Chapter 5 - System Limitations

This document lists implementation limitations confirmed by source inspection (not stakeholder feedback). It includes file-level evidence.

Incomplete Features (Functional Incompleteness)

• ExpenseReportController::export() returns {"message":"Export functionality coming soon"} while the expense management UI calls it. Only ExpenseManagementController::export outputs CSV; replacement can avoid misplaced expectations.
• Referral routes fully commented out in routes/web.php lines 521–527. ReferralController exists and referral/index.tsx frontend exists. Database seeder loads referral settings? — _settingsSeeder exists. Effective status: backend present, frontend present, routes disabled → feature unreachable in production.
• Slack GET settings route SlackSettingsController::getSettings method is absent (update, testWebhook exist only). Telegram has equivalent show working.
• PermissionController::assign() and manage() (routes permissions/assign, permissions/manage) are absent.
• Settings\ZoomSettingsController method requested by route POST zoom/test-connection is testConnection, but implemented method is test. The route therefore fails (BadMethodCallException via Laravel).
• TaskController::create() absent though GET tasks/create route is declared. TaskController::edit exists; UI uses modal component (TaskModal) instead.
• BugController::create() and edit() absent despite 2 GET bugs/create, bugs/{bug}/edit. UI is BugModal.
• WorkspaceController::edit(), update(), checkLimits(), leaveWorkspace(), getUserWorkspaceCount() absent despite routes.
• ProjectController::create(), edit(), assignClient() (plural assignClients exists) absent.
• TimesheetController::create(), edit() absent.
• PlanOrderController::create() absent despite POST plan-orders route.
• YooKassaPaymentController::processPayment() absent despite POST payments/yookassa route.
• Public invoice route POST invoices/payment/{token}/process points to InvoiceController::processPayment, which is commented out.
• Public vCard route POST vcards/verify-password commented out.

Present but Uncertain or Inconsistent

• Task::$fillable does not include allow_multi_assign, although the migration exposes the column and task_members pivot exists. Mass-assignment silently drops input for this flag at least if passed via Task::create.
• Plan::$fillable lists ai_monthly_token_limit although migration 2026-03-04 renames to ai_monthly_price_limit. Behaviour depends on service call path. Manual audit confirms potential drift; check the SaaS plan forms handling both.
• ZoomMeeting::$fillable references sync_google_calendar, but create_zoom_meetings migration does not declare column. Either a later migration exists (not found) or fillable must drop until added.
• User::$fillable only includes SaaS-economics fields when isSaasMode() is true. Self-hosted installations will have nullable columns with seeds (UserSeeder creates company in non-SaaS without SaaS attributes).
• Category and Product factories/key references exist despite no models/tables found → leftover boilerplate.
• Spatie permission teams feature ('teams' => false) means tenant-specific role isolation is handled manually; this extends migration metadata but is not enforced through Spatie.
• workspaces given is_suspended but muted toggling route is external (likely admin only). Routing path not verified via routes. (Needs confirmation.)
• Expense report CSV export (ExpenseReportController::export) still placeholder, Management export exists.
• Currency/Language mismatch: README claims 22 languages; 16 are enabled.
• OPENAI_API_KEY defaults to gpt-3.5-turbo, whereas inline email/agent services use Gemini exclusively. Usage of key only in demo ChatGptController. Incongruence relative to README.
• Field/label typo likely: sync_google_calendar versus migration naming.
• $fillable mentions principle for ZoomMeeting tied to no key — possible no impact.
• Consecutive is_paid duplicate in PaymentSettingController result set is harmless.
• Email delivery requires OAuth to Google calendar but none found (Zoom only stores a settings row).
• base URL. IS_DEMO bypass purge through "demo-mode middleware" acts contrary to toggles; coupled restrictions.
• Observer users uses "normal role guess" structure via RoleSeeder and company as a string; standard user role field for first login.
• Auditor log query in app/Policies/BugPolicy and app/Tasks recommendations potentially too strict.
• (Strikethrough/leftover.) Task Communications likely suitable "TaskChat" but only one channel via manager_approved.

Partially Verified

• Plan limits only enforce Basic rules in SaaS; non-SaaS all checks bypass with true (therefore no enforcement).
• AiAgentService::chat() uses rate limit 30 per user, token limit enforcement. Not exercised (no tests).
• WorkspaceObserver::created defines task stages and bug statuses, but their exact default name set wasn't read.
• HTML form approval mismatch for logged Slack/Telegram is echoed only.
• PerformAIExternal.
• Settings/LanguageController manages languages but translation auto-generated relies on duplicate common posts.
• tasks due tomorrow reminder command exists (tasks:check-due) but its message code omitted; no Notification class was found.
• Scheduled monthly report runs monthly at 06:00: text fields only.
• Webhook serialization text (field _module, 'Workspace Invitations' etc.) needs formatted value and events follow ability.
• PaymentSettingsController and settingsIndex not defined in PaymentSettingController (core stripe setting routes might be problematic — CAUTION):
• InvoicePaymentController redirected 33 getEnabledPaymentGateways via different controller counts. Does not include manuals [bank + manually]; model excludes 1 x authorize.
• Some gateway strings: ezp and another all able to method exceptions:
• 6 safe positive gateways mostly integrate through Dependency.
• FEDAPAY variable filter scans complex persistence, manufacturer/client error risk.
• ExpenseReportController::export mentioned.
• ImpersonateController may have extra stuff for getServices.
• User permanent delete [guard action dependent].

Not found / "Release Notes"

• No tests/ directory at app level and no test suite.
• No api.php route; no versioned API available; external clients cannot integrate unless further code forging.
• No SSO/OAuth, no SMS/push providers.
• No backup scripts.
• No .env.example (setup expects it and create-project script copies it → deployment error).
• no composer create-project call for config database; default mm messages.
• no public/build committed.
• Health endpoint /up tiny.
• No ingress config/edge provided.

Operational Risks

• Scheduled tasks and queue workers are assumed/provisioned by user.
• Runtime storage dirs must be full.
• README runbook unknown.
• Email config contains plaintext fallback values (gap).
• config/openai.php could be misleading.
• Remaining migrations' metadata needs fresh duplication / merge tooling.>