Projects/docs/MissingAPIs.md

Based on a thorough review of the entire codebase, below is a **complete list of files that are missing or incompletely implemented** (stubs, placeholders, or otherwise not production‑ready).

---

## 1. Missing Controllers (No REST Endpoints)

| File (Expected) | Reason |
|----------------|--------|
| `GrantController.java` | `GrantService` exists, but no endpoints for grants. |
| `PreprintController.java` | `PreprintService` exists, but no dedicated preprint controller. |
| `ProvenanceController.java` | `ProvenanceService` exists, but no API for provenance events. |
| `MediaController.java` | `MediaService` exists, but only `UploadController` handles basic file uploads; full CRUD missing. |
| `WorkspacePanelController.java` | `WorkspacePanelRepository` exists, but only a stub in `WorkspaceCompatController`. |
| `BroadcastChannelController.java` / `BroadcastPostController.java` | `BroadcastPostRepository` exists, but no endpoints for channels or posts. |
| `EncryptionKeyController.java` | `EncryptionKeyRepository` exists, but no endpoints (probably internal). |
| `PreKeyController.java` | `PreKeyRepository` exists – no endpoints. |
| `SignedPreKeyController.java` | `SignedPreKeyRepository` exists – no endpoints. |
| `GraphNodeController.java` | Graph nodes are managed via `GapAnalysisController` but not full CRUD. |
| `GraphEdgeController.java` | Same as above. |
| `CitationGraphController.java` | `CitationGraphService` exists, but no API for citation network. |
| `TagFollowController.java` | `TagFollowDTO` exists, but no endpoints for following tags. |
| `ToolStoreStateController.java` | `ToolStoreStateRepository` exists – no controller. |

---

## 2. Incomplete / Stub Controllers

| File | Issue |
|------|-------|
| `WorkspaceCompatController.java` | Most methods return hardcoded mock data; not production. |
| `AiCompatController.java` | Returns stub AI responses; no real AI integration. |
| `DataHubController.java` | Many methods return empty lists or throw `UnsupportedOperationException` (e.g., `search`, `getVersions`). |
| `AdminToolController.java` | Minimal – `getAllToolsAdmin` returns empty list. |
| `BlogCategoryController.java` | Missing bulk operations, admin reorder, etc. |
| `BlogCommentController.java` | Missing proper reply threading endpoints. |
| `UserUtilityController.java` | Only handles writing goals; other utilities missing. |

---

## 3. Missing or Placeholder Services

| File | Status / Issue |
|------|----------------|
| `WebhookService.java` | **Completely missing** – referenced in `WebhookController` but not provided. |
| `VoiceSettingsService.java` | **Missing** – `VoiceSettingsController` expects it, but only `VoiceSettingsRepository` exists. |
| `BackupService.java` | Placeholder – writes empty JSON arrays (`"[]"`); no real backup logic. |
| `ExportService.java` | Many methods return empty strings or mock CSV; no real export. |
| `IntegrationService.java` | All external API integrations (Zotero, Mendeley, ORCID, GitHub) return mock data. |

---

## 4. Missing Configuration & Resource Files

| File | Needed By |
|------|-----------|
| `firewall.properties` | `FirewallConfig` – defines IP rules. |
| `banned_keywords.txt` | `FirewallConfig` – list of banned words. |
| `GeoLite2-Country.mmdb` | `GeoIpResolver` – MaxMind GeoIP database (not provided). |
| Email templates (e.g., `welcome.html`, `reset-password.html`) | `MailService` – referenced but not in resources. |
| `git.properties` | `VersionController` – optional, but missing. |
| `maven.properties` | `VersionController` – optional, missing. |

---

## 5. Missing DTOs (Used in Services/Controllers but Not Defined)

| Missing DTO | Referenced By |
|-------------|---------------|
| `GrantDTO` | `GrantService` returns model directly; no DTO. |
| `BroadcastChannelDTO` | No DTO for broadcast channels. |
| `GraphNodeDTO` / `GraphEdgeDTO` | Models used directly in `GapAnalysisController`. |
| `ToolDownloadDTO` / `ToolInstallationDTO` | No DTOs for tool downloads/installations. |
| `PollOptionDTO` | Only `PollDTO` exists; options embedded. |
| `ProtocolDTO` / `ProtocolStepDTO` | Models used directly in `DataHubController`. |
| `ResearchObjectDTO` | Models used directly. |
| `RecentItemDTO` | Models used directly. |
| `WorkspacePanelDTO` | Only model exists. |

---

## 6. Incomplete Repository Implementations

| Repository | Missing / Stub Methods |
|------------|------------------------|
| `ArticleRepository` | `search()` does not handle tag filtering (commented out). |
| `MessageRepository` | `findByConversationId()` returns empty list (not implemented). |
| `CommentRepository` | Some methods rely on in‑memory filtering; no pagination in DB. |
| `GroupService` (not a repo, but service) | Several methods return empty lists (e.g., `searchMessages`, `getMediaForMessage`). |
| `ProjectService` | `getUsernameFromId` and `getUserIdFromUsername` are placeholders (hash‑based). |
| `PeerReviewService` | All data stored in‑memory (`ConcurrentHashMap`), not persisted. |
| `PollService` | Same – in‑memory only. |

---

## 7. Inactive / Commented‑Out Components

| File | Issue |
|------|-------|
| `RedisConfig.java` | Entirely commented out → Redis not active. |
| `OpenApiGenerator.java` | `@Component` commented out → OpenAPI docs not generated. |
| `RateLimitFilter.java` | Exists but not applied consistently to all endpoints. |
| `CsrfFilter.java` | Exists but not integrated with Spring Security; not enforced. |

---

## 8. Missing Persistence & Infrastructure

| Feature | Status |
|---------|--------|
| **Database migration scripts** | No Flyway/Liquibase. Only `Database.init()` creates tables (may fail on schema changes). |
| **Tests** | No unit, integration, or end‑to‑end tests. |
| **Frontend files** | `HomeController` returns view names (`index`, `search-results`) but no `.html` files provided. |
| **Real backup & restore** | `BackupService` does not actually save/restore database or files. |
| **Real WebSocket cross‑server messaging** | `WebSocketManager` includes Redis pub/sub, but Redis is disabled (config commented). |

---

## 9. Security & Session Management Gaps

| Issue | Description |
|-------|-------------|
| No Spring Security integration | Home‑grown `SessionManager` and filters; no method‑level security (`@PreAuthorize`). |
| CSRF protection not fully applied | `CsrfFilter` exists but not wired to all state‑changing endpoints. |
| Password hashing duplication | Uses both `BCrypt` (at.favre.lib) and `jBCrypt` (org.mindrot) – potential conflict. |
| JWT utilities unused | `JwtUtil` present but never used (session uses UUID tokens). |

---

## 10. Missing External Dependencies (Not Declared)

Even though the code compiles with provided JARs, the following libraries are **not listed in a `pom.xml` or `build.gradle`** in the provided files:

- `com.openhtmltopdf:openhtmltopdf-core` (PDF export)
- `org.apache.poi:poi-ooxml` (Excel export)
- `org.apache.pdfbox:pdfbox` (PDF thumbnail)
- `com.maxmind.geoip2:geoip2` (IP geolocation)
- `io.jsonwebtoken:jjwt-api` (JWT – though unused)
- `com.warrenstrange:googleauth` (TOTP – used in `TwoFactorService`)
- `org.java-websocket:Java-WebSocket` (WebSocket server – used)
- `redis.clients:jedis` (Redis – used in `WebSocketManager`)
- `org.thymeleaf:thymeleaf-spring5` (email templates)
- `at.favre.lib:bcrypt` (password hashing)

---

## Summary

The codebase is **structurally complete** for a prototype, but at least **30+ files** are either missing, stubbed, or incomplete. The most critical missing pieces for production are:

1. **Real backup, export, and integration logic** (currently mock).
2. **Missing controllers** (Grant, Preprint, Provenance, Media, etc.).
3. **Missing services** (`WebhookService`, `VoiceSettingsService`).
4. **Configuration files** (`firewall.properties`, `banned_keywords.txt`, GeoIP database).
5. **Testing and database migration** infrastructure.
6. **Spring Security integration** with proper role‑based access control.