Flexomatic81
fe305f6fc8
Full enterprise web operating system including: - Next.js 14 frontend with App Router, i18n (DE/EN), shadcn/ui - NestJS 10 backend with Prisma, JWT auth, Swagger docs - Keycloak 24 SSO with role-based access control - HR module (employees, time tracking, absences, org chart) - LEAN module (3S planning, morning meeting SQCDM, skill matrix) - Integrations module (PlentyONE, Zulip, Todoist, FreeScout, Nextcloud, ecoDMS, GembaDocs) - Dashboard with customizable drag & drop widget grid - Docker Compose infrastructure (PostgreSQL 16, Redis 7, Keycloak 24) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
3.7 KiB
3.7 KiB
Phase 7 - Full Backend Code Review (2026-02-06)
Overall Score: 7.8/10
Module Scores
| Module | Score | Key Issue |
|---|---|---|
| Auth (guards, strategy, decorators) | 8/10 | Role names leaked in error messages |
| Prisma (service, module) | 7/10 | cleanDatabase() ignores FK constraints |
| HR/Employees | 8/10 | as any type casts for encrypted data |
| HR/Time Tracking | 7/10 | Break tracking via string parsing, private method access |
| HR/Absences | 8/10 | Missing holiday calc, vacation carry-over TODO |
| LEAN/Skill Matrix | 8/10 | N+1 in analyzeGaps, non-transactional bulkUpsert |
| LEAN/Morning Meeting | 7/10 | ALL endpoints use DASHBOARD_VIEW permission |
| LEAN/S3 Planning | 8/10 | File upload MIME not validated, N+1 in findAll |
| Dashboard | 8/10 | Hardcoded role strings |
| Common (filters, interceptors) | 8/10 | Logging/Timeout interceptors never registered |
| Users | 8/10 | GET /users has no permission restriction |
| Audit | 7/10 | oldData always undefined, salary not sanitized |
| app.module + main.ts | 9/10 | enableImplicitConversion risk |
Critical Issues (3)
1. Morning Meeting Permission Escalation
- File:
apps/api/src/modules/lean/morning-meeting/morning-meeting.controller.ts - Lines: 47, 59, 66, 79, 99, 120, 149, 159, 170, 183, 193, 211, 221, 234, 249, 259, 270
- Issue: ALL endpoints (including create, update, delete) use
Permission.DASHBOARD_VIEW - Impact: Any authenticated user with dashboard access can create/modify/delete morning meetings
2. Private Method Access via Bracket Notation
- File:
apps/api/src/modules/hr/time-tracking/time-tracking.controller.ts - Lines: 237-239
- Issue:
this.timeTrackingService['getEmployeeByUserId'](user.sub)accesses private method - Impact: Circumvents TypeScript access modifiers, fragile to refactoring
3. Prisma cleanDatabase() with Promise.all
- File:
apps/api/src/prisma/prisma.service.ts - Lines: 48-61
- Issue: Deletes all tables in parallel ignoring foreign key constraints
- Impact: Can fail in production/staging if FK constraints exist; should use sequential deletion or raw SQL truncate cascade
Important Issues (14)
- Roles guard leaks role names - roles.guard.ts L31-33
- Permissions guard leaks permission names - permissions.guard.ts
- enableImplicitConversion in ValidationPipe - main.ts L44
- Break tracking via note string parsing - time-tracking.service.ts L216-219, L257-258
- No backdating limit for manual time entries
- Holiday calculation missing in absences calculateWorkingDays
- Vacation carry-over not implemented - absences.service.ts L979 (BUrlG)
- Event queue in-memory only - absences.service.ts L1414
- N+1 query in analyzeGaps - skill-entries.service.ts L515-523
- bulkUpsert not transactional - skill-entries.service.ts L429-476
- File upload MIME not validated - s3-planning.controller.ts
- LoggingInterceptor + TimeoutInterceptor never registered
- GET /users no permission check - users.controller.ts L88-97
- Audit oldData always undefined - audit.interceptor.ts L60
Positive Observations
- JWT verification (not just decode) with user existence check on every request
- AES-256-GCM encryption for sensitive employee data (salary, bank account)
- Consistent error response format via global HttpExceptionFilter
- Response envelope pattern via TransformInterceptor
- ArbZG break rules correctly implemented in time tracking
- Comprehensive absence workflow with approval chain
- Global ValidationPipe with whitelist + forbidNonWhitelisted
- Proper soft delete patterns for employees
- Well-structured module hierarchy (HrModule -> sub-modules)
- Swagger/OpenAPI documentation on all endpoints