Skip to main content

Audit A — Stub Data + Dead Handlers Report

Generated: 2026-04-26 by automated audit. Part of Production Readiness Audit Plan.

CRITICAL (demo blockers) — 16 findings​

1. Entire /revenue-manager/* section is hardcoded mock — no live data​

  • src/app/(dashboard)/revenue-manager/portfolio/page.tsx:35-122 — MOCK_PROPERTIES (Mumbai Central, Goa Beach, Delhi CP, Bangalore MG, Jaipur Palace), KPIs derived from mocks. Fix: replace with useChainProperties().

2. /revenue-manager/strategy Save button only mutates local state​

  • …/strategy/page.tsx:117-120 — handleSave() just setSaved(true); setTimeout(setSaved, 2500). Fix: wire useUpdateRevenueStrategy() mutation to /analytics/revenue/strategy.

3. /revenue-manager/rate-grid displays MOCK_GRID​

  • …/rate-grid/page.tsx:44-81 — Hardcoded BAR/channel rates with literal date '2026-04-03'. Production tenant sees wrong rates.

4. /revenue-manager/compset competitors hardcoded (Taj Palace, ITC Grand, Radisson Blu)​

  • …/compset/page.tsx:58-69 — INITIAL_COMPETITORS + Math.random() rate generator.

5. /revenue-manager/performance ROI cards, automation stats, channel ROI all hardcoded​

  • …/performance/page.tsx:30-67, 80-150 — RM_ROI_CARDS, AUTOMATION_STATS, CHANNEL_ROI literals.

6. /control-center/exceptions "Assign owner" dropdown shows hardcoded staff list​

  • …/exceptions/page.tsx:230-236 — placeholderUsers = [{id: 'user-1', name: 'Duty Manager'}, ...]. Assigning sends literal user-1 as ownerId. Backend may accept the bogus FK.

7. Control-center catch { toast.success(...) } fakes success on API failure (CRITICAL — silent data loss)​

  • …/exceptions/page.tsx:201-203, 213-214, 527-528
  • …/actions/page.tsx:204-205, 223-224
  • 5 callsites in 2 files. User sees "success" toast even when API 500s.

8. /front-desk/key-cards "Encode New Card" submits empty payload + onError fakes success​

  • …/key-cards/page.tsx:215-218 — encodeMutation.mutate({ roomNumber: '', guestName: '' })
  • page.tsx:189-194 — replaceMutation.onError: () => toast.success('Key card replacement requested'). Agents think replacement worked when it didn't.

9. /spa/{therapists,treatments,packages} show fake data when API empty​

  • 3 files, ~250 LoC of mock. New spa tenants see fully-populated Maria Johnson, Swedish Massage, etc. Biggest demo embarrassment.

10. /control-center/today resort timeline 100% hardcoded​

  • …/today/page.tsx:23-50, 398 — mockTimelineEvents rendered unconditionally.

11. /marketing hub stats hardcoded + 3 broken nav links​

  • …/marketing/page.tsx:21-27, 46, 56, 66 — Cards link to /crm/email-templates, /crm/sms-blasts, /marketing/landing-pages marked // TODO: Create this route.

12. Dashboard home arrival cards have empty onClick​

  • src/app/(dashboard)/keynova.tsx:320 — onClick={() => {}} with cursor-pointer styling.

13. Reservation detail "View full profile" button has no onClick (issue #4 confirmed)​

  • …/reservations/[id]/keynova.tsx:1050-1052

14. Housekeeping room panel hardcoded VIP_CHECKLIST (8 items, identical for every guest) (issue #7 confirmed)​

  • …/housekeeping/keynova.tsx:142-151 — Same checklist for every selected room.

15. Housekeeping "View all →" for Team workload is a styled span without onClick​

  • …/housekeeping/keynova.tsx:544-554 — span with cursor:pointer but no handler.

16. Check-in keynova has hardcoded party "members" + fake key encoding (issue #5 part)​

  • …/check-in/[id]/keynova.tsx:355-367 — members = [{name: 'Primary guest', ...}, ...] hardcoded + handleEncodeKey toasts "Key encoded — KN-KEY-1" without calling any API. Front desk thinks card was encoded.

HIGH (visible to user, looks broken) — 23 findings​

17. /marketplace/[pluginId] Save Configuration is no-op (toast.info('Coming soon'))​

18. /settings/roles/[id] Save Changes is fake​

19. /settings/in-room-tech 4 dead buttons​

20. /settings/integrations/whatsapp 5 dead buttons (entire WhatsApp Business module)​

21. /settings/integrations/tally 2 dead buttons​

22. /settings/integrations/sap 2 dead buttons​

23. /settings/integrations Configure / Connect buttons all dead​

24. /settings/smart-locks Generate Mobile Key + Sync All Locks dead​

25. /settings/currency Add Currency + Save Configuration dead​

26. /settings/compliance Process DSAR button dead​

27. /housekeeping/lost-found "Register Found Item" header button dead​

28. /housekeeping/inventory/reorder 2 dead buttons (Add Rule, Create PO)​

29. /marketing 3 broken nav cards leading to non-existent pages​

30-35. UUID leakage (6 confirmed):​

  • cash-management/safe/page.tsx:148 — tx.performedBy
  • front-desk/phone/page.tsx:298 — call.createdBy
  • crm/dsar/[id]/page.tsx:246 — entry.performedBy
  • housekeeping/inventory/reorder/page.tsx:447 — po.createdBy
  • pos/hardware/page.tsx:468 — d.openedBy
  • housekeeping/maintenance/page.tsx:447 — request.assignedTo

36. POS receipts hardcode propertyName: 'Hotel'​

  • pos/orders/keynova.tsx:70-72 — Printed receipts say "Hotel" instead of property name. Affects GST receipts.

37. Housekeeping tasks Assignee is free-text Input, not user picker (issue #8 part)​

  • …/housekeeping/tasks/page.tsx:484-490 — <Input placeholder="Staff name (optional)">. Front desk types arbitrary string; no FK.

38. Canteen has hardcoded fallback outlet UUID​

  • …/canteen/keynova.tsx:130-138 — CANTEEN_FALLBACK_OUTLET_ID = 'e0000000-0000-4000-a000-000000000001'.

39. /revenue-manager/page.tsx mock fallback chain leaks fake KPIs into prod​

  • …/revenue-manager/page.tsx:122-158 — Empty array gets replaced with mocks. User sees fake "Deluxe — 87% confidence" suggestions.

MEDIUM (catches edge cases, partial functionality) — 11 findings​

40. /marketing/social-posts and /marketing/mentions errors don't use extractApiError​

41. Housekeeping ChecklistsTab empty placeholder — referenced page doesn't exist​

42. Housekeeping LinenTab placeholder​

43. CRM guest detail uses synthesised data with // TODO: Replace with real data​

45. /billing/keynova.tsx has 1 bare catch { with no toast — silent swallow​

46. /banquet/events/[id]/function-sheet/page.tsx toast.error swallows non-user-error case​

47. /crm/dsar/[id] and /settings/property use bare toast.error('Failed to ...') strings​

48. Banquet floor-plan editor: drag updates only local state, no unsaved-changes warning​

50. /settings/payment-providers/actions.ts:94 has hardcoded minimum fallback for dialog​

Summary stats​

  • Hardcoded mock arrays in shipped routes: 12 (revenue-manager x6, control-center timeline, spa x3, marketing, exceptions placeholderUsers)
  • Hardcoded mock fallback to disguise empty API: 4 (revenue-manager kpis/approvals, spa x3, canteen outlet)
  • toast.info('Coming soon') dead handlers: 24 occurrences across 12 files (settings/integrations dominates with 14)
  • Empty onClick={() => {}} handlers in shipped UI: 1 + 2 unwired (View full profile, View all →)
  • TODO markers in shipped paths: 6
  • UUID leak suspicions: 6 confirmed
  • Mutation catch { toast.success(...) } fakes-success on failure: 6 callsites in 3 files
  • Mutation onError: () => {} empty / no extractApiError: 14 (~40% of mutation handlers)
  • Forms with empty submit payload: 1 critical
  • Save buttons that only setLocal state: 1 critical
  • Hardcoded outlet/property/role UUIDs: 2

Top 10 prioritized fixes (by user-impact)​

  1. /revenue-manager/strategy handleSave — rate strategy "saves" but never persists.
  2. /control-center/exceptions and /actions catch { toast.success() } — 5 callsites silently lose operational data.
  3. /control-center/exceptions placeholderUsers Select — bogus FK.
  4. /front-desk/key-cards Encode New Card sends empty body — looks broken to FD agents.
  5. /front-desk/key-cards replaceMutation.onError fakes success.
  6. /spa/{therapists,treatments,packages} placeholders — biggest demo embarrassment.
  7. POS receipt prints propertyName: 'Hotel' — affects GST compliance.
  8. Whole /revenue-manager section — 100% mock; don't expose to demo customers.
  9. Dashboard home arrival card empty onClick + "View full profile" Button.
  10. Housekeeping VIP_CHECKLIST hardcoded — load from existing /housekeeping/checklists endpoint.