetectorContext ctx) {
             // JavaParser may throw AssertionError for unrecognized token kinds
             // (e.g. newer Java syntax). Fall back to regex in those cases.
             return Optional.empty();
+        } finally {
+            PARSER.remove();
         }
     }
 

src/main/java/io/github/randomcodespace/iq/graph/GraphStore.java

@@ -402,7 +402,7 @@ public long countEdges() {
     public long countDistinctFiles() {
         try (Transaction tx = graphDb.beginTx()) {
             var result = tx.execute(
-                    "MATCH (n:CodeNode) WHERE n.filePath IS NOT NULL "
+                    "MATCH (n:CodeNode) WHERE n.filePath IS NOT NULL AND n.filePath <> '' "
                             + "RETURN count(DISTINCT n.filePath) AS cnt");
             if (result.hasNext()) {
                 return ((Number) result.next().get("cnt")).longValue();
@@ -699,7 +699,7 @@ private Map<String, Object> computeLanguageStats() {
                             + "RETURN toLower(n.prop_language) AS lang, count(n) AS cnt");
             while (result.hasNext()) {
                 var row = result.next();
-                String lang = ((String) row.get("lang")).trim();
+                String lang = String.valueOf(row.get("lang")).trim();
                 if (!lang.isBlank()) {
                     langCounts.merge(lang, ((Number) row.get("cnt")).longValue(), Long::sum);
                 }
@@ -725,7 +725,7 @@ private Map<String, Object> computeFrameworkStats() {
                             + "RETURN n.prop_framework AS fw, count(n) AS cnt");
             while (result.hasNext()) {
                 var row = result.next();
-                String fw = ((String) row.get("fw")).trim();
+                String fw = String.valueOf(row.get("fw")).trim();
                 if (!fw.isBlank()) {
                     fwCounts.merge(fw, ((Number) row.get("cnt")).longValue(), Long::sum);
                 }
@@ -759,7 +759,7 @@ private Map<String, Object> computeInfraStats() {
                             + "RETURN coalesce(n.prop_protocol, n.label, 'unknown') AS protocol, count(n) AS cnt");
             while (result.hasNext()) {
                 var row = result.next();
-                messaging.merge((String) row.get("protocol"), ((Number) row.get("cnt")).longValue(), Long::sum);
+                messaging.merge(String.valueOf(row.get("protocol")), ((Number) row.get("cnt")).longValue(), Long::sum);
             }
         }
         infra.put("messaging", sortByValueDesc(messaging));
@@ -771,7 +771,7 @@ private Map<String, Object> computeInfraStats() {
                             + "RETURN coalesce(n.prop_resource_type, n.label, 'unknown') AS resType, count(n) AS cnt");
             while (result.hasNext()) {
                 var row = result.next();
-                cloud.merge((String) row.get("resType"), ((Number) row.get("cnt")).longValue(), Long::sum);
+                cloud.merge(String.valueOf(row.get("resType")), ((Number) row.get("cnt")).longValue(), Long::sum);
             }
         }
         infra.put("cloud", sortByValueDesc(cloud));
@@ -789,7 +789,7 @@ private Map<String, Object> computeConnectionStats() {
             Map<String, Long> restByMethod = new TreeMap<>();
             while (restResult.hasNext()) {
                 var row = restResult.next();
-                restByMethod.put((String) row.get("method"), ((Number) row.get("cnt")).longValue());
+                restByMethod.put(String.valueOf(row.get("method")), ((Number) row.get("cnt")).longValue());
             }
             long restTotal = restByMethod.values().stream().mapToLong(Long::longValue).sum();
             Map<String, Object> rest = new LinkedHashMap<>();
@@ -824,7 +824,7 @@ private Map<String, Object> computeAuthStats() {
                             + "RETURN n.prop_auth_type AS authType, count(n) AS cnt");
             while (guardResult.hasNext()) {
                 var row = guardResult.next();
-                String authType = ((String) row.get("authType")).trim();
+                String authType = String.valueOf(row.get("authType")).trim();
                 if (!authType.isBlank()) {
                     authCounts.merge(authType, ((Number) row.get("cnt")).longValue(), Long::sum);
                 }
@@ -834,7 +834,7 @@ private Map<String, Object> computeAuthStats() {
                             + "RETURN n.prop_framework AS fw, count(n) AS cnt");
             while (fwResult.hasNext()) {
                 var row = fwResult.next();
-                String fw = ((String) row.get("fw")).trim();
+                String fw = String.valueOf(row.get("fw")).trim();
                 String authType = fw.substring("auth:".length()).trim();
                 if (!authType.isEmpty()) {
                     authCounts.merge(authType, ((Number) row.get("cnt")).longValue(), Long::sum);

src/main/java/io/github/randomcodespace/iq/query/QueryService.java

@@ -46,8 +46,16 @@ public Map<String, Object> getStats() {
             nodesByLayer.put((String) row.get("layer"), ((Number) row.get("cnt")).longValue());
         }
 
-        result.put("node_count", graphStore.count());
-        result.put("edge_count", graphStore.countEdges());
+        // Read from already-computed graph sub-map instead of re-querying
+        @SuppressWarnings("unchecked")
+        Map<String, Object> graphStats = (Map<String, Object>) result.get("graph");
+        if (graphStats != null) {
+            result.put("node_count", graphStats.get("nodes"));
+            result.put("edge_count", graphStats.get("edges"));
+        } else {
+            result.put("node_count", graphStore.count());
+            result.put("edge_count", graphStore.countEdges());
+        }
         result.put("nodes_by_kind", nodesByKind);
         result.put("nodes_by_layer", nodesByLayer);
         return result;

src/test/java/io/github/randomcodespace/iq/api/GraphControllerTest.java

@@ -45,7 +45,7 @@ void setUp() {
         config.setMaxDepth(10);
         config.setMaxRadius(10);
         config.setRootPath(".");
-        var controller = new GraphController(queryService, config, null);
+        var controller = new GraphController(queryService, config);
         mockMvc = MockMvcBuilders.standaloneSetup(controller).build();
     }
 
@@ -416,7 +416,7 @@ void searchGraphShouldReturnResults() throws Exception {
     void readFileShouldReturnContent(@TempDir Path tempDir) throws Exception {
         Files.writeString(tempDir.resolve("hello.txt"), "Hello World", StandardCharsets.UTF_8);
         config.setRootPath(tempDir.toAbsolutePath().toString());
-        var controller = new GraphController(queryService, config, null);
+        var controller = new GraphController(queryService, config);
         var fileMvc = MockMvcBuilders.standaloneSetup(controller).build();
 
         fileMvc.perform(get("/api/file").param("path", "hello.txt"))
@@ -427,7 +427,7 @@ void readFileShouldReturnContent(@TempDir Path tempDir) throws Exception {
     @Test
     void readFileShouldReturn404ForMissing(@TempDir Path tempDir) throws Exception {
         config.setRootPath(tempDir.toAbsolutePath().toString());
-        var controller = new GraphController(queryService, config, null);
+        var controller = new GraphController(queryService, config);
         var fileMvc = MockMvcBuilders.standaloneSetup(controller).build();
 
         fileMvc.perform(get("/api/file").param("path", "nonexistent.txt"))
@@ -437,7 +437,7 @@ void readFileShouldReturn404ForMissing(@TempDir Path tempDir) throws Exception {
     @Test
     void readFileShouldBlockPathTraversal(@TempDir Path tempDir) throws Exception {
         config.setRootPath(tempDir.toAbsolutePath().toString());
-        var controller = new GraphController(queryService, config, null);
+        var controller = new GraphController(queryService, config);
         var fileMvc = MockMvcBuilders.standaloneSetup(controller).build();
 
         fileMvc.perform(get("/api/file").param("path", "../../../etc/passwd"))
@@ -450,7 +450,7 @@ void readFileShouldReturnLineRange(@TempDir Path tempDir) throws Exception {
         Files.writeString(tempDir.resolve("multi.txt"), "line1\nline2\nline3\nline4\nline5",
                 StandardCharsets.UTF_8);
         config.setRootPath(tempDir.toAbsolutePath().toString());
-        var controller = new GraphController(queryService, config, null);
+        var controller = new GraphController(queryService, config);
         var fileMvc = MockMvcBuilders.standaloneSetup(controller).build();
 
         fileMvc.perform(get("/api/file")
@@ -465,7 +465,7 @@ void readFileShouldReturnLineRange(@TempDir Path tempDir) throws Exception {
     void readFileShouldReturnFullContentWithoutLineParams(@TempDir Path tempDir) throws Exception {
         Files.writeString(tempDir.resolve("full.txt"), "aaa\nbbb\nccc", StandardCharsets.UTF_8);
         config.setRootPath(tempDir.toAbsolutePath().toString());
-        var controller = new GraphController(queryService, config, null);
+        var controller = new GraphController(queryService, config);
         var fileMvc = MockMvcBuilders.standaloneSetup(controller).build();
 
         fileMvc.perform(get("/api/file").param("path", "full.txt"))

src/test/java/io/github/randomcodespace/iq/query/QueryServiceTest.java

@@ -80,8 +80,6 @@ void getStatsShouldReturnNodeAndEdgeCounts() {
         aggregateStats.put("architecture", Map.of("classes", 1L));
 
         when(graphStore.computeAggregateStats()).thenReturn(aggregateStats);
-        when(graphStore.count()).thenReturn(2L);
-        when(graphStore.countEdges()).thenReturn(1L);
         when(graphStore.countNodesByKind()).thenReturn(List.of(
                 Map.of("kind", "endpoint", "cnt", 1L),
                 Map.of("kind", "class", "cnt", 1L)));