Repository navigation
Hygiene: stale API_INTEGRATION.md references, unpinned requirements.txt, shell-loader dedup gap, /audit naming overlap #28
Description
Grouped low-severity findings from a full-repo review — none urgent individually.
1. API_INTEGRATION.md references a layout that no longer exists
Mentions frontend/ (actual dir: csv-table-hub-main/) and tests/test_api.py (actually split into test_api_unit.py / test_api_integration.py / test_api_coverage.py per commit b35f7ec). Stale since the reorg.
2. Shell loaders don't dedupe sanitized column collisions
build/csv/loader_postgresql.sh (and siblings) sanitize CSV headers to ^[a-z_][a-z0-9_]*$ but don't dedupe collisions the way api/services/csv_parse.py::sanitize_columns() does (which bumps a numeric suffix). Two headers colliding after sanitization produce a CREATE TABLE with a duplicate column → raw Postgres error instead of a clean rejection. Lower priority since todos_2026-08-12.md itself notes this CLI tooling's active-use status is unclear.
3. api/requirements.txt pins only lower bounds
fastapi>=0.140.7, pydantic>=2.13.4, etc. — a fresh pip install isn't reproducible; a future major-version bump could break the API silently.
4. /audit frontend route vs. backend /api/audit/log — naming overlap, not the same data
csv-table-hub-main/src/routes/audit.tsx renders a static hardcoded developer changelog (src/lib/audit-log.ts). The backend's actual /api/audit/log endpoint (deletion history) and /api/te/tables are never called anywhere in the shipped frontend (grepped for fetch( across all of src/ — only one call site exists, in csv.functions.ts, and it only calls /api/csv/upload, /api/csv/files, /api/csv/tables/{}/rows). Given the README markets "Audit log" as a frontend feature, this is worth a naming/scope clarification even though nothing is functionally broken.
Severity
Low — hygiene and clarity, no functional risk.
Activity
amar-python commentedon Aug 13, 2026
Fixed all four sub-items:
Stale
API_INTEGRATION.mdreferences — updatedfrontend/→csv-table-hub-main/(3 spots) andtests/test_api.py→test_api_unit.py/test_api_integration.pyin the currently-actionable sections (run commands, test counts/table, CI note). Left the historical "Previous state / Resolution" narrative for finding Bump actions/upload-artifact from 4 to 7 #1 untouched since it accurately describes what was true at the time. Also corrected the test counts while I was in there — the old doc said 19 tests (9+3+7); it's actually 32 now (9+3+20), verified viapytest --collect-only.Shell loader dedup gap — added the same collision-dedup logic
sanitize_columns()uses (bump numeric suffix until unique) to both embedded Python sanitizers inbuild/csv/loader_postgresql.shandbuild/csv/loader_mariadb.sh(2 occurrences each — COLUMNS list + CREATE TABLE). Verified standalone against the exact BUG-036 collision case:["Foo","foo","foo_2"]→["foo","foo_2","foo_2_2"], all unique. Confirmed no other loader_*.sh has this pattern (mariadb/postgresql only).Unpinned
requirements.txt— added upper bounds to all 6 deps inapi/requirements.txt(next minor for the two pre-1.0 packages, next major for the rest), so a future breaking release can't silently slip in on a fresh install. Verifiedpip install -r api/requirements.txtstill resolves cleanly against currently-installed versions./auditnaming overlap — added a clarifying note toREADME.mdabove the Frontend Features table. Turns out the real picture was more nuanced than originally described: the "audit log" features (filters, bulk selection, retry, export) are real and functional, but read from browser localStorage (the client's own import history), not the backend'sGET /api/audit/logendpoint (server-side deletion history, confirmed still never called by the frontend) — andaudit.tsxalso renders a small, separate, hardcoded developer changelog widget alongside that. Three different things were sharing the word "audit"; now documented.Verified: lint clean, health-check dashboard 86/86, full backend suite green, both edited shell scripts pass
bash -n.