Authentication and security
| Limitation | Impact | Priority |
|---|---|---|
| No multi-factor authentication (MFA) | Account compromise gives full access | High |
| No account lockout | Brute-force attacks possible | High |
| No CSP headers | XSS risk if React escaping is bypassed | Medium |
| No database-level RLS | A service-layer bug could leak cross-client data | Medium |
| No automated vulnerability scanning | Known CVEs may go unnoticed | Medium |
| No session rotation | Long-lived sessions widen the hijacking window | Low |
| No auth-event audit records | Login/logout failures are not in the audit trail | Low |
Entitlement engine
| Limitation | Impact | Priority |
|---|---|---|
| Single replacement cycle per rule set | No separate initial vs replacement quantities beyond the phase field on rule items | Medium |
| No provisional entitlements | Cannot grant temporary or exception-based entitlements | Low |
| No entitlement history view | Period consumption is auditable per order item but has no dedicated history screen | Low |
Orders
| Limitation | Impact | Priority |
|---|---|---|
| No estimated delivery dates | Users cannot see expected delivery | Medium |
| No shipment tracking | No courier integration | Medium |
| No partial fulfilment | Cannot ship part of an order | Low |
| No order templates | Common order configurations cannot be saved and reused | Low |
| No CSV/batch order creation | Bulk ordering is limited to the multi-employee cart | Low |
Notifications
| Limitation | Impact | Priority |
|---|---|---|
| No push or SMS channels | In-app and email only; WhatsApp reserved in schema | Medium |
| No notification preferences | Users cannot opt out of notification types | Low |
| No email retry on failure | Failed sends are recorded in EmailLog but not retried | Low |
| No delivery-status webhooks | Delivery cannot be confirmed beyond provider logs | Low |
Reports
| Limitation | Impact | Priority |
|---|---|---|
| No scheduled reports | Users trigger report generation manually | Medium |
| No historical trend analysis | Reports show current state, not comparisons over time | Medium |
| No custom report builder | Fixed report types only | Low |
| Client-side CSV generation | Very large datasets are limited by browser memory | Low |
Infrastructure
| Limitation | Impact | Priority |
|---|---|---|
| No CI workflow wiring | Tests run locally; no automated PR gates | High |
| No uptime monitoring or error tracking | Downtime and errors surface only via dashboards | High |
| Backend deploys are manual | render.yaml sets autoDeploy: false by design | Accepted |
| No log persistence | Render logs retained roughly 7 days | Medium |
| Render cold starts | 30 to 60 second wake-up after 15 minutes idle | Medium |
Data management
| Limitation | Impact | Priority |
|---|---|---|
| Mixed delete semantics | Domain records use active soft-delete flags; permanent delete removes rows outright, including dependent data | Medium |
| No data archival | Historical data accumulates without cleanup | Low |
| No GDPR-style data export | Cannot export all data for one employee | Low |
| No audit-log retention policy | Audit records grow indefinitely | Low |
Technical debt
| Debt | Location | Impact |
|---|---|---|
Legacy Role.EMPLOYEE self-service path | Backend auth/entitlement code, Employee.userId relation | Scheduled for removal in Phase 11.9; must not be built upon |
Test mocks typed as any | Backend *.spec.ts files | Production code unaffected; typed mocks deferred |
| Frontend types manually maintained | frontend/src/lib/domain-types.ts, lib/types.ts | Can drift from backend DTOs |
| No shared type package | Backend/frontend boundary | Type duplication |
| Playwright combined-run flake | Multi-spec runs can hang on server reuse | Runner issue, not a source defect |