# Code Analysis Report: Lecture Time Notifier
**Date:** 2024-07-26
**Analyst:** Jules (AI Software Engineer)
## Overall Summary:
The "Lecture Time Notifier" is a web application with a FastAPI Python
backend and a React frontend. It allows users (lecturers or students) to
register, log in, and manage schedules for lectures and exams. The system
aims to provide notifications for upcoming events via WebSockets and
browser notifications.
The application is functional for its core features. The backend uses
MongoDB for data storage and JWT for authentication. The frontend is a
single-page application built with React and styled with Tailwind CSS.
However, there are several areas for improvement across security, code
structure, maintainability, user experience, and best practices.
## Key Findings and Recommendations:
### I. Security:
1. **Hardcoded JWT Secret (Backend):**
* **Finding:** `SECRET_KEY` in `backend/server.py` is hardcoded.
* **Recommendation:** Store the `SECRET_KEY` in an environment
variable and load it via `os.environ`.
2. **Permissive CORS Policy (Backend):**
* **Finding:** `allow_origins=["*"]` in `backend/server.py` is too
permissive.
* **Recommendation:** Restrict `allow_origins` to the specific frontend
domain(s) in production.
3. **WebSocket Authentication (Backend & Frontend):**
* **Finding:** WebSocket connections (`/ws/{user_id}`) are not
authenticated using the JWT token. Relies on `user_id` in the path.
* **Recommendation (Backend):** Implement token-based
authentication for WebSocket connections. This could involve passing the
token as a query parameter during connection setup (if WSS is enforced) or
as the first message over the WebSocket, then validating it.
* **Recommendation (Frontend):** Send the token during WebSocket
connection handshake as per backend implementation.
4. **Token Storage (Frontend):**
* **Finding:** JWT token stored in `localStorage`, susceptible to XSS.
* **Recommendation:** For higher security, consider using HttpOnly
cookies (requires backend changes to set/read cookies). If `localStorage`
must be used, ensure strict XSS prevention measures across the frontend.
5. **Potentially Committed `.env` Files:**
* **Finding:** `.env` files were readable, implying they might be
committed to version control.
* **Recommendation:** Ensure `.env` files containing secrets are listed
in `.gitignore`. Provide `.env.example` files with placeholders for developers.
6. **Error Message Exposure (Frontend):**
* **Finding:** Backend error messages are directly shown in frontend
`alert()`s.
* **Recommendation:** Frontend should display generic, user-friendly
error messages and log detailed errors for developers.
### II. Code Structure & Maintainability:
1. **Monolithic Backend (`backend/server.py`):**
* **Finding:** A single file contains all backend logic (models, routes,
services, WebSocket).
* **Recommendation:** Modularize the backend. Create separate
directories/files for `routers` (e.g., `auth_router.py`, `schedule_router.py`),
`models.py`, `services.py` (for business logic like notification creation),
`websocket_manager.py`, and `security.py` (for JWT, password hashing).
2. **Monolithic Frontend (`frontend/src/App.js`):**
* **Finding:** A single React component (`App.js`) handles all frontend
logic, views, and state.
* **Recommendation:** Decompose `App.js` into smaller, manageable
components (e.g., `AuthForm`, `ScheduleForm`, `DashboardView`,
`ScheduleList`, `NotificationItem`, `Header`, `Navigation`). Use props and
potentially React Context or a state management library (Zustand, Redux)
for state sharing.
3. **Unused Models (Backend):**
* **Finding:** `AttendanceRecord` and `HomeworkReminder` models are
defined but not used.
* **Recommendation:** Remove if not planned for near-future
implementation, or implement the features.
4. **Unused Dependency (Frontend):**
* **Finding:** `react-router-dom` is a dependency but not used for
routing.
* **Recommendation:** Either remove the dependency or implement
client-side routing using it, which would also help in componentizing views.
5. **Dependency Management (Backend):**
* **Finding:** `requirements.txt` might not pin transitive dependencies.
Redundant `bcrypt` (covered by `passlib[bcrypt]`) and potentially `python-
jose` vs `pyjwt`.
* **Recommendation:** Use `pip freeze > requirements.txt` for full
pinning or adopt a tool like Poetry/PDM. Consolidate JWT libraries if possible.
### III. Performance:
1. **Data Fetching Limits (Backend):**
* **Finding:** `to_list(1000)` in `get_schedules` and
`notification_sender` could be an issue with large datasets.
* **Recommendation:** Implement pagination for `get_schedules`
endpoint and process notifications in smaller batches if necessary.
2. **Frontend Data Sync:**
* **Finding:** Frontend refetches all schedules after CUD operations.
* **Recommendation:** For large datasets, consider optimistic updates
or updating local state based on API responses to avoid full refetches.
(Current approach is acceptable for small scale).
### IV. User Experience (UX):
1. **Alerts and Confirms (Frontend):**
* **Finding:** Uses browser `alert()` and `window.confirm()`.
* **Recommendation:** Replace with more integrated UI elements like
modals or toast notifications for a smoother experience.
2. **Automatic Login After Registration (Frontend):**
* **Finding:** User must manually log in after registering.
* **Recommendation:** Automatically log in the user and redirect them
to the dashboard after successful registration.
3. **Accessibility (Frontend):**
* **Finding:** Forms might lack explicit labels for inputs (relying on
placeholders).
* **Recommendation:** Ensure all form inputs have associated `<label>`
elements or appropriate ARIA attributes for better accessibility.
### V. Best Practices & Other:
1. **Configuration Values (Backend):**
* **Finding:** Notification intervals (1hr, 45min, etc.) and lecture
notification window (4 weeks) are hardcoded.
`ACCESS_TOKEN_EXPIRE_MINUTES` is long (30 days).
* **Recommendation:** Make these configurable if flexibility is needed.
Consider shorter access token lifespans and implementing refresh tokens if
long-lived sessions are critical.
2. **Testing Structure:**
* **Finding:** `backend_test.py` in root, `tests/` directory also exists.
* **Recommendation:** Consolidate backend tests, perhaps under
`backend/tests/`. Expand test coverage.
3. **React Version (Frontend):**
* **Finding:** Uses React 19 (bleeding edge).
* **Recommendation:** Be aware of potential compatibility issues with
older libraries or less mature tooling. Ensure thorough testing.
4. **WebSocket Echo (Backend):**
* **Finding:** WebSocket endpoint echoes back any client message.
* **Recommendation:** Remove this echo behavior if not used for a
specific purpose, as the frontend doesn't send application messages.
## Code Quality Overview:
* The code demonstrates understanding of FastAPI and React fundamentals.
* Pydantic models in the backend and `useEffect`/`useState` in the
frontend are used correctly within their current scope.
* The primary weakness is the monolithic structure of both backend and
frontend, which will hinder scalability and maintainability.
* Security configurations need tightening.
By addressing these recommendations, the application can become more
secure, robust, maintainable, and user-friendly. The highest priorities should
be security improvements (JWT secret, CORS, WebSocket auth) and code
modularization.
