Description
In backend/controllers/analytics.controller.js, the getAnalytics endpoint fetches real task and message data from Supabase, then discards all actual user attribution and replaces it with statistics generated from a hardcoded list of six fake team members (Alex Rivera, Jordan Smith, Casey Morgan, Riley Lee, Morgan Patel, Quinn Taylor).
Tasks are pseudo-randomly assigned to these fictional members using a hash function, and completion/review counts are computed with arbitrary multipliers and offsets. None of these analytics reflect who actually created, completed, or reviewed tasks.
const memberProfiles = [
{ id: "alex", name: "Alex Rivera", role: "Lead Frontend Engineer", ... },
...
];
function buildMembers(tasks = [], messages = []) {
return memberProfiles.map((profile, index) => {
const assignedTasks = tasks.filter((task, taskIndex) => {
const seed = hashString(task.id || task.title || taskIndex);
return seed % memberProfiles.length === index; // fake assignment
});
...
});
}To Reproduce
- Create real user accounts and assign tasks to specific users.
- Call
GET /api/analytics.
- Observe that the returned member analytics show the six hardcoded fake members, not the real users.
Expected Behavior
Member analytics should be derived from real data: who created tasks, who marked them done, who sent messages. If user attribution is not yet stored in the tasks/messages schema, the analytics should accurately state that per-member breakdowns are unavailable rather than fabricating them.
Actual Behavior
Six fictitious team members are returned with plausible-looking but entirely fabricated statistics.
Desktop
- Backend: Node.js / Express / Supabase
- File:
backend/controllers/analytics.controller.js
Additional context
Expected NSOC points: level3 (significant feature correctness bug affecting core analytics functionality)
Labels: bug, NSoC'26, level3
Checklist:
Description
In
backend/controllers/analytics.controller.js, thegetAnalyticsendpoint fetches real task and message data from Supabase, then discards all actual user attribution and replaces it with statistics generated from a hardcoded list of six fake team members (Alex Rivera, Jordan Smith, Casey Morgan, Riley Lee, Morgan Patel, Quinn Taylor).Tasks are pseudo-randomly assigned to these fictional members using a hash function, and completion/review counts are computed with arbitrary multipliers and offsets. None of these analytics reflect who actually created, completed, or reviewed tasks.
To Reproduce
GET /api/analytics.Expected Behavior
Member analytics should be derived from real data: who created tasks, who marked them done, who sent messages. If user attribution is not yet stored in the tasks/messages schema, the analytics should accurately state that per-member breakdowns are unavailable rather than fabricating them.
Actual Behavior
Six fictitious team members are returned with plausible-looking but entirely fabricated statistics.
Desktop
backend/controllers/analytics.controller.jsAdditional context
Expected NSOC points: level3 (significant feature correctness bug affecting core analytics functionality)
Labels:
bug,NSoC'26,level3Checklist: