Booking a meeting is easy. Clearing up after it is the work.

This week SimpleScrumTools started booking Scrum Events on its own. When a sprint becomes Active, the product puts the Sprint Review on the final Friday. If the team asks, it also puts a 15-minute Daily Scrum on every weekday. The booking was the small part. Most of the follow-up work went into what happens to a booked session that nobody uses.

Book once, at activation

We considered two designs. One was an hourly job that keeps each sprint’s calendar full. The other books everything in the same database transaction that activates the sprint. The job looked friendlier, because a setting changed mid-sprint would apply at once. But a job cannot tell a session that someone cancelled on purpose from one that was never booked. A tool that books a meeting you just cancelled is worse than a setting that waits a sprint. We chose activation.

Every time is the team’s wall clock. A Daily Scrum at 09:15 stays at 09:15 across a daylight-saving change in the middle of the sprint. We test that rule in Los Angeles in November and in Sydney in October, because UTC never changes its clocks.

A row you book is a row you must retire

Adding rows was easy. Then we followed one booked Daily Scrum through a sprint that ended early. The board shows only the Active sprint, and the board is the only place a Daily Scrum opens. So Thursday’s and Friday’s sessions could never open, and they would read “scheduled” forever.

We now cancel a sprint’s unopened Daily Scrums when someone ends, closes or cancels it. We do not cancel Reviews or Retrospectives at that point, because a team can hold either one after the sprint is over. A Review leaves the calendar in two cases instead: when the team opens a different Review for the same sprint, or when the next sprint starts. Every cancellation writes a line in the activity feed with its reason, so nothing disappears without a record.

The test run that found three more problems

Before release we run a 288-check function test against the hosted development copy. It uses throwaway accounts and the real HTTP routes, then deletes everything it made. The suite had passed: 3,398 tests, with the integration tests running against a real Postgres. The function test still found three problems that only show up in a running app. The first was a booked Review that stayed “scheduled” after the team ran its own. The second was a Review screen that opened on the wrong sprint. The third was a set of controls that were too small to tap on a phone. A green suite tells you that the code does what the tests ask. It does not tell you that the product does what a team needs.

The security review

We paired the function test with a security review of everything not yet in production. It found one real problem, and it was older than this week’s work: a pre-account takeover. That is a known class of defect for any site that lets you sign in either with a password or through a provider such as Google.

It came to light now because this release adds GitHub as a sign-in option. The review went through the step that links a provider sign-in to an existing account, and the defect was in that step. Google sign-in uses the same step, and has since SimpleScrumTools went live, so the defect was in production until this release. GitHub sign-in reaches production with the fix already in place. We tested the fix through the real sign-in routes, with and without the change.

That is all we will say about how the defect worked. If you have a question about your account, contact us.

How we test the tests

For each change this week we broke the code on purpose, one line at a time, and checked that a test failed. The security fixes took 18 such breaks, and in the end a test caught all 18. The first run let one through. In that test the second account had nothing to lose, so a change that reached every account instead of one still passed. We gave it something to lose, and the test caught the change.

Two other breaks this week got through because another check already covered the line we broke. We removed one redundant line, and wrote down why the other one stays. When a break gets through, we record it with the reason, so nobody assumes it was covered.

SimpleScrumTools is free for teams of up to 5 members, with no card required. Create a free account.