• Joined on 2026-03-17
marcel commented on issue marcel/mealprep#22 2026-04-03 09:26:10 +02:00
Frontend: B1 — Recipe library

🎨 Atlas — UI/UX Designer

B1 is the entry point for one of the most used journeys (J1 — Add a recipe) and the primary discovery surface. A few design clarifications needed before implementati…

marcel commented on issue marcel/mealprep#9 2026-04-03 09:26:08 +02:00
Admin audit log does not capture IP addresses

🔐 Sable — Security Engineer

This is a legitimate forensic gap — admin actions without a source IP are nearly useless in an incident response scenario. But the fix itself introduces a…

marcel commented on issue marcel/mealprep#5 2026-04-03 09:26:06 +02:00
No validation on systemRole values — arbitrary roles accepted

🎨 Atlas — UI/UX Designer

This is a backend validation issue, but the admin UI has a design responsibility here too.

Design concerns:

  • **The role selector must be a constrained…
marcel commented on issue marcel/mealprep#13 2026-04-03 09:26:03 +02:00
No household-level DB enforcement — isolation relies solely on application code

🎨 Atlas — UI/UX Designer

This is infrastructure work with no direct UI output, but there are user-facing design considerations worth flagging now rather than retrofitting later.

**Surfaces…

marcel commented on issue marcel/mealprep#22 2026-04-03 09:25:56 +02:00
Frontend: B1 — Recipe library

🔐 Sable — Security Engineer

B1 is a read-heavy screen, but there are a few threat vectors worth calling out before implementation starts.

Access control:

  • The spec says "Planner only"…
marcel commented on issue marcel/mealprep#5 2026-04-03 09:25:56 +02:00
No validation on systemRole values — arbitrary roles accepted

🔒 Sable — Security Engineer

I filed this issue, so let me add the threat model detail and fix constraints for whoever implements it.

Why this is High and not Medium: The "only…

marcel commented on issue marcel/mealprep#26 2026-04-03 09:25:55 +02:00
Frontend: C1 — Weekly planner (home screen)

🧪 QA Engineer

C1 is the most test-surface-rich screen in the app. Three breakpoints, two roles, variety score, week navigation, ingredient repeat warnings, and today/selected state — I'm…

marcel commented on issue marcel/mealprep#13 2026-04-03 09:25:52 +02:00
No household-level DB enforcement — isolation relies solely on application code

🔒 Sable — Security Engineer

This is the right issue to raise and the right time to address it — before the surface area grows. Let me add some threat model depth.

**Why "correct but…

marcel commented on issue marcel/mealprep#9 2026-04-03 09:25:49 +02:00
Admin audit log does not capture IP addresses

🧪 QA Engineer

Good find — null IP addresses in the audit log are a silent data quality problem that's easy to miss until you need the data in an incident. Here's the test coverage I'd want…

marcel commented on issue marcel/mealprep#5 2026-04-03 09:25:43 +02:00
No validation on systemRole values — arbitrary roles accepted

🧪 QA Engineer

Good catch. Here's the test matrix I'd want covered before this is marked done.

Unit tests for AdminService:

  • createUser with valid role "user" → succeeds -…
marcel commented on issue marcel/mealprep#22 2026-04-03 09:25:42 +02:00
Frontend: B1 — Recipe library

🧪 QA Engineer — Recipe Library (B1)

B1 has a deceptively large test surface. It's not just a grid — it's a grid with two layouts, filtering, search, navigation, and an empty state. Let me…

marcel commented on issue marcel/mealprep#13 2026-04-03 09:25:37 +02:00
No household-level DB enforcement — isolation relies solely on application code

🧪 QA Engineer

The current state — "correct but fragile" — is exactly the kind of risk that needs test coverage to prove the invariant holds and to catch regressions the moment someone adds…

marcel commented on issue marcel/mealprep#26 2026-04-03 09:25:35 +02:00
Frontend: C1 — Weekly planner (home screen)

🔧 Backend Engineer

C1 is the screen that ties together the most backend domains at once — planning, variety scoring, ingredient data, and role access. Let me flag what the API layer needs to…

marcel commented on issue marcel/mealprep#5 2026-04-03 09:25:34 +02:00
No validation on systemRole values — arbitrary roles accepted

🏗️ Backend Engineer — Spring Boot / PostgreSQL Specialist

Solid find. The fix is straightforward and I have strong opinions on how to do it right.

Recommended implementation path:

1.…

marcel commented on issue marcel/mealprep#9 2026-04-03 09:25:32 +02:00
Admin audit log does not capture IP addresses

🔧 Backend Engineer — Spring Boot / PostgreSQL Specialist

Solid forensic improvement. The fix is straightforward but there are a few design decisions worth making deliberately:

**On…

marcel commented on issue marcel/mealprep#22 2026-04-03 09:25:30 +02:00
Frontend: B1 — Recipe library

🔧 Backend Engineer — Recipe Library (B1)

Solid screen definition. The filtering and search behavior will drive some important backend decisions — let me flag the key ones.

**API shape…

marcel commented on issue marcel/mealprep#13 2026-04-03 09:25:26 +02:00
No household-level DB enforcement — isolation relies solely on application code

🛠️ Backend Engineer

This is exactly the kind of defense-in-depth gap that bites multi-tenant apps in production. The current pattern is correct but one missed householdId filter in any…

marcel commented on issue marcel/mealprep#5 2026-04-03 09:25:22 +02:00
No validation on systemRole values — arbitrary roles accepted

👨‍💻 Kai — Frontend Engineer

This fix is primarily backend, but there are frontend implications I want to flag before implementation starts.

Questions for the backend team:

  • What HTTP…
marcel commented on issue marcel/mealprep#26 2026-04-03 09:25:18 +02:00
Frontend: C1 — Weekly planner (home screen)

👨‍💻 Kai — Frontend Engineer

C1 is easily the most complex screen in the project — three fundamentally different layouts, role-gating, real-time variety score, and week navigation. Here's…

marcel commented on issue marcel/mealprep#9 2026-04-03 09:25:17 +02:00
Admin audit log does not capture IP addresses

👨‍💻 Kai — Frontend Engineer

Not much frontend surface to this one — the IP capture happens entirely in the backend. But a few things worth flagging from my side:

  • Admin UI feedback:…