Codebase TODO Audit
This document catalogs all TODO, FIXME, HACK, NOTE, and unimplemented code in the Broadford Living codebase, organized by priority and category.
Last Updated: January 2026
Executive Summary
| Priority | Backend | Frontend | Total |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 2 | 3 |
| Informational | 5 | 1 | 6 |
Medium Priority
1. Apple Push Notification Entitlement
File: crates/bf_user/src/fcm.rs:459,464
// TODO: Change to ApnsSound::Critical once entitlement is approved
sound: Some(ApnsSound::Simple("alarm.caf".to_string())),
...
// TODO: Change to "critical" once Apple approves the entitlement
interruption_level: Some("time-sensitive".to_string()),
Context: iOS push notification payload for critical alerts (alarms, security events).
Impact: Critical alerts use "time-sensitive" interruption level instead of "critical". This means:
- Alerts don't bypass Do Not Disturb as aggressively
- No haptic feedback for critical alerts
Status: Waiting for Apple to approve Critical Alerts entitlement.
Workaround: Using "time-sensitive" which still bypasses notification summary and scheduled delivery.
2. Activity Timeline User Lookup
File: apps/web/src/lib/components/ActivityTimeline.svelte:32
// TODO: Once users endpoint is available, lookup user names
// For now, displaying user IDs directly
Impact: Activity logs display raw user IDs/emails instead of friendly names.
Recommendation: Add users endpoint and implement name resolution for better readability.
3. Floor Plan Upload Delay
File: apps/web/src/api/floorPlans.ts:308
// FUT-TODO
// improve this upload L
await new Promise((resolve) => setTimeout(resolve, 2000));
Impact: Hardcoded 2-second delay after file upload. Poor UX and unnecessary wait time.
Recommendation: Replace with proper upload status polling or progress tracking.
Informational Notes
These are architectural notes and documented limitations, not action items.
1. Notification System Architecture Change
File: crates/bf_notify/src/lib.rs:80
// NOTE: Scheduled cron jobs have been removed.
// Energy aggregation, backups, and device refresh are now handled by each
// property's Durable Object using the alarm API for distributed scheduling.
// See bf_user::scheduling module for details.
//
// Manual trigger endpoints are retained for admin testing:
// - POST /admin/trigger/energy-aggregation
// - POST /admin/trigger/backup
// - POST /admin/trigger/status-check
Context: Documents architectural shift from centralized cron jobs to distributed DO alarm scheduling.
2. Seeding Limitations in Staging/Production
File: crates/bf_types/src/resident/seed.rs:34
/// NOTE: This will fail with 522 in staging/production due to Worker self-call limits
/// Use Setup + service endpoints from Python instead
Full,
Context: SeedScope::Full enum variant documentation.
Implication: Full database seeding must use the Python orchestrator in non-local environments.
3. Document Storage Path Assumption
File: crates/bf_resident/src/handlers/properties.rs:77
// NOTE: this requires we have the documents initial folder structure ...
// URL format: S3_ENDPOINT/BUCKET_NAME/documents/library/{portfolio_id}/{file_id}?...
Implication: Code assumes specific S3 bucket folder structure. Changes to bucket organization could break document retrieval.
4. Mock Behavior Difference
File: crates/bf_resident/src/handlers/it_setup/handlers.rs:2506
// NOTE this is not what it should be, but it is ok for mock
if is_not_applicable_device_type_for_st(device_type) {
Context: Device external ID setup during IT provisioning.
Implication: Mock mode behavior differs from production for SmartThings device mapping.
5. OTA CSP Hash Non-Exhaustive Enum
File: crates/bf_mobile/src/ota.rs:208
let csp_hashes: Vec<RuntimeCspHash> = value
.csp_hashes(&asset_key)
.map(|hash| match hash {
CspHash::Script(x) => RuntimeCspHash::Script(x.to_owned()),
CspHash::Style(x) => RuntimeCspHash::Style(x.to_owned()),
_ => unimplemented!(),
})
Context: The CspHash enum is non-exhaustive, requiring the wildcard arm for compilation. Only Script and Style variants are used in practice.
Implication: The unimplemented!() arm should never be reached in the current codebase. If the upstream library adds new variants that are actually emitted, this would panic.
6. Settings Profile Update
File: apps/web/src/lib/pages/Settings.svelte:17
/** This whole page is for the future can remove now */
function handleSaveProfile() {
// TODO: Implement profile update via Clerk
console.log("Update profile:", { name, email });
}
Context: The Settings page component is not currently used in the app. It is retained in the codebase as a reference for future implementation.
Implication: No user-facing impact. When this page is activated, Clerk profile update integration will need to be implemented.
Summary by Location
Backend (crates)
| Crate | Count | Items |
|---|---|---|
| bf_user | 1 | FCM entitlements |
| bf_mobile | 1 | OTA CSP hash note |
| bf_notify | 1 | Architecture note |
| bf_types | 1 | Seeding limitations |
| bf_resident | 2 | Document storage note, mock behavior note |
Frontend (apps)
| App | Count | Items |
|---|---|---|
| apps/web | 3 | Activity timeline, floor plan upload, settings (unused) |
Recommendations
Backlog
- Apply for Apple critical alerts entitlement (external dependency)
- Add users endpoint for activity timeline name lookup
- Improve floor plan upload flow