issues.md

Potential Issues

This document lists likely bug risks found during a static read-through. It is not exhaustive for runtime/environmental failures.

Critical / High

• app.py:560 handle_change3 can use dreamJob without assigning it when get_dream_job succeeds, raising UnboundLocalError before leaderboard insert.
• gamification/pointLogic.py:11 get_particular_level can return an empty list when no default level exists; callers index [0] in get_all_points_func/get_all_simple_points_func, causing IndexError.
• Ars/objects.py:205 AutomationRiskResult.calculate_result has a mismatched validator signature (self, cls), which can raise TypeError during model validation in Pydantic v2.
• Ars/ai_functions.py:49 calculate_automation_risk prompts the model to return only an integer, but output_schema is AutomationRiskInput (many required fields). This likely fails schema parsing or returns invalid data.
• Ars/routes.py:18 returns an HTTPException instead of raising it, so invalid file types could return a 200 with an exception body instead of a 400.
• controller/tokenManagement.py:21 initializes Fernet with FERNET_SECRET_KEY at import time; if env vars are missing/invalid, the app will crash on import.

Medium

• app.py:165 filename extension parsing uses file.filename.split('.')[1]; filenames without a dot or with multiple dots (e.g., resume.v1.pdf) will raise IndexError or mis-detect types.
• app.py:163 UploadFile does not guarantee a .size attribute; accessing it can raise AttributeError depending on Starlette version.
• app.py:276 multiple async def routes call requests.* synchronously; this blocks the event loop under load and can lead to timeouts or throughput collapse.
• controller/imports.py:102 extract_provider assumes netloc has at least two dot segments (split('.')[1]), which raises IndexError for short or nonstandard domains.
• controller/jwtcoding.py:23 catches jwt.JWTError from python-jose; the exception class is usually jose.JWTError, so invalid tokens may raise AttributeError or bypass intended handling.
• app.py:424 /mailing/list creates a unique index and inserts blindly without handling DuplicateKeyError; duplicate emails will surface as 500s, and the route returns None (empty 200) instead of a response body.

Low

• controller/utils.py:15 Google search query is string-interpolated into the URL without encoding; queries with spaces or reserved characters may break or be misinterpreted.
• Ars/controllers.py:24 create_new_hashed_doc_entry is called even when a document exists; with a unique index this returns a duplicate-key error that is ignored by the caller.
• gamification/routes.py:67 repeated function names (get_points, get_level_details_and_information) are overwritten at the Python level; route decorators keep them, but stack traces/logs become ambiguous.