4.8 KiB
Senior Developer — Follow-up Tasks
Date: 2026-06-01
Author: Review pass cross-referencing SENIOR_REPORT.md and senior_skaffolding_1.md against SCAFFOLDING_HANDOFF_SENIOR.md and the actual repository state.
Summary
The Session-2 stabilisation work in SENIOR_REPORT.md checks out against the repo: the seeded_ids fixture is in tests/conftest.py, services/break_period_service.py exists, analytics_service.py is fully implemented, the Alembic migration (migrations/versions/001_initial_schema.py), auth (argon2 + JWT + slowapi limiter), the FetchDataService contract + manual path + scraper stub, the tips skeleton, the frontend scaffold, and .github/workflows/ci.yml are all present. frontend/package-lock.json and node_modules/ now exist, so the one-off npm install step is done.
29 test functions are present, matching the reported "29 passed" (I could not execute them here — Python 3.14/uv isn't installable offline — but the count and the fixes line up).
What follows are the items that were explicitly deferred plus a couple of handoff requirements that aren't yet met.
1. Wire the scraper_enabled guard — routers/fetch_data.py
The scraper routes currently return a blanket 501 NOT_IMPLEMENTED; the settings.scraper_enabled flag is never checked. Wire the real guard (if not settings.scraper_enabled: raise 501) so the flag controls behaviour once the scraper exists. (Self-noted in the report; confirmed still open.)
2. Inject WorkspaceRepository into TipsService — services/tips_service.py
_build_context hardcodes planning_goal = "balanced" (line ~255). The three goal-specific rules (skip_fp_first_12_months, wrap_weekend_with_vacation, wrap_red_days_with_vacation) will never filter correctly until the real planning_goal is read from the workspace. Inject WorkspaceRepository or pass planning_goal into get_tips(). This blocks the junior's tips-wiring work from being testable end-to-end.
3. BreakPeriodUpdate field semantics — models/break_period.py
All fields are required (not Optional), so every PUT must send the full body. Either make them Optional for partial updates or document the full-replacement semantics. Decide this before the junior writes the BreakPeriod update tests (Task 1 in JUNIOR_FOLLOWUP.md) so the tests match the contract.
4. CI coverage gate will fail — .github/workflows/ci.yml
The backend job runs pytest --cov=app --cov-fail-under=90, but total app/ coverage is ~37% because most routers/services are stubs. The pipeline will go red. Either temporarily lower the threshold, add a [tool.coverage.run] omit list for stub/skeleton files, or stage the gate to rise as the junior's tests land.
5. Password reset + email verification — services/auth_service.py / routers/auth.py
Handoff §b asked for "password reset / email verification," but neither is implemented (only register/login/JWT verify exist) and the report doesn't mention them. Confirm whether these are in scope for MVP; if so, implement them, if not, note the deferral explicitly so it isn't silently dropped.
6. Confirm rate-limiting is actually applied — routers/auth.py, routers/fetch_data.py
The slowapi limiter is created and attached in main.py, but handoff §b asked specifically for rate limits on the auth + fetch endpoints. Verify the per-endpoint @limiter.limit(...) decorators are in place (I didn't find them on the routes); add them if missing.
7. Postgres repository implementations — repositories_impl/postgres/
Only the vacation_days NotImplementedError skeleton exists. The other 8 entities (personal_data, user, workspace, child, parental_leave, planned_leave, break_period, workspace_invitation) need Postgres impls before production. Pattern: copy each SQLite impl, swap aiosqlite for asyncpg and ? params for $1, $2. Lower priority — fine to leave until the app approaches production, but it's the largest remaining senior chunk.
8. Försäkringskassan scraper + BankID — scrapers/fk_scraper.py (BLOCKED)
Still a NotImplementedError stub behind the legal/ToS + BankID-automation gate. Do not implement until that gate clears (tracked in the legal-gate note referenced by the report). Listed here only so it isn't forgotten.
Heads-up that affects the junior
A separate JUNIOR_FOLLOWUP.md has been created. The key finding: none of the work described in JUNIOR_REPORT.md is present in the repository — only your Session-1 scaffolding is there. The junior's Child/PlannedLeave service+model+router layers, the BreakPeriod tests, the dates.py/holidays.py utils, and all the frontend components/hooks are missing. Items 2 and 3 above (TipsContext injection, BreakPeriodUpdate semantics) directly unblock or shape that junior work, so they're worth doing first.