Modules/service.js (1)

17-28: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract the duplicated transporter setup into a shared helper.

The identical nodemailer.createTransport({ host, port, secure, auth, tls }) block is copied across SendEmail, SendNotificationEmail, and sendAttachMail. Consolidating into a single factory removes the three-way drift risk and makes fixes (e.g., the TLS change above) apply in one place.

♻️ Example helper

const createTransporter = () => nodemailer.createTransport({
    host: config.NODEMAILER_HOST,
    port: config.NODEMAILER_PORT,
    secure: config.NODEMAILER_PORT == 465,
    auth: {
        user: config.NODEMAILER_EMAIL,
        pass: config.NODEMAILER_EMAIL_PASSWORD,
    },
});

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Modules/service.js` around lines 17 - 28, The transporter setup is duplicated
in SendEmail, SendNotificationEmail, and sendAttachMail, so extract the repeated
nodemailer.createTransport configuration into a shared helper such as
createTransporter. Update each mail-sending function to call that helper instead
of inlining host/port/secure/auth/tls, and keep the transport configuration in
one place so future changes like TLS behavior only need to be made once.

frontend/src/components/organisms/LiveWorkCard/LiveWorkCard.vue (1)

116-117: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Swallowed fetch error — no logging.

Unlike sibling cards' catch blocks (e.g., ActiveWorkTableCard.vue Line 115), errors here are dropped silently with no console.error, making failures harder to diagnose.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/components/organisms/LiveWorkCard/LiveWorkCard.vue` around lines
116 - 117, The LiveWorkCard fetch error is being swallowed in the catch block
with no diagnostics. Update the catch in LiveWorkCard.vue to log the caught
exception with console.error before resetting data.value, following the pattern
used by sibling components such as ActiveWorkTableCard so failures can be
diagnosed.

frontend/src/components/organisms/ActiveWorkTableCard/ActiveWorkTableCard.vue (2)

89-92: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated taskMatch-building IIFE.

This exact IIFE (flatten filterData then buildFilterQuery) is repeated verbatim in FreeResourcesCard, TeamLoggedVsEtaCard, and WorkedTasksTableCard. Consider extracting a buildTaskMatch(filterData, userId) helper into useResourceWorkload.js to avoid drift between copies.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@frontend/src/components/organisms/ActiveWorkTableCard/ActiveWorkTableCard.vue`
around lines 89 - 92, The taskMatch IIFE in ActiveWorkTableCard duplicates the
same flatten-and-build logic used in FreeResourcesCard, TeamLoggedVsEtaCard, and
WorkedTasksTableCard. Extract that repeated logic into a shared
buildTaskMatch(filterData, userId) helper in useResourceWorkload.js, then
replace the inline IIFE in this component with a call to the helper so all cards
stay consistent.

---

74-120: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

No request sequencing guard against concurrent load() calls.

refreshTrigger, cardData (deep), and filterData (deep) each independently trigger load(). If two calls overlap, responses can resolve out of order and the older response can overwrite rows after the newer one, leaving stale data displayed until the next refresh.

♻️ Suggested fix — sequence token

+let requestSeq = 0;
 const load = async () => {
+    const seq = ++requestSeq;
     loading.value = true;
     try {
         ...
-        rows.value = flat;
+        if (seq === requestSeq) rows.value = flat;
     } catch (e) {
         console.error('ActiveWorkTableCard fetch error:', e);
-        rows.value = [];
+        if (seq === requestSeq) rows.value = [];
     } finally {
-        loading.value = false;
+        if (seq === requestSeq) loading.value = false;
     }
 };

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@frontend/src/components/organisms/ActiveWorkTableCard/ActiveWorkTableCard.vue`
around lines 74 - 120, The load() flow in ActiveWorkTableCard.vue has no
sequencing protection, so overlapping refreshTrigger/cardData/filterData-driven
requests can resolve out of order and overwrite newer rows with stale data. Add
a request sequence/token guard inside load() so each invocation captures its own
id and only the latest successful response is allowed to assign rows.value,
while older in-flight responses are ignored even in the finally loading reset
path.

frontend/src/components/organisms/WorkedTasksTableCard/WorkedTasksTableCard.vue (1)

73-76: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

PERIOD_LABELS duplicated with TeamLoggedVsEtaCard.vue.

Identical object literal (Lines 73-76 here vs. TeamLoggedVsEtaCard.vue Lines 101) — extract to a shared constant (e.g. in commonFunction.js or useResourceWorkload.js) to keep the two in sync.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@frontend/src/components/organisms/WorkedTasksTableCard/WorkedTasksTableCard.vue`
around lines 73 - 76, The PERIOD_LABELS object is duplicated in
WorkedTasksTableCard and TeamLoggedVsEtaCard, so move this shared mapping to a
common location such as commonFunction.js or useResourceWorkload.js and update
both components to import and use the same constant. Keep the existing
PERIOD_LABELS symbol name or a similarly clear shared export so both views stay
in sync from one source of truth.

frontend/src/components/organisms/ProjectMetricsCard/ProjectMetricsCard.vue (1)

66-69: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Hardcoded English labels bypass i18n.

TYPE_LABELS values ("Fixed", "Hourly", "In House", "Retainer", "Unspecified") are hardcoded strings rendered directly, unlike other labels in this file that use $t(...). These won't be translated for non-English locales.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/components/organisms/ProjectMetricsCard/ProjectMetricsCard.vue`
around lines 66 - 69, The TYPE_LABELS mapping in ProjectMetricsCard is using
hardcoded English display values, which bypasses the existing i18n flow. Update
the label resolution used by ProjectMetricsCard so the displayed type names come
from $t(...) or equivalent translation keys instead of literal strings, and make
sure every entry referenced by the component (such as Fix, Hourly, InHouse,
Retainer, and Unspecified) is localized consistently with the other labels in
this file.

frontend/src/components/organisms/TeamCategoryBreakdownCard/TeamCategoryBreakdownCard.vue (1)

122-125: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Three independent watchers can race on load().

refreshTrigger, deep cardData, and deep filterData watches each call load() without cancelling in-flight requests. Rapid successive changes (e.g., toggling the dimension select then changing a filter) can let a stale response overwrite fresher data.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@frontend/src/components/organisms/TeamCategoryBreakdownCard/TeamCategoryBreakdownCard.vue`
around lines 122 - 125, Three separate watchers in TeamCategoryBreakdownCard are
triggering load() concurrently and can let stale responses win. Update the load
flow in TeamCategoryBreakdownCard.vue so refreshTrigger, cardData, and
filterData changes do not start overlapping requests without protection; for
example, add request cancellation or a sequence guard inside load() and keep the
existing watch/onMounted hooks calling that guarded loader. Make sure the latest
invocation of load() is the only one allowed to update the component state.

frontend/src/components/organisms/ProjectPulseCard/ProjectPulseCard.vue (3)

116-138: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

No guard against out-of-order responses across concurrent watchers.

refreshTrigger and a deep watch on cardData both invoke load() independently with no request sequencing/abort. Rapid consecutive triggers (e.g., quick period changes) can let an older response overwrite a newer one.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/components/organisms/ProjectPulseCard/ProjectPulseCard.vue`
around lines 116 - 138, The load flow in ProjectPulseCard.vue can apply stale
data because refreshTrigger and the deep watch on props.cardData both call
load() without any sequencing or cancellation. Update the load function and its
callers so only the latest request can commit state, using a request
token/version or AbortController-style guard around apiRequest and the
data.value assignment. Keep the check tied to the existing load, watch, and
onMounted hooks so older responses are ignored if a newer load starts first.

---

62-66: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Duplicate hardcoded PERIOD_LABELS object, not localized.

The same PERIOD_LABELS map is duplicated verbatim in TeamCategoryBreakdownCard.vue, and its values are plain English strings not routed through $t(...) like other labels in this file.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/components/organisms/ProjectPulseCard/ProjectPulseCard.vue`
around lines 62 - 66, The PERIOD_LABELS map in ProjectPulseCard is duplicated
elsewhere and uses hardcoded English strings instead of localization. Replace
the local hardcoded PERIOD_LABELS/periodLabel lookup with the shared source used
by TeamCategoryBreakdownCard, and route each label through $t(...) so the
timerange labels are translated consistently with the rest of the component.

---

69-114: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Reuse the shared date-range helper here. ProjectPulseCard.vue duplicates the timerange→ISO mapping that useResourceWorkload.resolveIsoRange already centralizes. Pulling from the shared composable keeps the range IDs in one place and avoids drift if the semantics change later.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/components/organisms/ProjectPulseCard/ProjectPulseCard.vue`
around lines 69 - 114, The date range conversion in resolveDateRange is
duplicating logic that already exists in useResourceWorkload.resolveIsoRange.
Replace the local switch-based mapping in ProjectPulseCard.vue with the shared
helper so the range IDs and ISO date semantics stay centralized and consistent.
Keep the component using resolveDateRange only as a thin adapter, or remove it
entirely if the composable can be called directly from the existing code path.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Modules/service.js (1)

5-8: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Centralize the SMTP transport config.

The same security-sensitive Nodemailer config is duplicated in all three helpers. Extract it once and rename the module-level flag to UPPER_SNAKE_CASE while touching this code.

As per coding guidelines, **/*.{js,ts,vue}: “Use UPPER_SNAKE_CASE for constant values.”

♻️ Proposed refactor

-const allowSelfSigned = String(process.env.NODEMAILER_ALLOW_SELF_SIGNED || "").toLowerCase() === "true";
+const ALLOW_SELF_SIGNED = String(process.env.NODEMAILER_ALLOW_SELF_SIGNED || "").toLowerCase() === "true";
+
+const createMailerTransport = () => nodemailer.createTransport({
+    host: config.NODEMAILER_HOST,
+    port: config.NODEMAILER_PORT,
+    secure: config.NODEMAILER_PORT == 465,
+    auth: {
+        user: config.NODEMAILER_EMAIL,
+        pass: config.NODEMAILER_EMAIL_PASSWORD,
+    },
+    tls: {
+        rejectUnauthorized: !ALLOW_SELF_SIGNED
+    }
+});

Then replace each duplicated nodemailer.createTransport({...}) block with:

-let transporter = nodemailer.createTransport({
-    ...
-});
+const transporter = createMailerTransport();

Also applies to: 22-33, 73-84, 123-134

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Modules/service.js` around lines 5 - 8, The SMTP transport setup is
duplicated across the three Nodemailer helpers, and the module-level opt-in flag
should follow the constant naming rule. Centralize the shared security-sensitive
transport configuration into one reusable module-level object or factory used by
the helper functions, and rename allowSelfSigned to UPPER_SNAKE_CASE while
keeping the same NODEMAILER_ALLOW_SELF_SIGNED behavior. Update the Nodemailer
helper entry points that currently build transport inline to consume the shared
config instead of repeating nodemailer.createTransport calls.

Source: Coding guidelines