# Senior Developer — Follow-up Tasks **Date:** 2026-06-01 **Author:** Review pass cross-referencing `SENIOR_REPORT.md` and `senior_skaffolding_1.md` against `SCAFFOLDING_HANDOFF_SENIOR.md` and the actual repository state. --- ## Summary The Session-2 stabilisation work in `SENIOR_REPORT.md` checks out against the repo: the `seeded_ids` fixture is in `tests/conftest.py`, `services/break_period_service.py` exists, `analytics_service.py` is fully implemented, the Alembic migration (`migrations/versions/001_initial_schema.py`), auth (argon2 + JWT + slowapi limiter), the `FetchDataService` contract + manual path + scraper stub, the tips skeleton, the frontend scaffold, and `.github/workflows/ci.yml` are all present. `frontend/package-lock.json` and `node_modules/` now exist, so the one-off `npm install` step is done. 29 test functions are present, matching the reported "29 passed" (I could not execute them here — Python 3.14/`uv` isn't installable offline — but the count and the fixes line up). What follows are the items that were explicitly deferred plus a couple of handoff requirements that aren't yet met. --- ## 1. Wire the `scraper_enabled` guard — `routers/fetch_data.py` The scraper routes currently return a blanket `501 NOT_IMPLEMENTED`; the `settings.scraper_enabled` flag is never checked. Wire the real guard (`if not settings.scraper_enabled: raise 501`) so the flag controls behaviour once the scraper exists. (Self-noted in the report; confirmed still open.) ## 2. Inject `WorkspaceRepository` into `TipsService` — `services/tips_service.py` `_build_context` hardcodes `planning_goal = "balanced"` (line ~255). The three goal-specific rules (`skip_fp_first_12_months`, `wrap_weekend_with_vacation`, `wrap_red_days_with_vacation`) will never filter correctly until the real `planning_goal` is read from the workspace. Inject `WorkspaceRepository` or pass `planning_goal` into `get_tips()`. This blocks the junior's tips-wiring work from being testable end-to-end. ## 3. `BreakPeriodUpdate` field semantics — `models/break_period.py` All fields are required (not `Optional`), so every `PUT` must send the full body. Either make them `Optional` for partial updates or document the full-replacement semantics. Decide this before the junior writes the BreakPeriod update tests (Task 1 in `JUNIOR_FOLLOWUP.md`) so the tests match the contract. ## 4. CI coverage gate will fail — `.github/workflows/ci.yml` The backend job runs `pytest --cov=app --cov-fail-under=90`, but total `app/` coverage is ~37% because most routers/services are stubs. The pipeline will go red. Either temporarily lower the threshold, add a `[tool.coverage.run] omit` list for stub/skeleton files, or stage the gate to rise as the junior's tests land. ## 5. Password reset + email verification — `services/auth_service.py` / `routers/auth.py` Handoff §b asked for "password reset / email verification," but neither is implemented (only register/login/JWT verify exist) and the report doesn't mention them. Confirm whether these are in scope for MVP; if so, implement them, if not, note the deferral explicitly so it isn't silently dropped. ## 6. Confirm rate-limiting is actually applied — `routers/auth.py`, `routers/fetch_data.py` The `slowapi` limiter is created and attached in `main.py`, but handoff §b asked specifically for rate limits **on the auth + fetch endpoints**. Verify the per-endpoint `@limiter.limit(...)` decorators are in place (I didn't find them on the routes); add them if missing. ## 7. Postgres repository implementations — `repositories_impl/postgres/` Only the `vacation_days` `NotImplementedError` skeleton exists. The other 8 entities (personal_data, user, workspace, child, parental_leave, planned_leave, break_period, workspace_invitation) need Postgres impls before production. Pattern: copy each SQLite impl, swap `aiosqlite` for `asyncpg` and `?` params for `$1, $2`. Lower priority — fine to leave until the app approaches production, but it's the largest remaining senior chunk. ## 8. Försäkringskassan scraper + BankID — `scrapers/fk_scraper.py` (BLOCKED) Still a `NotImplementedError` stub behind the legal/ToS + BankID-automation gate. Do not implement until that gate clears (tracked in the legal-gate note referenced by the report). Listed here only so it isn't forgotten. --- ## Heads-up that affects the junior A separate `JUNIOR_FOLLOWUP.md` has been created. The key finding: **none of the work described in `JUNIOR_REPORT.md` is present in the repository** — only your Session-1 scaffolding is there. The junior's Child/PlannedLeave service+model+router layers, the BreakPeriod tests, the `dates.py`/`holidays.py` utils, and all the frontend components/hooks are missing. Items 2 and 3 above (TipsContext injection, `BreakPeriodUpdate` semantics) directly unblock or shape that junior work, so they're worth doing first.