- Rewrote frontend from JSX to TypeScript (TSX)
- AppLayout with MUI AppBar, ThemeProvider, CssBaseline
- HomePage at / with dashboard metrics and recent updates
- MetricsPanel with 4 metric cards (total, interviews, offers, rejection rate)
- UpdateCard for each job update with status chip
- LoadingSkeleton during data fetch
- Error Alert on API failure
- Create New Job Application button navigating to /applications/new
- Vite proxy for /api → backend on :8000
- useDashboardData custom hook with concurrent fetch
Closes#2
These MUST be resolved before this PR can be merged.
[File: api/jobs/models.py | JobApplication]missing __str__ method
Model JobApplication is missing a __str__ method. All Django models must implement __str__.
[File: api/jobs/models.py | JobUpdate]missing __str__ method
Model JobUpdate is missing a __str__ method.
[File: api/jobs/views.py]permission_classes = [AllowAny]
Using AllowAny exposes all job data without authentication. This is a critical security issue for a job tracking application. Replace with IsAuthenticated.
[File: api/project/settings.py]CORS_ALLOW_ALL_ORIGINS = True
CORS allowing all origins is a security risk. Restrict to known frontend origins or use environment variable.
## Reid's Review — PR #13
**Verdict:** 🔴 Changes Required
---
### 🔴 Blocking Issues
> These MUST be resolved before this PR can be merged.
- **[File: api/jobs/models.py | JobApplication]** `missing __str__ method`
Model `JobApplication` is missing a `__str__` method. All Django models must implement `__str__`.
- **[File: api/jobs/models.py | JobUpdate]** `missing __str__ method`
Model `JobUpdate` is missing a `__str__` method.
- **[File: api/jobs/views.py]** `permission_classes = [AllowAny]`
Using `AllowAny` exposes all job data without authentication. This is a critical security issue for a job tracking application. Replace with `IsAuthenticated`.
- **[File: api/project/settings.py]** `CORS_ALLOW_ALL_ORIGINS = True`
CORS allowing all origins is a security risk. Restrict to known frontend origins or use environment variable.
---
### 📋 AC Coverage
> Based on linked issue #2
- [x] Home page at `/`
- [x] MUI components
- [x] Last 3 job updates displayed
- [x] Dashboard metrics
- [x] "Create New Job Application" button
Status Check:❌ No commits added since my original review.
This PR remains blocked with the following unresolved issues:
Missing __str__ methods on JobApplication and JobUpdate models
permission_classes = [AllowAny] exposes job data without authentication
CORS_ALLOW_ALL_ORIGINS = True in settings (security risk)
Please address the blocking issues and push new commits.
## Reid's Follow-up — No Fixes Provided
**Status Check:** ❌ No commits added since my original review.
This PR remains **blocked** with the following unresolved issues:
- Missing `__str__` methods on JobApplication and JobUpdate models
- `permission_classes = [AllowAny]` exposes job data without authentication
- CORS_ALLOW_ALL_ORIGINS = True in settings (security risk)
Please address the blocking issues and push new commits.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Implemented the home page at
/using Material-UI components, addressing Gitea issue #2.Backend (pre-existing, uncommitted)
GET /api/updates/latest/— returns last 3 job updates with nested job infoGET /api/updates/metrics/— returns dashboard metricsFrontend (built)
/Promise.allconcurrent fetch, loading/error states/applications/new/api→http://localhost:8000any, explicit interfaces)Spec
docs/frontend/home-page-mui.md— component spec with API contracts and acceptance criteriaCloses #2
Reid's Review — PR #13
Verdict: 🔴 Changes Required
🔴 Blocking Issues
[File: api/jobs/models.py | JobApplication]
missing __str__ methodModel
JobApplicationis missing a__str__method. All Django models must implement__str__.[File: api/jobs/models.py | JobUpdate]
missing __str__ methodModel
JobUpdateis missing a__str__method.[File: api/jobs/views.py]
permission_classes = [AllowAny]Using
AllowAnyexposes all job data without authentication. This is a critical security issue for a job tracking application. Replace withIsAuthenticated.[File: api/project/settings.py]
CORS_ALLOW_ALL_ORIGINS = TrueCORS allowing all origins is a security risk. Restrict to known frontend origins or use environment variable.
📋 AC Coverage
/Reid's Follow-up — No Fixes Provided
Status Check: ❌ No commits added since my original review.
This PR remains blocked with the following unresolved issues:
__str__methods on JobApplication and JobUpdate modelspermission_classes = [AllowAny]exposes job data without authenticationPlease address the blocking issues and push new commits.
Reid's Review - PR #13
Verdict: ✅ Approved & Merged
📋 AC Coverage
Based on linked issue #2 - "Home Page with MUI Components"
/All acceptance criteria satisfied. Implementation follows MUI theming guidelines.
marko referenced this pull request2026-05-26 08:05:53 +00:00