mbweb — Refactoring and fixes round 2 (April 2026)

Context

Follow-up on the first audit pass. This article covers the six improvements and refactors applied after the initial bug fixes.

Changes

G — Dead code removed from viewHelpers.js

yesNo() and isEnabled() were exported but never imported anywhere in the codebase. Both functions were removed. boolLabel() remains as the single utility for boolean display.

R10 — fmtUptime moved to viewHelpers.js

fmtUptime() was defined inline inside the GET / request handler, meaning it was re-created on every request. It is now a named export in lib/viewHelpers.js and imported at module level in app.js.

H — Quotes, Commands and Network added to navigation

lib/render.js only included Profil, Channels and Radio in the nav bar. Quotes and Commands are now visible to all authenticated users. Network and Users are conditionally shown to Master and above.

E — findMount was matching against server_name instead of serverName

In lib/radio.js, findMount() is called with the normalized mounts array where raw Icecast fields have been camel-cased. The fallback .find() was still checking src.server_name (always undefined on normalized objects) instead of src.serverName. The mount lookup now works correctly across all fallback paths.

R11 — Duplicate level calculation removed from mediabotRepository.js

userHasChannelAccess() was computing the semantic user level inline, duplicating the logic already in globalLevel() from permissions.js. The function now imports and calls globalLevel() directly — single source of truth for level resolution across the codebase.

R13 — express-rate-limit removed from package.json

The package was listed under optionalDependencies but was never imported or used. Rate limiting on the login route is handled by a lightweight custom implementation in routes/auth.js. The dead dependency entry has been removed.

Status

Next: split app.js into dedicated route files and extract Prometheus helpers into lib/metrics.js (R9).