# Admin System Gap Analysis Report
*Generated: 2026-04-03 12:23:47*

## 📊 Executive Summary

- **Total hardcoded business values found:** 228
- **API modules analyzed:** 23
- **Modules missing admin endpoints:** 20

## 🔍 Hardcoded Business Values

These values should be moved to `system_parameters` table for dynamic configuration.

| File | Line | Variable | Value | Context |
|------|------|----------|-------|---------|
| `create_integration_session.py` | 26 | `TEST_EMAIL` | `"tester_pro@profibot.hu..."` | `TEST_EMAIL = "tester_pro@profibot.hu"` |
| `create_integration_session.py` | 27 | `TEST_PASSWORD` | `"TestPassword123!..."` | `TEST_PASSWORD = "TestPassword123!"` |
| `create_integration_session.py` | 117 | `output_path` | `"/opt/docker/dev/service_finder/tests/integration_s..."` | `output_path = "/opt/docker/dev/service_finder/tests/integration_session.json"` |
| `test_schema_changes.py` | 14 | `DATABASE_URL` | `"postgresql+asyncpg://postgres:postgres@postgres:54..."` | `DATABASE_URL = "postgresql+asyncpg://postgres:postgres@postgres:5432/service_finder"` |
| `test_token_refresh.py` | 10 | `base_url` | `"http://sf_api:8000..."` | `base_url = "http://sf_api:8000"` |
| `test_token_refresh_simple.py` | 10 | `base_url` | `"http://sf_api:8000..."` | `base_url = "http://sf_api:8000"` |
| `test_token_debug.py` | 10 | `base_url` | `"http://sf_api:8000..."` | `base_url = "http://sf_api:8000"` |
| `test_complete_flow.py` | 18 | `API_BASE` | `"http://localhost:8000..."` | `API_BASE = "http://localhost:8000"` |
| `test_complete_flow.py` | 160 | `email` | `"tester_pro@profibot.hu..."` | `email = "tester_pro@profibot.hu"` |
| `test_complete_flow.py` | 161 | `password` | `"Password123!..."` | `password = "Password123!"` |
| `test_final_verification.py` | 13 | `API_BASE` | `"http://sf_api:8000/api/v1..."` | `API_BASE = "http://sf_api:8000/api/v1"` |
| `test_final_verification.py` | 14 | `EMAIL` | `"tester_pro@profibot.hu..."` | `EMAIL = "tester_pro@profibot.hu"` |
| `test_final_verification.py` | 15 | `PASSWORD` | `"Password123!..."` | `PASSWORD = "Password123!"` |
| `test_minimal_verification.py` | 12 | `API_BASE` | `"http://sf_api:8000/api/v1..."` | `API_BASE = "http://sf_api:8000/api/v1"` |
| `test_minimal_verification.py` | 13 | `EMAIL` | `"tester_pro@profibot.hu..."` | `EMAIL = "tester_pro@profibot.hu"` |
| `test_minimal_verification.py` | 14 | `PASSWORD` | `"Password123!..."` | `PASSWORD = "Password123!"` |
| `test_debug_switch.py` | 10 | `API_BASE` | `"http://sf_api:8000/api/v1..."` | `API_BASE = "http://sf_api:8000/api/v1"` |
| `test_debug_switch.py` | 11 | `EMAIL` | `"tester_pro@profibot.hu..."` | `EMAIL = "tester_pro@profibot.hu"` |
| `test_debug_switch.py` | 12 | `PASSWORD` | `"Password123!..."` | `PASSWORD = "Password123!"` |
| `test_check_response.py` | 10 | `API_BASE` | `"http://sf_api:8000/api/v1..."` | `API_BASE = "http://sf_api:8000/api/v1"` |
| `test_check_response.py` | 11 | `EMAIL` | `"tester_pro@profibot.hu..."` | `EMAIL = "tester_pro@profibot.hu"` |
| `test_check_response.py` | 12 | `PASSWORD` | `"Password123!..."` | `PASSWORD = "Password123!"` |
| `test_decode_token.py` | 11 | `API_BASE` | `"http://sf_api:8000/api/v1..."` | `API_BASE = "http://sf_api:8000/api/v1"` |
| `test_decode_token.py` | 12 | `EMAIL` | `"tester_pro@profibot.hu..."` | `EMAIL = "tester_pro@profibot.hu"` |
| `test_decode_token.py` | 13 | `PASSWORD` | `"Password123!..."` | `PASSWORD = "Password123!"` |
| `test_makes_filter.py` | 12 | `base_url` | `"http://sf_api:8000..."` | `base_url = "http://sf_api:8000"` |
| `test_makes_filter.py` | 13 | `token` | `"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0Z..."` | `token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0ZXJfcHJvQHByb2ZpYm90Lmh1IiwiZXhwIjoxNz` |
| `create_vehicle_for_org.py` | 36 | `url` | `"http://sf_api:8000/api/v1/assets/vehicles..."` | `url = "http://sf_api:8000/api/v1/assets/vehicles"` |
| `create_vehicle_via_api.py` | 9 | `BASE_URL` | `"http://192.168.100.10:8000..."` | `BASE_URL = "http://192.168.100.10:8000"` |
| `test_auth_e2e.py` | 42 | `base_url` | `"http://localhost:8000/api/v1..."` | `base_url = "http://localhost:8000/api/v1"` |
| `test_auth_e2e.py` | 43 | `email` | `"test_architect@example.com..."` | `email = "test_architect@example.com"` |
| `test_auth_e2e.py` | 44 | `password` | `"TestPassword123!..."` | `password = "TestPassword123!"` |
| `test_auth_e2e.py` | 121 | `delete_resp_status_code` | `200` | `delete_resp_status_code = 200` |
| `test_asset_e2e_direct.py` | 13 | `user1_id` | `2` | `user1_id = 2` |
| `test_asset_e2e_direct.py` | 14 | `user2_id` | `3` | `user2_id = 3` |
| `app/api/v1/endpoints/expenses.py` | 42 | `limit` | `10` | `limit = 10` |
| `app/api/v1/endpoints/services.py` | 75 | `new_level` | `80` | `new_level = 80` |
| `app/models/core_logic.py` | 17 | `__tablename__` | `"subscription_tiers..."` | `__tablename__ = "subscription_tiers"` |
| `app/models/core_logic.py` | 29 | `__tablename__` | `"org_subscriptions..."` | `__tablename__ = "org_subscriptions"` |
| `app/models/core_logic.py` | 48 | `__tablename__` | `"credit_logs..."` | `__tablename__ = "credit_logs"` |
| `app/models/core_logic.py` | 64 | `__tablename__` | `"service_specialties..."` | `__tablename__ = "service_specialties"` |
| `app/models/reference_data.py` | 7 | `__tablename__` | `"reference_lookup..."` | `__tablename__ = "reference_lookup"` |
| `app/models/identity/identity.py` | 26 | `region_admin` | `"region_admin..."` | `region_admin = "region_admin"` |
| `app/models/identity/identity.py` | 27 | `country_admin` | `"country_admin..."` | `country_admin = "country_admin"` |
| `app/models/identity/identity.py` | 29 | `sales_agent` | `"sales_agent..."` | `sales_agent = "sales_agent"` |
| `app/models/identity/identity.py` | 31 | `service_owner` | `"service_owner..."` | `service_owner = "service_owner"` |
| `app/models/identity/identity.py` | 32 | `fleet_manager` | `"fleet_manager..."` | `fleet_manager = "fleet_manager"` |
| `app/models/identity/identity.py` | 207 | `__tablename__` | `"verification_tokens..."` | `__tablename__ = "verification_tokens"` |
| `app/models/identity/identity.py` | 221 | `__tablename__` | `"social_accounts..."` | `__tablename__ = "social_accounts"` |
| `app/models/identity/identity.py` | 239 | `__tablename__` | `"active_vouchers..."` | `__tablename__ = "active_vouchers"` |

*... and 178 more findings*

## 🏗️ Admin Endpoints Analysis

### Modules with Admin Prefix

*No modules have `/admin` prefix*

### Modules with Admin Routes (but no prefix)

*No mixed admin routes found*

## ⚠️ Critical Gaps: Missing Admin Endpoints

These core business modules lack dedicated admin endpoints:

- **users** - No `/admin` prefix and no admin routes
- **vehicles** - No `/admin` prefix and no admin routes
- **services** - No `/admin` prefix and no admin routes
- **assets** - No `/admin` prefix and no admin routes
- **organizations** - No `/admin` prefix and no admin routes
- **billing** - No `/admin` prefix and no admin routes
- **gamification** - No `/admin` prefix and no admin routes
- **analytics** - No `/admin` prefix and no admin routes
- **security** - No `/admin` prefix and no admin routes
- **documents** - No `/admin` prefix and no admin routes
- **evidence** - No `/admin` prefix and no admin routes
- **expenses** - No `/admin` prefix and no admin routes
- **finance_admin** - No `/admin` prefix and no admin routes
- **notifications** - No `/admin` prefix and no admin routes
- **reports** - No `/admin` prefix and no admin routes
- **catalog** - No `/admin` prefix and no admin routes
- **providers** - No `/admin` prefix and no admin routes
- **search** - No `/admin` prefix and no admin routes
- **social** - No `/admin` prefix and no admin routes
- **system_parameters** - No `/admin` prefix and no admin routes

### Recommended Actions:
1. Create `/admin` prefixed routers for each missing module
2. Implement CRUD endpoints for administrative operations
3. Add audit logging and permission checks

## 🚀 Recommendations

### Phase 1: Hardcode Elimination
1. Create `system_parameters` migration if not exists
2. Move identified hardcoded values to database
3. Implement `ConfigService` for dynamic value retrieval

### Phase 2: Admin Endpoint Expansion
1. Prioritize modules with highest business impact:
   - `users` (user management)
   - `billing` (financial oversight)
   - `security` (access control)
2. Follow consistent pattern: `/admin/{module}/...`
3. Implement RBAC with `admin` and `superadmin` roles

### Phase 3: Monitoring & Audit
1. Add admin action logging to `SecurityAuditLog`
2. Implement admin dashboard with real-time metrics
3. Create automated health checks for admin endpoints

## 🔧 Technical Details

### Scan Parameters
- Project root: `/app`
- Files scanned: Python files in `/app`
- Business patterns: 25
- Trivial values excluded: 1, '', True, "", {}, 0, [], None, False