47 lines
4.8 KiB
Markdown
47 lines
4.8 KiB
Markdown
# Senior Developer — Follow-up Tasks
|
|
|
|
**Date:** 2026-06-01
|
|
**Author:** Review pass cross-referencing `SENIOR_REPORT.md` and `senior_skaffolding_1.md` against `SCAFFOLDING_HANDOFF_SENIOR.md` and the actual repository state.
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
The Session-2 stabilisation work in `SENIOR_REPORT.md` checks out against the repo: the `seeded_ids` fixture is in `tests/conftest.py`, `services/break_period_service.py` exists, `analytics_service.py` is fully implemented, the Alembic migration (`migrations/versions/001_initial_schema.py`), auth (argon2 + JWT + slowapi limiter), the `FetchDataService` contract + manual path + scraper stub, the tips skeleton, the frontend scaffold, and `.github/workflows/ci.yml` are all present. `frontend/package-lock.json` and `node_modules/` now exist, so the one-off `npm install` step is done.
|
|
|
|
29 test functions are present, matching the reported "29 passed" (I could not execute them here — Python 3.14/`uv` isn't installable offline — but the count and the fixes line up).
|
|
|
|
What follows are the items that were explicitly deferred plus a couple of handoff requirements that aren't yet met.
|
|
|
|
---
|
|
|
|
## 1. Wire the `scraper_enabled` guard — `routers/fetch_data.py`
|
|
The scraper routes currently return a blanket `501 NOT_IMPLEMENTED`; the `settings.scraper_enabled` flag is never checked. Wire the real guard (`if not settings.scraper_enabled: raise 501`) so the flag controls behaviour once the scraper exists. (Self-noted in the report; confirmed still open.)
|
|
|
|
## 2. Inject `WorkspaceRepository` into `TipsService` — `services/tips_service.py`
|
|
`_build_context` hardcodes `planning_goal = "balanced"` (line ~255). The three goal-specific rules (`skip_fp_first_12_months`, `wrap_weekend_with_vacation`, `wrap_red_days_with_vacation`) will never filter correctly until the real `planning_goal` is read from the workspace. Inject `WorkspaceRepository` or pass `planning_goal` into `get_tips()`. This blocks the junior's tips-wiring work from being testable end-to-end.
|
|
|
|
## 3. `BreakPeriodUpdate` field semantics — `models/break_period.py`
|
|
All fields are required (not `Optional`), so every `PUT` must send the full body. Either make them `Optional` for partial updates or document the full-replacement semantics. Decide this before the junior writes the BreakPeriod update tests (Task 1 in `JUNIOR_FOLLOWUP.md`) so the tests match the contract.
|
|
|
|
## 4. CI coverage gate will fail — `.github/workflows/ci.yml`
|
|
The backend job runs `pytest --cov=app --cov-fail-under=90`, but total `app/` coverage is ~37% because most routers/services are stubs. The pipeline will go red. Either temporarily lower the threshold, add a `[tool.coverage.run] omit` list for stub/skeleton files, or stage the gate to rise as the junior's tests land.
|
|
|
|
## 5. Password reset + email verification — `services/auth_service.py` / `routers/auth.py`
|
|
Handoff §b asked for "password reset / email verification," but neither is implemented (only register/login/JWT verify exist) and the report doesn't mention them. Confirm whether these are in scope for MVP; if so, implement them, if not, note the deferral explicitly so it isn't silently dropped.
|
|
|
|
## 6. Confirm rate-limiting is actually applied — `routers/auth.py`, `routers/fetch_data.py`
|
|
The `slowapi` limiter is created and attached in `main.py`, but handoff §b asked specifically for rate limits **on the auth + fetch endpoints**. Verify the per-endpoint `@limiter.limit(...)` decorators are in place (I didn't find them on the routes); add them if missing.
|
|
|
|
## 7. Postgres repository implementations — `repositories_impl/postgres/`
|
|
Only the `vacation_days` `NotImplementedError` skeleton exists. The other 8 entities (personal_data, user, workspace, child, parental_leave, planned_leave, break_period, workspace_invitation) need Postgres impls before production. Pattern: copy each SQLite impl, swap `aiosqlite` for `asyncpg` and `?` params for `$1, $2`. Lower priority — fine to leave until the app approaches production, but it's the largest remaining senior chunk.
|
|
|
|
## 8. Försäkringskassan scraper + BankID — `scrapers/fk_scraper.py` (BLOCKED)
|
|
Still a `NotImplementedError` stub behind the legal/ToS + BankID-automation gate. Do not implement until that gate clears (tracked in the legal-gate note referenced by the report). Listed here only so it isn't forgotten.
|
|
|
|
---
|
|
|
|
## Heads-up that affects the junior
|
|
|
|
A separate `JUNIOR_FOLLOWUP.md` has been created. The key finding: **none of the work described in `JUNIOR_REPORT.md` is present in the repository** — only your Session-1 scaffolding is there. The junior's Child/PlannedLeave service+model+router layers, the BreakPeriod tests, the `dates.py`/`holidays.py` utils, and all the frontend components/hooks are missing. Items 2 and 3 above (TipsContext injection, `BreakPeriodUpdate` semantics) directly unblock or shape that junior work, so they're worth doing first.
|