The bottom of uv.tpl has

<script src="uv/uv.js"></script>

whereas that should be

<script src="{{base_url}}/viewer/uv/uv.js"></script>

Initial user feedback suggests that we change the "remove" button in the /list view to be something else. Perhaps the functionality should be named "suppress" or something like that.

The title should link to the viewer page and the barcode to tind.

As reported internally at Caltech, some people experience a situation with the viewer page where the page keeps reloading rapidly and never showing the content.

Right now, when a new version goes live, we don't have a way to tell people what has changed. There ought to be a news page or recent changes list or something, somewhere. Perhaps it could be linked from the About page?

Staff users shouldn't have to wait on the cooling down period between loans of the same title.

This may only happen in debug mode, but if REMOTE_USER is not set, server.py doesn't check for None and some things fail.

A lot of code, e.g. in dibs.js, uses var when it should probably use let.

The code in uv.tpl should check if the user's browser has js enabled. The way it's done in item.tpl could be a model for how to do it.

query-dibs could have an option for listing the users known to the system. people-manager does that too, so maybe query-dibs could invoke the same functionality.

The structure of Person and GuestPerson behaves like GuestPerson is a subclass of Person. The Person class should be the parent and not sited to a specific database presentation or storage. A subclass would then be used for stored Person objects via the ORM. This will allow us to store a minimal class of users while allowing general access through the fact of having a Shibboleth/Basic Auth managed account.

Person class when instantiated holds a default user description with the uname assigned on instantiation (e.g. the value that Shibboleth passes as REMOTE_USER). It should contain the following attributes - uname, display_name, role. The person class would define a standard set of methods like has_role() these would return results based on the attributes held in the object instance.

A generalize function like person_from_environment() could then return a Person compatible object based on either the default Person class or the subclass where the attributes are populated via the ORM.

Ideally the server code should think all Person objects are the same but behind the scenes we only store rows in the SQL person table for specific people who require more than the minimum access.

The eventual goal is for people.py and people-manager to become a common package use across applications that we build for apps.library.caltech.edu.

The javascript-not-enabled warning flashes on the screen always, and may be visible for longer if the user is coming from a slow connection.

clicking the average loan duration column does not result in a meaningful sort by that column at all; when the page auto-reloads the order changes immediately to something else that is meaningless

We want to gather stats about which items are loaned out, when, and for how long, as a minimum set of stats. This needs to be done in a privacy-preserving way.

Currently navbar.tpl hardwires the path to the documentation at the "Help" link in the navbar. This should be configurable.

If you have 2 windows open on a loan item, and end the loan early in one window, the other window will still show the viewer but with none of the content accessible (you get spinning squares in the thumbnails). This happens because the viewer page only has a (self-contained) mechanism for time-based expiration and does not actively check if something else ended the loan. This needs to be fixed.

I'm pretty sure my uses of atomic() in server.py aren't doing what I think they're doing, and that they don't need to be used in all the places they are currently in.

The mobile UV viewer is missing some features that are available on desktop:

• No reservation timer
• No end loan button
• No contents panel
• Non-functional bookmark button - see screenshot (not present in desktop)

The HTML code surrounding the viewer disappears if the user invokes the full-screen feature of UV, so we need to put the button and timer inside, like Princeton did with theirs.

The auto-reloading on the stats page is a problem for viewers.

Currently we're using the single-threaded server option in Bottle. We should switch servers. This may have implications for software development, if we discover issues due to multithreaded operations on the database.

The run-server doesn't check for a minimum python version, but should.

In current version testing on dibs on apps.caltechlibrary.dev the people-manager shows the WARNING if you try to use secrets. The WARNING message should be "secret" not "secrets" or more specific about Basic Auth and htpasswd not being enabled. Second, had to use htpasswd to reset my password to finish testing. The database scheme needs to be updated so a warning about that would be have been helpful too.

Currently we have console log statements all over the JavaScript code. This should be cleaned up and the message printing turned off by default in production.

The template item.tpl has a hardcoded assumption on caltech.tind.io, which should be changed to a variable.

When you visit an /item page, you can still see old content. Not sure what the circumstances are, but the current browser-cache-prevention isn't working well enough.

See if there's a way to consolidate some of the network endpoints.

The text and elements on the item info page (nor any other page) does not resize well for smaller screens and mobile devices. This is independent of the UV widget and issue #60.

This could be used to dynamically adjust the cooling-off period.

Closing the viewer window does not end the loan, but initial user feedback says this is not obviousa.

The bottle session plugin uses Cookies. In addition to setting the cookie name and duration we also should set the cookie_secure status. False should set hte SameSite status to Lax and True should set it to Secure based on the Python 3.8 http.cookie support.

This can be rolled out in the next refresh for dibs.caltechlibrary.dev after we get some feed back.

It's currently not obvious that someone could start a loan on one device and continue on another device.

The time patrons must wait before being able to re-loan the same title needs to be adjusted lower, per initial user feedback. At this point, I think it makes sense to make the value configurable in the settings file, on the theory that different sites that use DIBS might want to use different values.

Currently, run-server only supports setting a REMOTE_USER in debug mode. However, during development, you really do want to be able to set the user to test adapter.wsgi too, but the latter is only used when debug mode is not in effect (i.e., when -m is either verbose or normal).

Now, it does turn out to be possible to set REMOTE_USER using --setenv when invoking mod_wsgi-express. However, this would weaken the security intentions; we originally wanted to have 2 things preventing someone from overriding security (use debug mode and use the -u flag), and so disconnecting -u from the mode would allow someone to use -u in any run mode. OTOH, we tell people not to use run-server in production, so maybe this doesn't matter?

Initial user feedback says that the list of items in /list should be sortable.

In some situation it seems the item page will display a message about "the item will be available at at unknown".

On mobile the viewer is extends past the window, which makes it hard to scroll through pages. The viewer size should reflect the phone screen size.

We should move the "copies in use" column off the /list page and have a separate page for stats where the info is updated automatically.

• footer doesn't stay stuck to the bottom when many items exist and page is scrolled
• when the height of the window and number of items is just right the add a new item button is blocked

If we need to do something on the server, we should announce it ahead of time. There should be a page or other way to display that.

As @rsdoiel wrote in a Slack conversation recently:

1. It'd be good to include an option to do a maintenance page while longer maintenance is happening
2. It'd be nice to be able to insert an "announcement" at the top of pages to let people know if something was coming up like, we'll be down for five minutes at 2:00pm for system updates.

Also from Robert:

On many of our systems you create an annoucement document and if it exists it's included in the template. For lone downtimes I think we set a boolean in the settings.ini so we display the page for all URLs request until we're back up. If maintence == true then redirect to maintenance page, continue as normal or something.

There are a lot of references to Caltech all over the HTML template files. At some point (possibly with input from another interested potential user group) we should make the templates configurable. At the very least, we could replace "Caltech" with a variable reference.

Whenever query-dibs is run, it should do the same process for expiring loans that the server does.

The file people.py is missing an import sys statement.

We're behind the latest version of UV.

Currently, we rely on a settings.ini file to set the values of certain configuration variables. The decouple package supports putting values into a .env file and reading values from the run-time Unix process environment (as described here, but we may want a more direct way to change values, perhaps via command-line arguments. In any case, this topic should be revisited at some point.

I'm thinking it would make sense to pull the tind code out into a separate Python package. Wouldn't take too much time and it would be conceptually cleaner, since there's no good reason to have tind-specific code in dibs per se.

The code in people.py can pick up the wrong copies of htpasswd and the password file. It should probably have full paths to those things. Also, the way it checks for output from htpasswd can mislead it into think there is an error when there is not.

The current simple way of handling the /list page leaves the values unchanged even if loans are taken out while a user is looking at the list. We should have a way to update the "Copies in use" column dynamically.

Currently, the implementation of Item in database.py includes fields for metadata like title, year, etc. These metadata fields are populated from the LSP/ILS at the time the Item object is created. The fields are used to fill out the /item page. Unfortunately, keeping this data cached introduces the problem that the metadata may be updated in the LSP but never be updated in the Item object kept in the database.

Getting the data dynamically every time /item pages are generated is not an option due to obvious performance reasons, but we should find a way to (e.g.) refresh the data, or otherwise avoid potential data inconsistencies.