Create P3_assigned-feedback.md

[clbarry]

Project 3 Assigned Feedback

[tonyzhang0510]

Strengths

• Role-based access control is done well, and events are correctly scoped so users only ever see their own club's data.
• Dues state changes use atomic database updates that prevent a member from submitting twice or slipping into an invalid state.
• The code never exposes password hashes to the client, and database queries only pull the fields each page actually needs.

Weaknesses

• Some treasurer and group endpoints trust the group ID in the URL without checking who's asking, so a treasurer from one club can see another club's members and dues.
• An admin can lower their own role or demote another admin, which could leave a club with no admin at all.
• When a member submits dues, they get marked "pending" before the submission is actually saved, so if that step fails they're stuck with nothing for the treasurer to review.
• The member's dues tier gets saved as the word "null" instead of a real empty value, which can quietly break checks later on.