📋 Daily Codebase Review - 2025-12-11

[claude]

Executive Summary

The Sobriety Waypoint codebase is in good health overall, demonstrating strong security practices, comprehensive test coverage, and well-organized architecture. However, there are significant opportunities for improvement in code organization (large file refactoring) and test coverage (error paths).

Health Score: B+

Justification: The codebase has excellent security practices (no hardcoded secrets, comprehensive PII scrubbing, parameterized queries), good test infrastructure meeting 80% coverage thresholds, and clean architecture. Points deducted for significant code duplication (~3,200 lines between settings files), some skipped tests, and incomplete error path coverage.

---

Top 5 Priority Items

#	Issue	Severity	Effort	Impact
1	Critical Code Duplication - settings.tsx (1,591 lines) and SettingsSheet.tsx (1,653 lines) are nearly identical	HIGH	Medium	Maintenance nightmare - bugs must be fixed twice
2	Skipped Tests - 3 test suites are skipped due to mock issues (onboarding, AppleSignInButton)	MEDIUM	Low	Test coverage gaps for critical auth flows
3	Analytics Strategy Decision - @todo in lib/analytics/platform.web.ts needs product decision	MEDIUM	Low	Blocks proper analytics implementation
4	Platform Alert Pattern Duplication - Same web/native alert code repeated in 15+ files	MEDIUM	Medium	DRY violation, inconsistent UX risk
5	Large Files Need Refactoring - 8 files over 300 lines (largest: 1,653 lines)	LOW	High	Code maintainability and readability

---

Detailed Findings by Category

1. Code Health & Technical Debt

Large Files (Over 300 lines)

File	Lines	Issue
components/SettingsSheet.tsx	1,653	Multiple responsibilities (account, theme, updates, deletion)
app/settings.tsx	1,591	DUPLICATE of SettingsSheet.tsx
app/(tabs)/tasks.tsx	1,308	Combines sponsee and sponsor views
app/(tabs)/profile.tsx	1,230	Relationship mgmt + sobriety tracking mixed
components/TaskCreationSheet.tsx	770	Complex state management
app/(tabs)/manage-tasks.tsx	733	Similar to tasks.tsx manage view
app/onboarding.tsx	727	Multi-step flow in single file
lib/analytics/platform.web.ts	678	Firebase + Vercel analytics

TODO/FIXME Comments Needing Attention

1. lib/analytics/platform.web.ts:9 - Product decision required for analytics strategy (Firebase vs Vercel vs both)
2. __tests__/components/auth/AppleSignInButton.test.tsx:1274 - Skipped tests due to async flow issues
3. __tests__/components/auth/AppleSignInButton.test.tsx:1324 - Skipped tests due to async flow issues
4. __tests__/app/onboarding.test.tsx:639 - Skipped test due to mock upsert issue

Code Duplication

• Critical: settings.tsx ↔ SettingsSheet.tsx (~3,200 combined lines)
• High: Platform-specific alert pattern repeated in 15+ files
• Medium: Task deletion confirmation logic duplicated

2. Security Audit

Overall Rating: EXCELLENT ✓

Category	Status
Hardcoded Secrets	✓ PASS - None found
SQL Injection	✓ PASS - All queries parameterized via Supabase
XSS/Dangerous Patterns	✓ PASS - No eval(), dangerouslySetInnerHTML, innerHTML
Input Validation	✓ PASS - Comprehensive validation in lib/validation.ts
Authentication	✓ PASS - Secure OAuth 2.0, proper token handling
PII Handling	✓ PASS - Comprehensive Sentry privacy scrubbing
Environment Config	✓ PASS - Proper .gitignore, .env.example documented

No security vulnerabilities found.

3. Test Coverage Gaps

Current Coverage: ~80% statements, ~60-70% branches

Missing Test Coverage

• Error Handling: Most tests only cover happy paths; Supabase error responses rarely tested
• Form Validation Edge Cases: XSS attempts, unicode, very long strings
• Offline Behavior: No tests simulate offline mode
• Race Conditions: No tests for rapid interactions, concurrent mutations

Skipped Tests (3 suites)

1. onboarding.test.tsx:639 - Profile update error test
2. AppleSignInButton.test.tsx:1274 - Analytics tracking edge cases
3. AppleSignInButton.test.tsx:1324 - Profile update edge cases

4. Documentation Freshness

Status: GOOD ✓

• README.md - Accurate and comprehensive
• CLAUDE.md - Detailed development guidelines (43KB)
• docs/ - Setup guides for Apple Sign In, Google OAuth, Logger

5. Dependency Health

Status: GOOD ✓

All major dependencies are current and actively maintained:

• expo ~54.0.27 ✓
• react 19.1.0 ✓
• @supabase/supabase-js ^2.86.0 ✓
• @sentry/react-native 7.2.0 ✓
• typescript ~5.9.2 ✓

6. Performance Opportunities

• Large Bundle Size Risk: Some files (SettingsSheet, tasks) are very large
• Client-side Aggregation: Task statistics calculated client-side in profile.tsx
• No Performance Tests: Bundle size and render performance not measured

7. Code Consistency

Status: GOOD ✓

• ESLint no-console enforced globally
• Prettier formatting consistent
• Path aliases (@/) used consistently
• TypeScript strict mode enabled
• No any types found in production code (only in test mocks)

---

Recommendations

Immediate Actions

1. Consolidate settings.tsx and SettingsSheet.tsx
2. Fix the 3 skipped tests
3. Make analytics strategy decision

Short-Term (Next Sprint)

4. Create showAlert() utility to replace duplicated alert pattern
5. Add error path tests for Supabase operations
6. Split tasks.tsx into separate view components

Long-Term

7. Refactor remaining large files
8. Add E2E tests with Maestro
9. Add performance benchmarks

---

Individual Issues Created

See linked issues below for specific action items.

---

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com

[coderabbitai]

🔗 Similar Issues

Possible Duplicates

• ISSUE-119

Related Issues

• VolvoxCommunity/Sobriety-Waypoint#119
• VolvoxCommunity/Sobriety-Waypoint#112
• VolvoxCommunity/Sobriety-Waypoint#123
• VolvoxCommunity/Sobriety-Waypoint#114
• VolvoxCommunity/Sobriety-Waypoint#113

🔗 Related PRs

#48 - New Onboarding Screens [merged]
VolvoxCommunity/Volvox.Website#44 - feat(seo): comprehensive SEO implementation [merged]
#58 - Fix Sobriety Counter to use users local datetime [merged]
#60 - fix(auth): resolve iOS Google Sign-In infinite loading screen [merged]
#116 - feat(onboarding): replace first_name/last_initial with display_name and improve profile creation [merged]

👤 Suggested Assignees

• claude
• BillChirico

---

Enable issue planning

_{To enable issue planning, add the following to your .coderabbit.yaml:}

issue_enrichment:
  planning:
    enabled: true

_{You can then request a plan by commenting @coderabbitai plan on any issue.}

🧪 Issue enrichment is currently in early access.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

[BillChirico]

Findings from this review have been addressed in recent commits.