src/app/api/debug/setup-admins/route.ts (2)

6-12: Lock down this debug endpoint in non-development environments

This route seeds accounts and exposes sensitive data. It must be disabled outside development to prevent accidental production execution.

Apply this diff to guard the endpoint:

 export async function POST() {
   try {
+    // Hard stop for non-development environments
+    if (process.env.NODE_ENV !== "development") {
+      return NextResponse.json(
+        { success: false, message: "setup-admins is disabled outside development" },
+        { status: 403 }
+      );
+    }
+
     await connectDB();

---

97-118: Do not return plaintext credentials in API responses

Returning seeded admin credentials is a serious security/PII issue, even for “debug” routes. If you need the credentials for local dev, conditionally include them only in development; otherwise omit entirely.

Apply this diff to conditionally include credentials only in development:

-    return NextResponse.json({
-      success: true,
-      message: "Admin setup completed successfully",
-      admins: allAdmins.map((admin) => ({
-        id: admin._id,
-        fullName: admin.fullName,
-        email: admin.email,
-        role: admin.role,
-        accountStatus: admin.accountStatus,
-        createdAt: admin.createdAt,
-      })),
-      credentials: {
-        superAdmin: {
-          email: "superadmin@govlink.lk",
-          password: "ThisIsInsane",
-        },
-        regularAdmin: {
-          email: "admin@govlink.lk",
-          password: "TestAdmin123",
-        },
-      },
-    });
+    const payload: any = {
+      success: true,
+      message: "Admin setup completed successfully",
+      admins: allAdmins.map((admin) => ({
+        id: admin._id.toString(),
+        fullName: admin.fullName,
+        email: admin.email,
+        role: admin.role,
+        accountStatus: admin.accountStatus,
+        createdAt: admin.createdAt,
+      })),
+    };
+    if (process.env.NODE_ENV === "development") {
+      payload.credentials = {
+        superAdmin: { email: "superadmin@govlink.lk", password: "ThisIsInsane" },
+        regularAdmin: { email: "admin@govlink.lk", password: "TestAdmin123" },
+      };
+    }
+    return NextResponse.json(payload);

src/components/agent/analytics/SystemTrends.tsx (4)

297-301: Guard TrendChart against empty datasets to avoid -Infinity/NaN heights

When data is empty, Math.max(...[]) yields -Infinity and height math can be undefined. Add an early return and a safe max baseline.

Apply this diff:

-  const TrendChart = ({ data, metric, color }: { data: TrendDataPoint[], metric: keyof TrendDataPoint, color: string }) => {
-    const maxValue = Math.max(...data.map(d => d[metric] as number));
+  const TrendChart = ({ data, metric, color }: { data: TrendDataPoint[], metric: keyof TrendDataPoint, color: string }) => {
+    if (!data || data.length === 0) {
+      return <div className="h-40 flex items-center justify-center text-sm text-muted-foreground">No data</div>;
+    }
+    const maxValue = Math.max(1, ...data.map(d => d[metric] as number));

---

400-413: Prevent -Infinity/NaN in Peak/Avg/Low traffic when trendsData is empty

Rendering with empty trendsData shows -Infinity/Infinity/NaN. Guard calculations.

Apply this diff:

-              <div className="font-bold text-[#FFC72C]">{Math.max(...trendsData.map(d => d.traffic))}</div>
+              <div className="font-bold text-[#FFC72C]">{trendsData.length ? Math.max(...trendsData.map(d => d.traffic)) : 0}</div>
...
-                {Math.round(trendsData.reduce((acc, d) => acc + d.traffic, 0) / trendsData.length)}
+                {trendsData.length ? Math.round(trendsData.reduce((acc, d) => acc + d.traffic, 0) / trendsData.length) : 0}
...
-              <div className="font-bold text-[#008060]">{Math.min(...trendsData.map(d => d.traffic))}</div>
+              <div className="font-bold text-[#008060]">{trendsData.length ? Math.min(...trendsData.map(d => d.traffic)) : 0}</div>

---

423-437: Prevent -Infinity/NaN in Response Time stats when trendsData is empty

Same issue for responseTime max/avg/min. Guard the math.

Apply this diff:

-                {Math.max(...trendsData.map(d => d.responseTime)).toFixed(1)}s
+                {(trendsData.length ? Math.max(...trendsData.map(d => d.responseTime)) : 0).toFixed(1)}s
...
-                {(trendsData.reduce((acc, d) => acc + d.responseTime, 0) / trendsData.length).toFixed(1)}s
+                {(trendsData.length ? (trendsData.reduce((acc, d) => acc + d.responseTime, 0) / trendsData.length) : 0).toFixed(1)}s
...
-                {Math.min(...trendsData.map(d => d.responseTime)).toFixed(1)}s
+                {(trendsData.length ? Math.min(...trendsData.map(d => d.responseTime)) : 0).toFixed(1)}s

---

447-447: Avoid mutating state-derived arrays during render

sort() mutates the original array (systemData.peakHoursData). Clone before sorting to prevent accidental state mutation in render.

Apply this diff:

-          {peakHoursData.sort((a, b) => b.traffic - a.traffic).map((hour) => (
+          {[...peakHoursData].sort((a, b) => b.traffic - a.traffic).map((hour) => (

src/app/api/debug/setup-admins/route.ts (1)

100-107: Serialize ObjectId to string to avoid JSON serialization quirks

Mongoose ObjectId should be stringified for consistent API responses.

Apply this diff:

-        id: admin._id,
+        id: admin._id.toString(),

src/app/user/auth/register/page.tsx (1)

199-231: Either localize the strength labels or drop the unused language prop

Right now, PasswordStrengthIndicator accepts a language prop in its type but ignores it at runtime, while callers still pass it. Either remove the prop end-to-end or use it to localize labels.

Apply this diff to localize labels and keep the API clear:

-const PasswordStrengthIndicator = ({ password }: { password: string; language?: Language }) => {
+const PasswordStrengthIndicator = ({ password, language = 'en' }: { password: string; language?: Language }) => {
+  const strengthLabels: Record<Language, { weak: string; fair: string; strong: string }> = {
+    en: { weak: 'Weak', fair: 'Fair', strong: 'Strong' },
+    si: { weak: 'දුර්වල', fair: 'සාමාන්‍ය', strong: 'දृඝ' },
+    ta: { weak: 'பலவீனமானது', fair: 'சராசரி', strong: 'வலிமையானது' },
+  };
+
   const getStrength = () => {
     if (password.length === 0) return { score: 0, label: '', color: '' };
-    if (password.length < 6) return { score: 1, label: 'Weak', color: '#FF5722' };
-    if (password.length < 10) return { score: 2, label: 'Fair', color: '#FFC72C' };
-    return { score: 3, label: 'Strong', color: '#008060' };
+    if (password.length < 6) return { score: 1, label: strengthLabels[language].weak, color: '#FF5722' };
+    if (password.length < 10) return { score: 2, label: strengthLabels[language].fair, color: '#FFC72C' };
+    return { score: 3, label: strengthLabels[language].strong, color: '#008060' };
   };

src/app/api/debug/check-admins/route.ts (2)

14-14: Avoid logging full admin documents

Logging the entire admin array leaks PII into logs. Log the count instead.

Apply this diff:

-    console.log("Found admins:", admins);
+    console.log("Found admins:", admins.length);

---

20-21: Stringify ObjectId in API response

Ensure id is a string for client consumption and consistent typing.

Apply this diff:

-        id: admin._id,
+        id: admin._id.toString(),

src/lib/auth/admin-middleware.ts (1)

192-214: Avoid redundant DB connect and select safe fields; handle deleted admin

authenticateAdmin already connects to the DB. Also, selecting only safe fields reduces accidental exposure downstream and handling a not-found edge makes the helper more robust.

Apply this diff:

-export const verifyAdminAuth = async (request: NextRequest) => {
+export const verifyAdminAuth = async (request: NextRequest) => {
   const authResult = await authenticateAdmin(request);
   
   if (!authResult.success) {
     return {
       isValid: false,
       admin: null,
       error: authResult.message
     };
   }
 
-  // Fetch full admin data
-  await connectDB();
-  const admin = await Admin.findById(authResult.admin!.userId);
+  // Fetch admin data (select safe fields)
+  const admin = await Admin.findById(authResult.admin!.userId)
+    .select("fullName email role accountStatus lastLoginAt createdAt updatedAt");
+  if (!admin) {
+    return {
+      isValid: false,
+      admin: null,
+      error: "Admin not found"
+    };
+  }
   
   return {
     isValid: true,
     admin,
     error: null
   };
 };

src/app/admin/admin-management/page.tsx (1)

85-104: Consider toggling loading state at the start of fetchAdmins (for refresh UX) and add abort support

Current implementation only sets loading to false in finally. If you ever reuse fetchAdmins to refresh the list after create/update/delete, you won’t show a loading indicator. Also, adding an AbortController prevents setState on unmounted components during navigation.

Apply this diff to show refresh loading and support abort:

-  const fetchAdmins = useCallback(async () => {
-    try {
+  const fetchAdmins = useCallback(async () => {
+    const controller = new AbortController();
+    try {
+      setLoading(true);
       const response = await fetch("/api/admin/admins", {
         method: "GET",
-        headers: getAuthHeaders(),
+        headers: getAuthHeaders(),
         credentials: "include",
+        signal: controller.signal,
       });
 
       if (response.ok) {
         const data = await response.json();
         setAdmins(data.admins);
       } else {
         console.error("Failed to fetch admins");
       }
     } catch (error) {
       console.error("Error fetching admins:", error);
     } finally {
       setLoading(false);
     }
-  }, [getAuthHeaders]);
+    return () => controller.abort();
+  }, [getAuthHeaders]);

src/app/api/agent/analytics/performance/route.ts (2)

62-63: Clamp firstContactRate to 100 to avoid >100% values in UI

With resolutionRate near 100, 60 + 0.3*resolutionRate can exceed 100. Clamp to keep percentages valid.

-      const firstContactRate = totalAppointments > 0 ? 
-        (60 + (resolutionRate * 0.3)) : 0;
+      const firstContactRate = totalAppointments > 0
+        ? Math.min(100, 60 + resolutionRate * 0.3)
+        : 0;

---

150-169: Avoid N+1 queries when building team rankings

The per-agent Appointment.find call inside map causes N+1 DB roundtrips. Consider an aggregation to group by assignedAgent over the time window and compute counts in one query, then join to the agents list in memory.

src/lib/auth/agent-middleware.ts (1)

175-210: Prefer excluding id when spreading agent to avoid duplicate identifiers

verifyAgentAuth currently spreads authResult.agent, which includes id, after adding _id. This creates both id and _id on the returned object. While generally harmless, eliminating id avoids confusion and accidental downstream reliance.

Apply this diff:

-  return {
-    isValid: true,
-    agent: {
-      _id: authResult.agent.id,
-      ...authResult.agent
-    }
-  };
+  const { id, ...agentRest } = authResult.agent;
+  return {
+    isValid: true,
+    agent: {
+      _id: id,
+      ...agentRest,
+    },
+  };

src/components/agent/dashboard/StatsOverview.tsx (3)

120-124: Remove console logs before shipping

These logs are useful during development but noisy in production. Consider gating with NODE_ENV or removing.

-      const result = await response.json();
-      console.log('Dashboard API Response:', result);
-      console.log('Dashboard Data:', result.data);
-      setDashboardData(result.data);
+      const result = await response.json();
+      setDashboardData(result.data);

---

66-95: Unused confirmedAppointments in DashboardData

Type includes confirmedAppointments but no card renders it. Either add a card or remove it from the type to reduce confusion.

Would you prefer we add a Confirmed Appointments card or drop the field from this component’s local type to match current UI?

---

106-137: Optional: abort in-flight fetches on unmount or refresh

To avoid setState on unmounted component edge cases, wrap fetchStats with AbortController and check signal.aborted before updating state.

I can provide a patch using AbortController if you want to harden fetchStats.

src/components/agent/analytics/SystemTrends.tsx (3)

346-358: selectedMetric is not wired to the chart; hook it up for expected behavior

Buttons update selectedMetric but the primary TrendChart always renders traffic. Map selectedMetric to the appropriate metric field.

Apply this diff:

-          <TrendChart data={trendsData} metric="traffic" color="#FFC72C" />
+          <TrendChart 
+            data={trendsData} 
+            metric={
+              selectedMetric === 'traffic' ? 'traffic' :
+              selectedMetric === 'performance' ? 'responseTime' :
+              selectedMetric === 'resources' ? 'cpuUsage' : 
+              'errorRate'
+            } 
+            color="#FFC72C" 
+          />

Also applies to: 398-398

---

253-275: Cancel in-flight fetches on timeRange changes/unmount to avoid state updates on unmounted components

Use AbortController and check signal.aborted before setting state. This also avoids racing responses overwriting newer data.

I can provide a patch adding AbortController and cleanup in useEffect if you’d like.

---

176-226: Minor i18n nit: Mixed-script characters in Tamil translation

There appears to be a Devanagari segment in a Tamil string (line 207). Please review and correct the mixed script.

src/components/agent/analytics/AnalyticsDashboard.tsx (1)

123-146: Set loading on re-fetch to avoid showing stale data during timeRange changes

Currently only isRefreshing is toggled; the page-level spinner never shows after the initial load. Optionally set loading true before fetch to present a consistent UX on timeRange changes.

Apply this diff:

-    try {
-      setIsRefreshing(true);
+    try {
+      setIsRefreshing(true);
+      setLoading(true);

src/app/api/agent/dashboard/route.ts (2)

64-70: Unify trend payload shape for consistent consumers

Using a literal "Scheduled" for trend.value breaks consistency with percentage changes used elsewhere. Consider standardizing trend.value to a delta-like string (e.g., "+0%") and adding a separate status if needed.

Please confirm how StatsOverview (or other consumers) expect trend for confirmedAppointments. If they expect a percent-like value, I can provide a patch to align this field.

---

13-14: Optional: Skip DB connection when returning mock data

connectDB is unnecessary here until real queries are added, and skipping it reduces overhead.

src/components/agent/analytics/PerformanceMetrics.tsx (2)

174-196: Cancel in-flight requests to prevent race conditions and state updates on unmounted

Introduce AbortController and clean up in useEffect. This avoids stale responses overriding newer state.

I can supply a patch adding AbortController wiring if you want to adopt it here and in sibling analytics components for consistency.

---

284-285: Safer fallback for missing translation keys

If the backend adds a metric without a translation key, this will render undefined. Provide a fallback to the key string.

Apply this diff:

-                    {t[key as keyof MetricsTranslation]}
+                    {t[key as keyof MetricsTranslation] ?? String(key)}

src/app/api/agent/analytics/route.ts (1)

42-46: Reduce query payload for performance

Only a few fields are used (status, createdAt, serviceType). Use select(...).lean() to cut transfer and de-hydration overhead.

Example:

const agentAppointments = await Appointment.find(
  { assignedAgent: agentId, createdAt: { $gte: startDate, $lte: now } },
  'status createdAt serviceType'
).lean();

Also consider adding a compound index on { assignedAgent: 1, createdAt: 1 } in the Appointment schema to optimize these range queries.

src/app/api/agent/analytics/trends/route.ts (5)

42-45: Select only needed fields to reduce memory and serialization cost

You only use createdAt, serviceType, and status downstream. Limit the projection to reduce payload and speed up serialization.

-    const appointments = await Appointment.find({
-      assignedAgent: agentId,
-      createdAt: { $gte: startDate, $lte: now }
-    });
+    const appointments = await Appointment.find({
+      assignedAgent: agentId,
+      createdAt: { $gte: startDate, $lte: now }
+    }).select('createdAt serviceType status');

---

131-131: More robust label formatting for service types

Replace only-first-underscore replace('_', ' ') with a global underscore replacement and proper title-casing.

-          type: type.charAt(0).toUpperCase() + type.slice(1).replace('_', ' '),
+          type: type
+            .replace(/_/g, ' ')
+            .replace(/\b\w/g, (c) => c.toUpperCase()),

---

86-106: Optional: Pre-binning for peak hour calculation

Current approach is O(24 × N). For larger datasets, pre-binning into a 24-length counter array in a single pass will reduce complexity to O(N).

If you want, I can provide a refactor that builds a frequency map by hour in one pass and derives peak hours from it.

---

140-170: Clarify errorRate semantics

errorRate is a 0–2 value depending on loadFactor; consumers likely expect a percentage (0–100). Consider normalizing and documenting the unit.

---

41-45: Indexing advice for query performance

Make sure Appointment has a compound index on { assignedAgent: 1, createdAt: 1 } to keep these range queries fast as data grows.

src/app/api/agent/analytics/reports/route.ts (1)

125-147: Honor custom endDate and make endDate explicit

In custom period, endDate from the request is ignored. Also make endDate explicit for all periods to avoid relying on a closed-over now.

-      const now = new Date();
-      let startDate = new Date();
-      
-      switch (reportConfig.period) {
+      const now = new Date();
+      let startDate = new Date();
+      let endDate = now;
+      const period = reportConfig?.period;
+
+      switch (period) {
         case 'daily':
           startDate.setHours(0, 0, 0, 0);
           break;
         case 'weekly':
           startDate.setDate(now.getDate() - 7);
           break;
         case 'monthly':
           startDate.setMonth(now.getMonth() - 1);
           break;
         case 'quarterly':
           startDate.setMonth(now.getMonth() - 3);
           break;
         case 'custom':
           startDate = new Date(reportConfig.startDate);
+          if (reportConfig.endDate) {
+            endDate = new Date(reportConfig.endDate);
+          }
           break;
         default:
           startDate.setDate(now.getDate() - 7);
       }

Note: The subsequent query/filter should use endDate instead of now (see previous comment).

src/components/agent/analytics/SimplifiedAnalytics.tsx (5)

205-216: Mislabelled stat: shows satisfactionRate under "Completion Rate"

This card renders satisfactionRate but labels it "Completion Rate". Either switch to resolutionRate or rename the title to "Satisfaction Rate" for clarity.

-          {
-            title: 'Completion Rate',
-            value: `${quickStats.satisfactionRate?.value || '0'}${quickStats.satisfactionRate?.unit || '%'}`,
+          {
+            title: 'Satisfaction Rate',
+            value: `${quickStats.satisfactionRate?.value || '0'}${quickStats.satisfactionRate?.unit || '%'}`,
             change: quickStats.satisfactionRate?.change || '0%',
             isPositive: quickStats.satisfactionRate?.isPositive || false,

---

253-254: Make the section header reflect the selected time range

Avoid “Weekly” when the timeRange is today/month/quarter.

-          <h3 className="text-lg font-semibold text-foreground">Weekly Performance</h3>
+          <h3 className="text-lg font-semibold text-foreground">
+            {timeRange.charAt(0).toUpperCase() + timeRange.slice(1)} Performance
+          </h3>

---

447-448: Avoid rendering 'undefined' when unit is missing

Default the unit to an empty string.

-                {metric.value}{metric.unit}
+                {metric.value}{metric.unit ?? ''}

---

93-94: Avoid noisy logs in production

Wrap console logs with a NODE_ENV check so production consoles remain clean.

-        console.log('Analytics data received:', result);
+        if (process.env.NODE_ENV !== 'production') {
+          console.log('Analytics data received:', result);
+        }

-        console.log('Performance data received:', result);
+        if (process.env.NODE_ENV !== 'production') {
+          console.log('Performance data received:', result);
+        }

-        console.log('Trends data received:', result);
+        if (process.env.NODE_ENV !== 'production') {
+          console.log('Trends data received:', result);
+        }

Also applies to: 102-103, 111-112

---

72-90: Optional: Prevent race conditions on rapid timeRange changes

Add an AbortController to cancel in-flight requests when timeRange changes to avoid setting state from stale responses.

I can provide a small refactor using AbortController if you want to pursue this now.

Also applies to: 124-127

src/components/agent/analytics/ReportGenerator.tsx (4)

296-298: Remove duplicated comment

The “Fetch real report data from backend” comment appears twice consecutively.

-  // Fetch real report data from backend
-  // Fetch real report data from backend
+  // Fetch real report data from backend

---

523-528: Hook "Generate Now" buttons to actions for accessibility

Right now generation is only bound to the card onClick. Also attach onClick to the button so keyboard users can trigger it.

                   <button
                     disabled={isGenerating}
+                    onClick={(e) => { e.stopPropagation(); handleQuickReport('performance'); }}
                     className="w-full px-4 py-2 bg-gradient-to-r from-[#FFC72C] to-[#FF5722] text-white rounded-lg hover:from-[#FF5722] hover:to-[#8D153A] transition-all duration-300 disabled:opacity-50 font-medium shadow-lg hover:shadow-xl"
                   >

                   <button
                     disabled={isGenerating}
+                    onClick={(e) => { e.stopPropagation(); handleQuickReport('service'); }}
                     className="w-full px-4 py-2 bg-gradient-to-r from-[#008060] to-[#FFC72C] text-white rounded-lg hover:from-[#FFC72C] hover:to-[#FF5722] transition-all duration-300 disabled:opacity-50 font-medium shadow-lg hover:shadow-xl"
                   >

                   <button
                     disabled={isGenerating}
+                    onClick={(e) => { e.stopPropagation(); handleQuickReport('operational'); }}
                     className="w-full px-4 py-2 bg-gradient-to-r from-[#FF5722] to-[#8D153A] text-white rounded-lg hover:from-[#8D153A] hover:to-[#FF5722] transition-all duration-300 disabled:opacity-50 font-medium shadow-lg hover:shadow-xl"
                   >

Also applies to: 578-583, 632-637

---

330-358: Differentiate success message for scheduled vs generated reports

Currently you always show “Report generated successfully!” even when scheduling. Use the schedule selection to show t.reportScheduled for the scheduled flow.

I can provide a small state tweak (e.g., successMessage) and wire it into the success toast if you’d like.

---

373-381: Check and handle non-OK responses for quick reports

You ignore non-OK responses; consider logging and surfacing an error toast to match the generate flow.

-      if (response.ok) {
+      if (response.ok) {
         setShowSuccess(true);
         setTimeout(() => setShowSuccess(false), 3000);
         
         // Refresh report history
         await fetchReportData();
-      }
+      } else {
+        console.error('Failed to generate quick report:', response.status, await response.text());
+      }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.