todo.md
2026-08-12 - Immediate deployment status
Platform baseline
- [x] Run the declared smoke suite and record the real result.
- [x] Correct project status so scaffold and contract work is not reported as fully functional.
- [x] Preserve existing plugin manifests, routes, lifecycle scripts, and scaffold tests.
Persistence
- [x] Add a real SQLite-backed primary database configuration for the deployment path.
- [x] Add executable migration tracking through installer-driven schema creation.
- [x] Use real database transactions for installation, authentication, and website publishing flows.
- [x] Add integration coverage that proves records are written and read from a real database.
- [x] Prove the current installer and commerce stack against a real MariaDB server on Wednesday, August 12, 2026.
- [ ] Add production-targeted PostgreSQL migration runners beyond the current SQLite/MariaDB deployment path.
Central Authentication
- [x] Real user accounts with hashed passwords.
- [x] Login and logout with persistent session records.
- [x] Login attempt logging and account status enforcement.
- [x] User-to-company membership with active company context.
- [x] Password reset token flow.
- [x] Email verification token architecture.
- [x] OAuth-style client registration, redirect validation, authorization-code SSO, and access-token exchange.
- [x] Service credential issuance.
- [x] Audit logging for installation, auth, company, client, and website actions.
- [x] MFA TOTP enrolment, confirmation, recovery-code challenge, and disable flow for interactive sign-in.
- [ ] Google and Apple provider credential wiring with live provider testing.
Common Application Framework runtime
- [x] Real HTTP request handling from `public/index.php`.
- [x] Runtime bootstrap that routes auth, admin, and public website traffic.
- [x] Shared administration shell with navigation, account state, company switcher, forms, notices, 404 handling, and access control redirects.
- [x] Public website rendering through framework-owned host and path resolution.
- [ ] Richer middleware and policy composition beyond the current operational route layer.
Administration
- [x] Functional administration dashboard for users, companies, client registration, site creation, page creation, publish actions, plugin status visibility, health, and audit logs.
- [x] Administration routes require authentication.
- [x] Administration routes enforce explicit permissions instead of authentication-only access.
- [x] State-changing browser administration routes enforce CSRF validation.
- [x] Company switcher only exposes accessible companies and rotates session + CSRF tokens on switch.
- [ ] Advanced administration analytics, queue visualisation, and AI administration remain scaffold-only.
Website Builder
- [x] Multi-site persistence with hostname resolution.
- [x] Explicit endpoint records and generated Website Builder entrypoints that identify the active site without requiring hostname discovery, verified on Wednesday, August 12, 2026.
- [x] Domains, pages, parent path support, structured page content, draft/published state, and publication history records.
- [x] Two-site public rendering proof through the functional deployment smoke test.
- [x] Shared framework template and SEO-ready page metadata fields.
- [x] Tenant isolation on site, page, domain, and publish actions with manipulated public-ID denial coverage.
- [ ] Broaden explicit endpoint deployment coverage across auth/admin plus diagnostics, repair, and regeneration controls.
- [ ] Shared storage-backed media upload workflow in the operational admin UI.
- [ ] Redirect management UI and richer revision browsing.
- [ ] Visual editor and theme customization remain later-phase work.
Security hardening for first public testing
- [x] Active-company permission resolution no longer merges privileges from unrelated company memberships.
- [x] OAuth authorization codes validate active client, exact redirect URI, allowed scopes, company application access, single use, expiry, and PKCE for public-browser flows.
- [x] Browser-realistic cross-domain SSO creates application-local sessions instead of forwarding central auth cookies between hosts.
- [x] Password reset responses suppress reset tokens outside debug mode and route through the shared notification/email service path.
- [x] Explicit tenant-isolation and unauthorised-path tests now run in the functional deployment smoke on Windows.
- [ ] Public exposure still needs rate limiting, provider-backed email delivery wiring, scheduler hardening, and external HTTPS deployment verification before Internet-facing rollout.
Dependency hardening
- [x] Preserve existing dependency rules and current resolver.
- [x] Keep minimum and maximum framework compatibility checks, required dependencies, cycle detection, ordering, and reverse-dependency protection.
- [ ] Add richer optional dependency, capability-provider, and version-range enforcement as a follow-on hardening batch.
Deferred plugin modules
- [ ] ServiceVault - contract/scaffold present, functional implementation pending.
- [ ] Asset Registry - contract/scaffold present, functional implementation pending.
- [ ] Inventory Tracking - contract/scaffold present, functional implementation pending.
- [ ] Order Processing - contract/scaffold present, functional implementation pending.
- [x] E-commerce - first real commerce storefront, store configuration, cart, checkout, order, and public Website Builder route integration implemented on Wednesday, August 12, 2026.
- [x] Payments & Billing - checkout payment abstraction, provider diagnostics, development test provider, Stripe configuration scaffold, webhook intake, and idempotent payment tracking implemented on Wednesday, August 12, 2026.
- [x] Suppliers - authoritative supplier records and supplier-product relationship management implemented on Wednesday, August 12, 2026.
- [x] Products - authoritative catalogue, categories, pricing baseline, variants, and commerce-facing retrieval implemented on Wednesday, August 12, 2026.
- [ ] Lead Pipeline - contract/scaffold present, functional implementation pending.
- [ ] Project Tendering - contract/scaffold present, functional implementation pending.
- [ ] Business Intelligence & Reporting - contract/scaffold present, functional implementation pending.
2026-08-12 - Next controlled scope
- [ ] Add dedicated category CRUD administration forms instead of the current repository-assisted category creation path used by the commerce smoke.
- [ ] Expand public storefront filtering, pagination, and richer product media/document rendering on top of the first commerce stack.
- [ ] Add real Stripe outbound API execution once test credentials are provided and verify webhook signature enforcement against live test events.
- [ ] Add richer order-management mutations, refund actions, and optional Order Processing handoff worker consumption.