lib/dsstore/datastore.go (15 lines):
	- line 70: // TODO: these fileds are only used for Info and are not related to the store.
	- line 116: // TODO: create the client for datastore in the main and inject it.
	- line 140: // TODO: delete this and pass the information directly rather than through store.
	- line 152: ctx := context.Background() /* TODO: pass ctx from request */
	- line 214: ctx := context.Background() /* TODO: pass ctx from request */
	- line 300: ctx := context.Background() /* TODO: pass ctx from request */
	- line 315: // TODO: handle pagination.
	- line 367: // TODO: ensure that the handling of last rev between write and delete are correct.
	- line 459: _, err := s.multiDelete(context.Background() /* TODO: pass ctx from request */, q, maxRowsPerBatchOperation)
	- line 540: dstx, err = s.client.NewTransaction(context.Background() /* TODO: pass ctx from request */)
	- line 542: dstx, err = s.client.NewTransaction(context.Background() /* TODO: pass ctx from request */, datastore.ReadOnly)
	- line 561: // TODO: get rid of this function and fix the code using it.
	- line 609: if err := s.client.Get(context.Background() /* TODO: pass ctx from request */, k, meta); err == datastore.ErrNoSuchEntity {
	- line 615: _, err := s.client.Put(context.Background() /* TODO: pass ctx from request */, k, meta)
	- line 754: dstx, err := tx.client.NewTransaction(context.Background() /* TODO: pass ctx from request */)


lib/handlerfactory/request_handler.go (8 lines):
	- line 36: // TODO: do not rely on registeration of routes at global mux for parsing names,
	- line 54: // TODO: Have LookupItem() return an error instead, so different errors can be handled
	- line 109: // TODO: move inside each service and don't pass NameChecker here.
	- line 134: // TODO: Replace NormalizeInput with a ParseReq that returns a request proto message.
	- line 135: // TODO: Explicitly pass the message to the service methods.
	- line 140: // TODO: get rid of LookupItem and move this inside the service methods.
	- line 192: // TODO: move outside this package. Service handlers should call it.
	- line 220: // TODO: use status err as early as possible, than we can get rid of this func.


lib/dam/token_flow.go (6 lines):
	- line 54: // TODO: remove this older path when DDAP no longer uses it
	- line 88: // TODO ttl params should remove.
	- line 189: // TODO: remove support for oldResourcePath
	- line 311: // TODO: remove support for oldResourcePath
	- line 332: // TODO: need support real policy filter
	- line 468: // TODO: move state checks to storage package.


lib/ic/ic.go (6 lines):
	- line 120: // TODO: remove these once DDAP BFF switches to use access token.
	- line 359: // TODO: should return error after front end supports nonce field.
	- line 369: // TODO: should return error after front end supports state field.
	- line 665: // TODO: consider skipping claims if idp=cfg.IdProvider[link.Provider] is missing (not <persona>) or idp.State != "ACTIVE".
	- line 758: // TODO: add config option for LinkedIdentities expiry.
	- line 1351: // TODO: move registeration of endpoints to main package.


lib/dam/dam.go (5 lines):
	- line 584: // TODO: consider separating acceptable errors (don't halt the request) from system errors that should return an error code.
	- line 990: // TODO: need a better struct or message for this case.
	- line 1071: // TODO: deep copy
	- line 1081: // TODO: deep copy
	- line 1476: // TODO: move registeration of endpoints to main package.


lib/auth/auth.go (4 lines):
	- line 137: // TODO: We use lazy load for verifier creation since now Hydra
	- line 259: // TODO: maybe should also cover content-length = -1
	- line 376: // TODO: token maybe leaked at this point, consider auto revoke or contact user/admin.
	- line 387: // TODO: token maybe leaked at this point, consider auto revoke or contact user/admin.


lib/storage/cache.go (4 lines):
	- line 35: // TODO: expire cache entries.
	- line 41: // TODO: cap cache memory size.
	- line 52: // TODO: expire cache entries.
	- line 58: // TODO: cap cache memory size.


lib/dam/endpoints.go (4 lines):
	- line 29: // TODO: rename to "accept" which is a more idiomatic OIDC name.
	- line 57: // TODO: remove the sub-paths and use filter and update mask parameters instead.
	- line 93: // TODO: remove and perform tests at the time of config update and reject
	- line 117: // TODO: remove these and reuse the config endpoint when the caller does not


lib/ga4gh/policy.go (3 lines):
	- line 137: // TODO: add to a passport visa tracker for all AccessTokenVisaFormat visas that were used to confirm access to check validity every hour (https://bit.ly/ga4gh-aai-profile#at-polling).
	- line 148: // TODO: can we check only the ones used in allow and deny?
	- line 164: // TODO: The specs only requires checking conditions on Visas that


deploy/build-templates/dam/entrypoint.bash (3 lines):
	- line 29: # TODO need to update after we deploy hydra on GCP.
	- line 32: # TODO need to update after we deploy hydra on GCP.
	- line 66: # TODO: should read from cloud store


deploy/build-templates/ic/entrypoint.bash (3 lines):
	- line 30: # TODO need to update after we deploy hydra on GCP.
	- line 34: # TODO need to update after we deploy hydra on GCP.
	- line 67: # TODO: should read from cloud store


lib/faketokensapi/fake_dam.go (2 lines):
	- line 67: // TODO: demux based on the platform from which the token is from.
	- line 96: // TODO: mux based on the platform from which the token is from.


lib/oathclients/endpoints.go (2 lines):
	- line 37: // TODO: double check the default values.
	- line 257: // TODO should use field mask for update.


lib/validator/policy_builder.go (2 lines):
	- line 182: // TODO: change this when using the new policy engine
	- line 198: // TODO: remove this helper function


lib/ga4gh/passport.go (2 lines):
	- line 62: // TODO: Replace identities with LinkedIdentities visas.
	- line 122: // TODO: Replace identities with LinkedIdentities visas.


lib/tokensapi/handler.go (2 lines):
	- line 87: // TODO should support filter parameters.
	- line 123: // TODO: need original err from provider to check if it is a "not found" err.


lib/saw/gc.go (2 lines):
	- line 24: // TODO: remove once the dependency between KeyGC and SAW are reversed.
	- line 28: // TODO: fix input parameters based on config file.


lib/ic/endpoints.go (2 lines):
	- line 58: // TODO: remove the sub-paths and use filter and update mask parameters instead.
	- line 102: // TODO: remove these and reuse the config endpoint when the caller does not


lib/permissions/permissions.go (2 lines):
	- line 87: // TODO Need to verify JWT before use.
	- line 88: // TODO Need to verify JWT from trust issuer and source.


lib/ga4gh/type.go (2 lines):
	- line 164: // TODO: use global regexp cache.
	- line 183: // TODO: add a (global) cache for r.


lib/translator/dbgap.go (2 lines):
	- line 37: // TODO: Update the issuer address once NCBI stands up their own OIDC endpoint.
	- line 240: // TODO: Verify that the heuristics for de-duplicating access entries is correct.


lib/ic/configadmin.go (2 lines):
	- line 100: // TODO: consider upgrading older config versions automatically.
	- line 415: // TODO: consider requiring an "admin" scope (modify all admin handlerSetup calls).


lib/httputils/response.go (2 lines):
	- line 73: // TODO: move to a test package.
	- line 82: // TODO: move to a test package.


lib/httputils/resources.go (2 lines):
	- line 18: // TODO: not related to http, move to a more appripriate package.
	- line 49: // TODO: move this block to caller.


lib/saw/warehouse.go (2 lines):
	- line 138: // TODO: reverese the dependency.
	- line 289: // TODO: instead of turning duration to string and comparing strings, the string ValidAfterTime should be converted to time and compared using time comparison.


deploy/build-gke-templates/ic/entrypoint.bash (2 lines):
	- line 28: # TODO need to update after we deploy hydra on GCP.
	- line 32: # TODO need to update after we deploy hydra on GCP.


lib/scim/scim_user.go (2 lines):
	- line 337: // TODO: support for boolean input for "active" field instead of strings
	- line 772: // TODO: handle more complex substructure and remove "object" field.


lib/hydra/hydra.go (2 lines):
	- line 153: // TODO: consider support page param.
	- line 231: // TODO: figure out what error from hydra should handle.


lib/tokensapi/gcp.go (2 lines):
	- line 50: // TODO: Should pass error from GRPC call to here for better error code.
	- line 72: // TODO: Should pass error from GRPC call to here for better error code.


lib/aws/warehouse.go (2 lines):
	- line 185: // TODO: get PathPrefix from config
	- line 585: // TODO: Make prefix configurable for different dam deployments


lib/storage/storage.go (1 line):
	- line 143: // TODO: make this smarter.


lib/scim/scim.go (1 line):
	- line 62: // TODO: move state checks to storage package.


prepare_project.bash (1 line):
	- line 92: # TODO: make region configurable.


lib/process/process.go (1 line):
	- line 807: // TODO: use new status errors and detect this better


lib/auditlog/auditlog.go (1 line):
	- line 173: ctx := context.Background() /* TODO: pass context to here */


lib/dam/configadmin.go (1 line):
	- line 105: // TODO: consider upgrading older config versions automatically.


lib/ga4gh/identity.go (1 line):
	- line 176: // TODO: use new policy engine instead when it becomes available.


lib/hydraproxy/proxy.go (1 line):
	- line 64: // TODO: should unify with HydraOAuthToken in DAM.


lib/dam/auth.go (1 line):
	- line 15: // TODO move to damauth package.


prepare_project_gke.bash (1 line):
	- line 107: # TODO: make region configurable.


lib/storage/util.go (1 line):
	- line 85: // TODO: perhaps this should be the empty list?


lib/ic/info_release.go (1 line):
	- line 235: // TODO: remove this extra "ga4gh" check once DDAP is compatible.


lib/saw/retry.go (1 line):
	- line 30: // TODO: Extend this function's logic if other types of errors need


lib/faketokensapi/fake_stub.go (1 line):
	- line 49: // TODO: move these fakes to test file once implemented.


lib/persona/broker.go (1 line):
	- line 363: // TODO: move registeration of endpoints to main package.


deploy/build-gke-templates/hydra-ic/entrypoint.bash (1 line):
	- line 24: # TODO: should read from cloud store


lib/ga4gh/condition.go (1 line):
	- line 147: // TODO: add tests for this file.


lib/scim/scim_helper.go (1 line):
	- line 48: // TODO: update account properties and account profile


lib/translator/translator.go (1 line):
	- line 38: // TODO: use JWKS to discover the /userinfo endpoint.


proto/auditlogs/v0/auditlogs.proto (1 line):
	- line 73: // TODO: consider making this an enum.


lib/ga4gh/visa.go (1 line):
	- line 177: // TODO: move to a testutil package.


assets/serve/js/client_login.js (1 line):
	- line 113: // TODO: don't pass pararameters as URL parameters.


lib/ic/auth.go (1 line):
	- line 15: // TODO move to icauth package.


lib/processgc/gc.go (1 line):
	- line 59: // TODO: reverse the dependency, this package doesn't need to know about process.


lib/timeutil/timeutil.go (1 line):
	- line 181: // TODO: use standard time functions for other platforms if https://github.com/golang/go/issues/20629 is implemented.


proto/auditlogs/v0/auditlogs.pb.go (1 line):
	- line 133: // TODO: consider making this an enum.


deploy.bash (1 line):
	- line 17: # TODO: initial steps


deploy-gke.bash (1 line):
	- line 17: # TODO: initial steps


lib/adapter/gatekeeper_adapter.go (1 line):
	- line 103: // TODO: support standard audience formats instead of space-delimited.