Peer review: a few small issues + what's working well

README.md

@@ -271,6 +271,10 @@ Things we scoped out for this version but would build next:
 
 ## AI Use Disclosure
 
+<!-- REVIEW: "-Julian" reads like a signature but it's placed before the section
+     it's attributing, not after (compare to "- Sean" further down, which
+     correctly follows his section). Worth moving below the paragraph it belongs to. -->
+
 -Julian
 
 I used an AI assistant (Claude Code, by Anthropic) during development, primarily as a **mentor/tutor rather than a code generator**.

db/config.js

@@ -1,6 +1,9 @@
 import { MongoClient } from "mongodb";
 import dotenv from "dotenv";
 
+// REVIEW: leftover from before the project was renamed to ClubSync? Worth
+// updating to match (or a comment noting it's intentional to avoid a DB
+// migration), since the name shows up in package.json too.
 export const DB_NAME = "group-sync";
 dotenv.config();
 const DEFAULT_URI = process.env.MONGO_URI;

db/users-db.js

@@ -43,6 +43,9 @@ function UsersCollection({ collectionName = "users" } = {}) {
         phoneNumber,
         duesStatus: DUES_STATUS.NOT_SUBMITTED,
         groupId: null,
+        // REVIEW: this is the string "null", not the null value used right above
+        // for groupId — was that intentional? A strict `=== null` check on
+        // duesTier elsewhere in the codebase would silently fail against this.
         duesTier: "null",
         duesAmount: null,
         discount: null,

desgin/DESIGN.md

@@ -1,3 +1,5 @@
+<!-- REVIEW: the containing folder is named "desgin" — looks like a typo for "design". -->
+
 # ClubSync — Design Document
 
 **Team:** Sean Behan, Julian Leonhardt

frontend/src/pages/member/member-dashboard/group-widget/GroupWidget.jsx

@@ -54,6 +54,8 @@ export default function GroupWidget() {
       if (!res.ok) {
         const data = await res.json().catch(() => ({}));
         setError(data.message ?? "Could not leave the club.");
+        // REVIEW: unlike the line above, this has no fallback — if res.json()
+        // fails and data is {}, this shows a "danger" toast with undefined text.
         showToast(data.message, "danger");
         return;
       }

middleware/auth.js

@@ -14,6 +14,8 @@ const ROLE_RANK = { member: 1, treasurer: 2, admin: 3 };
 // requireRole("treasurer") RETURNS a middleware that allows treasurer and above.
 // The inner function is what Express actually runs per request; it "remebers"
 // minRole via closure
+// REVIEW: typo "remebers" -> "remembers"; also the 401 message below has a
+// trailing space ("Not authenticated ") that doesn't match the one on line 8.
 
 export const requireRole = (minRole) => {
   return (req, res, next) => {