ThinkBoard Identified GitHub Issues

Below are 5 high-priority bugs, architectural flaws, and UX issues identified in the ThinkBoard codebase.

1. 📁 Missing Backend Routes and Controllers for Note Reordering and Stack Grouping

Title: [BUG/API-MISMATCH] Missing backend routes and controllers for note reordering and stack grouping
Type: Bug / API Mismatch
Description: The React frontend in HomePage.jsx contains full drag-and-drop code to move notes (handleMoveNote / handleReorderNotes) and combine notes into stack groups (handleCombineNotes / handleCreateGroup). These methods perform API requests to:
- PATCH /api/notes/:id/reorder
- POST /api/notes/group
However, the Express backend defines no routes or controllers matching these paths, resulting in permanent 404 Not Found responses when dragging cards.
Suggested Fix: Implement controllers for reorder and group in backend/src/controllers/notesController.js and mount them in backend/src/routes/notesRoutes.js.
GitHub Link: 👉 Create Issue on GitHub

Title: [BUG/DATA-INTEGRITY] Deleting a parent note leaves child notes orphaned in the database
Type: Bug / Data Integrity
Description: In backend/src/controllers/notesController.js, deleteNote only deletes the target note using Note.findOneAndDelete({ _id: id, userId: req.user._id }). Since sub-notes store a reference to their parent note container via parentId, deleting a parent note leaves its child notes orphaned in MongoDB. These children cannot be rendered because their parent node is missing, causing database bloat.
Suggested Fix: Modify deleteNote to fetch the note first and recursively delete all nested child notes whose parentId matches the deleted note's ID, or set up a Mongoose pre-hook.
GitHub Link: 👉 Create Issue on GitHub

Title: [BUG/UX] Users are unable to save empty content or clear notes
Type: Bug / UX
Description: Both the frontend (CreatePage.jsx and NoteDetailPage.jsx) and backend controllers enforce validation that both title and content must be present and non-empty. This prevents users from creating a note containing only a title (with blank content), or editing a note to wipe out its text content, showing "All fields are required" validation errors.
Suggested Fix: Allow content to be empty. Validate only that the title is non-empty.
GitHub Link: 👉 Create Issue on GitHub

Title: [BUG/ARCHITECTURE] Middleware ordering bug disables user-specific rate limiting
Type: Bug / Architecture
Description: In backend/src/server.js, the middleware registration order is:
```
app.use("/api", rateLimiter);
app.use("/api", optionalAuthenticateUser);
```
Since Express executes middlewares sequentially, the rate limiter runs before user authentication runs. Because req.user is not yet populated by the auth parser, req.user?._id inside rateLimiter.js is always undefined, causing the rate limiter to fall back to IP-based limits for all clients.
Suggested Fix: Reverse the registration order so that optionalAuthenticateUser executes first:
```
app.use("/api", optionalAuthenticateUser);
app.use("/api", rateLimiter);
```
GitHub Link: 👉 Create Issue on GitHub

Title: [BUG/SECURITY] Inconsistent JWT token extraction in optional authentication middleware
Type: Bug / Security
Description: The main authenticateUser middleware extracts JWT tokens from both cookies and the Authorization header. However, the optionalAuthenticateUser middleware defined inside backend/src/server.js only checks cookies (req.cookies?.token). This means clients authenticating using standard Authorization: Bearer <token> headers are not recognized as authenticated during the optional auth phase, resulting in them being subject to global/IP rate limits rather than user-specific rate limits.
Suggested Fix: Update optionalAuthenticateUser to check both cookies and req.headers.authorization.
GitHub Link: 👉 Create Issue on GitHub