Lab 9 Report

Lab 9 Report

Date: April 30, 2026 Attendees: Amin Abu-Hilga, Övgü Su Afşar, Muhammet Sami Çakmak, Beratcan Doğan, İbrahim Kayan, Mehmet Bora Sarıoğlu, Burak Ögüt

---

Requirements Review

Methodology

We revisited every wiki requirement and tagged each as DONE, PARTIAL, or MISSING against the current code. All wiki requirements are committed to Final Delivery — none are deferred.

Scoping meeting for Blog, Community, and Profile-content requirements. Before implementing the Blog (1.1.6), Community (1.1.7–1.1.12 and 1.2.4), and Profile-content (1.2.2) clusters, we will hold a dedicated meeting with the instructor and a project stakeholder to confirm priorities, refine user-facing surfaces, and lock acceptance criteria. The meeting is scheduled in the final week of the project, after the smaller well-bounded features (mentorship lifecycle, meetings, tasks, advanced recommendation, notifications, admin) have shipped, so the community-style features are implemented against confirmed scope.

Status by Area

1.1.1.1 Mentees (13)

#	Status	Note
1, 2, 3, 4, 5, 9, 10	DONE	profile CRUD, recs, requests, messaging (#245), single-active-mentor, keyword search
6	MISSING	Task submissions (#248)
7	MISSING	feedback on TaskSubmission
8	MISSING	Meeting entity (#284)
11	MISSING	mentor rating after end
12	MISSING	cancel + auto-ban
13	MISSING	Report entity

1.1.1.2 Mentors (15)

#	Status	Note
1–3, 5–7, 11, 12	DONE	profile, candidates, accept/reject, messaging, capacity, durations
4	PARTIAL	over-fires (bug #273)
8	PARTIAL	only weekly slots; need Meeting entity
9, 10	MISSING	covered by Task entity (#248)
13, 14	MISSING	extend / end-early endpoints
15	MISSING	Blog (scoping meeting)

1.1.1.3 Admins (3) — All MISSING

AdminController is stub-only. Build ban endpoints + Ban entity + Report review queue (depends on shared Report entity).

1.1.2 Recommendation (8)

#	Status	Note
6, 7	DONE	privacy at rec stage (verify), mentees can't find mentees
1, 2, 8	PARTIAL	background factor missing; over-fires (#273); capacity race (#270)
3, 4, 5	MISSING	location proximity, diversity branch, factor explanations

1.1.3 Messaging (5)

#	Status	Note
1–4	DONE	STOMP+REST, history, attachments (#245)
5	PARTIAL	mentor↔mentor wiring (#284)

1.1.4 Scheduling (6)

#	Status	Note
1	DONE	weekly availability
2	PARTIAL	needs Meeting entity (separate from AvailabilitySlot)
3, 4, 5, 6	MISSING	confirmation/reminder notifications, reschedule flow, auto-terminate scheduler

1.1.5 Tasks & Progress (8)

#	Status	Note
6	DONE	sharedGoal endpoint
1–5, 7, 8	MISSING	Task + Milestone entities, submissions, feedback, progress aggregation, reminders (#248)

1.1.6 Blog (4) — All MISSING

Blog post + comment + like entities + /api/blogs CRUD + mentor profile integration (#283). Final scope to be confirmed in the stakeholder meeting.

1.1.7–1.1.12 Communities (~60) — All MISSING

Final scope to be confirmed in the stakeholder meeting before last-week implementation. High-level plan, by subsection:

Subsection	Reqs	Plan
1.1.7 Creation & Membership	16	Community entity (immutable name, slug, visibility enum), Moderator + MembershipRequest entities, join/leave/approve endpoints
1.1.8 Posts & Comments	19	Post (TEXT/IMAGE/VIDEO/LINK/POLL via type enum + Poll sub-entity), Comment with parentId, Bookmark, Award; CRUD with author/mod checks
1.1.9 Voting & Reputation	6	PostVote/CommentVote (unique per user-target), cached postReputation/commentReputation on User, hot-score ranking
1.1.10 Feed & Discovery	5	/api/feed/home, /api/feed/popular, community feed; sort modes hot/new/top/rising/controversial
1.1.11 Moderation	14	mod management endpoints, CommunityBan/CommunityMute, AutomodRule (spam, keyword, flair, suspicious-activity flagging), admin override endpoints
1.1.12 Reporting	5	unified Report entity (polymorphic target) + ReportRoutingService (mod-first vs. admin-direct based on violation type)

1.2.1 Notifications (7)

#	Status	Note
4, 5	DONE	only-relevant-users, REQUEST_ACCEPTED
1, 2	PARTIAL	in-app only; FCM dispatch missing
3, 6, 7	MISSING	meeting reminders, REQUEST_SUBMITTED, task/milestone reminders + scheduler

1.2.2 Profiles (5)

Final scope to be confirmed in the stakeholder meeting (profile-content cluster).

#	Status	Note
1, 2	DONE	background/goals/skills/interests, mentoring prefs
3	PARTIAL	mentee visibility exists; add to mentor
4	MISSING	depends on Blog
5	MISSING	add city (+ optional lat/lng) to User

1.2.3 Sign-Up & Authentication (8) — All DONE

Registration, unique email, password validation, email verification, login/logout, JWT, error on bad credentials.

1.2.4 Community API (5) — All MISSING

Public read endpoints for posts/comments, scoped API tokens for moderation tools, API-key issuance for third-party integrations, rate limiting (shared with #252). Final scope in the stakeholder meeting.

2.1 Availability (2)

24/7: PARTIAL (production deploy + monitoring planned). Web + mobile: DONE.

2.2 Security (8)

#	Status	Note
1	DONE	BCrypt
2	PARTIAL	HTTPS at deploy layer
3	MISSING	data export + delete + consent (GDPR/KVKK)
4	MISSING	escalating temp-ban from cancelCount
5	MISSING	rate limit (#252) + CAPTCHA + content heuristics
6	MISSING	vote rate limit + rapid-sequential detector + sockpuppet check
7	MISSING	device fingerprint + IP + email-domain checks at registration
8	MISSING	time-window graph clustering on vote/post patterns

2.3 Performance (5)

#	Status	Note
1, 3	DONE	event-driven notifications, basic rec processing
2, 4, 5	UNVERIFIED	DevOps load tests pre-Final-Delivery

Pre-existing Bug Fixes (Lab 8 Backlog)

Five backend bugs identified in Lab 8 must be closed before final delivery:

• #270 Mentor capacity race in MentorshipService.acceptRequest — add DB-level optimistic lock
• #271 NPE risk when JWT lacks userId/role claims — null-safe JwtAuthenticationFilter
• #272 Inconsistent timezone handling — standardize on Clock + UTC OffsetDateTime
• #273 Match-found notification fires on every browse — fire only on new top-match change
• #274 Missing per-resource authorization on GET /api/availability/{mentorId}

Plan to Address Unimplemented Requirements

The Final Milestone plan (wiki) is being expanded to cover every wiki requirement — none are deferred. Priority order for the remaining sprints:

1. Core mentorship lifecycle — end/extend/cancel/auto-terminate/auto-ban/rate
2. Meetings — Meeting entity + reminders + reschedule flow
3. Tasks & milestones — Task/Milestone entities, submissions, feedback, progress aggregation
4. Recommendation overhaul — location, diversity, explanation
5. Blog — full CRUD + mentor profile integration (#283)
6. Notifications — FCM dispatch, new types, reminder schedulers
7. Admin & moderation — admin endpoints (ban/list/reports), unified Report entity (shared with community reporting)
8. Communities — Phase A Community + membership + visibility + moderator role (1.1.7)
9. Communities — Phase B Posts (text/image/video/link/poll), edit/delete, share/save, mod approval, pin (1.1.8 posts)
10. Communities — Phase C Comments, replies, comment voting, awards (1.1.8 comments)
11. Communities — Phase D Voting + reputation scoring (1.1.9)
12. Communities — Phase E Feeds (home / popular / community-specific) + sort modes (1.1.10)
13. Communities — Phase F Moderation + automoderation rules + admin oversight (1.1.11)
14. Communities — Phase G Reporting flow (extends shared Report) (1.1.12)
15. Public Community API + integrations with rate-limiting middleware (1.2.4)
16. Anti-abuse hardening — spam-bot, vote-manipulation, ban-evasion, coordinated-abuse detectors (2.2.5–2.2.8)
17. GDPR/KVKK compliance — data-export + delete endpoints + consent UI
18. Lab 8 bug closures — five fixes (#270–#274)
19. DevOps hardening — production deploy, monitoring (Prometheus + Grafana), load testing for performance requirements 2.3.2 and 2.3.5

---

Acceptance Testing Strategy

Write your acceptance testing strategy.

---

Data Strategy

Write your data strategy.

---

Example Acceptance Tests

Test 6 — Mentorship Request Lifecycle

Author: Burak Ögüt (2021400168)

Feature: Mentorship Requests

Name: Mentor and mentee complete request lifecycle

ID: AT-05

Description: Verifies request creation, sent/received listing, duplicate prevention, rejection, and acceptance of mentorship requests.

Prerequisite: A mentee without an active mentor exists, a mentor with available capacity exists, and both users have verified accounts.

#	Instruction	Expectation	Result	Notes
1	Log in as the mentee on the mobile app	Home screen is displayed; mentee role is active
2	Navigate to the Explore tab and select an available mentor; tap "Send Mentorship Request"; enter a cover letter and submit	Success message is displayed confirming the request was submitted; request appears in the mentee's "My Requests" list with status PENDING		Req 1.1.1.1.4, 1.2.1.6
3	Attempt to send a second mentorship request to the same mentor	System blocks the duplicate request with an appropriate error message; no second request is created		Business rule: one active request per mentor–mentee pair
4	Log out and log in as the mentor	Mentor's Home dashboard is displayed
5	Open the received requests list (Requests tab)	The pending request from the mentee appears in the list with mentee's first name visible but surname hidden		Req 1.1.2.6, 1.1.1.2.4
6	Reject one pending request (if another pending request is available) by tapping Reject	The rejected request is removed from the pending list; the corresponding mentee receives a rejection notification; mentor mentee count is unchanged		Req 1.1.1.2.6
7	Tap on the valid pending request from the mentee; review the profile; tap Accept and provide mentorship duration information	Acceptance is confirmed with a success message; the mentee is added to the mentor's active mentees list; mentor mentee count increases by 1		Req 1.1.1.2.6, 1.1.1.2.12, 1.2.1.5
8	Reopen the requests list and navigate to the mentee's active mentorships on the Home dashboard	The accepted request no longer appears in pending list; the mentee is listed as an active mentee; the mentee's app shows the mentorship as active		Req 1.1.1.1.9: mentee limited to one active mentor

Note: Covers only request lifecycle and business rules around duplicate/capacity/request handling.

---

Test 7 — Mentor Cross-Profile & Progress Review

Feature: Mentor Profile Exploration, Inter-Mentor Communication, and Mentee Progress Tracking

Name: Mentor views peer mentor profiles, communicates with another mentor, and reviews mentee progress

ID: AT-06

Description: Verifies that a logged-in mentor can browse and view other mentors' public profiles, initiate communication with a peer mentor, and monitor the ongoing progress of their active mentees including task completion status and milestones.

Prerequisite:

• A mentor account (Mentor A) with at least two active mentees exists and is verified
• At least one other mentor account (Mentor B) with a complete public profile exists in the system
• Mentee X (active under Mentor A) has at least one assigned task in "In Progress" or "Submitted" state
• Both mentor accounts have verified credentials and are able to log in
• Messaging between mentors is enabled (or marked N/A if out of scope for current milestone)

#	Instruction	Expectation	Result	Notes
1	Log in as Mentor A on the mobile app	Home dashboard is displayed showing Mentor A's active mentees and mentee count
2	Navigate to the Explore tab	Explore tab loads and displays other mentor profiles (name, expertise, availability) — not mentee profiles		Req 1.1.2.7: mentees not discoverable by other mentees; mentor view should differ
3	Tap on Mentor B's profile card	Mentor B's public profile screen opens
4	Review Mentor B's profile details (name, expertise, mentoring goals, availability, mentee capacity)	All fields are visible; full name including surname is shown (surname hiding applies only to mentee candidates, not peer mentors)		Req 1.1.2.6 applies only to mentee candidates during request review
5	From Mentor B's profile, tap "Send Message" and type: "Hi, I'd like to connect regarding a shared mentoring approach." then send	Message is sent successfully; confirmation is shown		Req 1.1.3.5; mark N/A if inter-mentor messaging not yet deployed in this milestone
6	Navigate to the Messages tab	Conversation thread with Mentor B is visible; sent message appears with correct timestamp		Mark N/A if messaging is out of scope
7	Navigate to the Home tab	Home dashboard shows the list of active mentees with names and mentee count (e.g., 2/5)		Req 1.1.1.2.11
8	Tap on Mentee X's card	Mentee X's progress detail screen opens showing task list and milestone summary		Req 1.1.5.1
9	Review the list of assigned tasks and their statuses	Tasks are listed with correct statuses: Not Started / In Progress / Submitted / Completed		Req 1.1.5.2
10	Tap on a task with status "Submitted" and view the submitted content	Submission details (file or link) are displayed; "Approve" and "Request Revision" actions are available		Req 1.1.5.3
11	Enter feedback: "Good effort. Please add input validation before the next submission." and tap Approve	Task status changes to "Completed"; feedback is saved and visible		Req 1.1.5.3, 1.1.5.6
12	Return to Mentee X's progress screen	Milestone progress percentage has increased; completed task is listed with a completion timestamp; Mentee X has received a notification about the approval within 5 seconds		Req 1.1.5.4, 2.3.1

---

---

Individual Contributions

Name	Task	Linked Issue
Mehmet Bora Sarıoğlu	to be filled	to be filled
	to be filled	to be filled
Amin Abu-Hilga	to be filled	to be filled
	to be filled	to be filled
Övgü Su Afşar	to be filled	to be filled
	to be filled	to be filled
Muhammet Sami Çakmak	to be filled	to be filled
	to be filled	to be filled
Beratcan Doğan	to be filled	to be filled
	to be filled	to be filled
İbrahim Kayan	to be filled	to be filled
	to be filled	to be filled
Burak Ögüt	to be filled	to be filled
	to be filled	to be filled