Todo

TODO.md

@@ -0,0 +1,139 @@
+# CMS Todo And Progress
+
+This file is the single source of truth for roadmap and delivery progress.
+
+## Status Legend
+
+- [ ] Planned
+- [~] Partially done
+- [x] Done
+
+## MVP 0: Foundations
+
+### MVP1 Gate: Mandatory Before Feature Work
+
+- [ ] RBAC domain model finalized (roles, permissions, resource scopes)
+- [ ] RBAC enforcement at route and action level in admin
+- [ ] Permission matrix documented and tested
+- [ ] Reusable CRUD base patterns (list/detail/editor/service/repository)
+- [ ] Shared CRUD validation strategy (Zod + server-side enforcement)
+- [ ] Shared error and audit hooks for CRUD mutations
+
+### Admin App
+
+- [x] Separate Next.js admin app in monorepo
+- [x] App Router + TypeScript + `src/` structure
+- [x] Shared DB access via `@cms/db`
+- [~] Base admin dashboard shell and roadmap page (`/todo`)
+- [ ] Authentication and session model (`admin`, `editor`, `manager`)
+- [ ] Protected admin routes and session handling
+- [ ] Core admin IA (pages/media/users/commissions/settings)
+
+### Public App
+
+- [x] Separate Next.js public app in monorepo
+- [x] App Router + TypeScript + `src/` structure
+- [~] Public app connected to shared data layer
+- [ ] Public layout system (header/footer/navigation)
+- [ ] Header banner rendering from CMS-managed content
+- [ ] Basic SEO defaults (metadata, OG, sitemap, robots)
+
+### Testing
+
+- [x] Vitest + Testing Library + MSW baseline
+- [x] Playwright baseline with web/admin projects
+- [ ] CI workflow for lint/typecheck/unit/e2e gates
+- [ ] Test data strategy (seed fixtures + isolated e2e data)
+- [ ] RBAC policy unit tests and permission regression suite
+- [ ] CRUD contract tests for shared service patterns
+
+### Delivery Pipeline And Runtime
+
+- [x] Theoretical Gitea Actions workflow scaffold (`.gitea/workflows/ci-cd-theoretical.yml`)
+- [x] Bun-based Dockerfiles for public and admin apps
+- [x] Staging and production docker-compose templates
+- [ ] Registry credentials and image push strategy
+- [ ] Staging deployment automation against real host
+- [ ] Production promotion and rollback procedure
+
+## MVP 1: Core CMS Business Features
+
+### Admin App (Primary Focus)
+
+- [ ] Page management (create/edit/publish/unpublish/schedule)
+- [ ] Navigation management (menus, nested items, order, visibility)
+- [ ] Media library (upload, browse, replace, delete)
+- [ ] Media enrichment metadata (alt text, copyright, author, source, tags)
+- [ ] Media refinement for artworks (medium, dimensions, year, framing, availability)
+- [ ] Users management (invite, roles, status)
+- [ ] Commissions management (request intake, owner, due date, notes)
+- [ ] Kanban workflow for commissions (new, scoped, in-progress, review, done)
+- [ ] Header banner management (message, CTA, active window)
+
+### Public App
+
+- [ ] Dynamic page rendering from CMS page entities
+- [ ] Navigation rendering from managed menu structure
+- [ ] Media entity rendering with enrichment data
+- [ ] Artwork views and listing filters
+- [ ] Commission request submission flow
+- [ ] Header banner render logic and fallbacks
+
+### News / Blog (Secondary Track)
+
+- [ ] News/blog content type (not primary CMS domain)
+- [ ] Admin list/editor for news posts
+- [ ] Public news index + detail pages
+- [ ] Tag/category and basic archive support
+
+### Testing
+
+- [ ] Unit tests for content schemas and service logic
+- [ ] Component tests for admin forms (pages/media/navigation)
+- [ ] E2E happy paths: create page, publish, see on public app
+- [ ] E2E happy paths: media upload + artwork refinement display
+- [ ] E2E happy paths: commissions kanban transitions
+
+## MVP 2: Production Readiness
+
+### Admin App
+
+- [ ] Audit log for key content operations
+- [ ] Revision history for pages/navigation/media metadata
+- [ ] Permission matrix refinement with granular scopes
+- [ ] Error boundaries and UX fallback states
+
+### Public App
+
+- [ ] Revalidation strategy and cache tuning
+- [ ] Performance budget checks (Core Web Vitals)
+- [ ] 404/500 content-aware error pages
+- [ ] Accessibility review and fixes
+
+### Platform
+
+- [x] Bun workspace + Biome + Turbo baseline
+- [x] Prisma + PostgreSQL baseline
+- [ ] Monitoring and alerting baseline
+- [ ] Backup and migration rollback playbook
+- [ ] Release/versioning checklist per environment
+
+### Testing
+
+- [ ] Visual regression workflow for critical templates
+- [ ] Load/perf tests for key public routes
+- [ ] Flake tracking and quarantine policy for e2e
+- [ ] Coverage thresholds and enforcement policy
+
+## Discovery Log
+
+- [2026-02-10] Prisma client must be generated before app/e2e startup to avoid runtime module errors.
+- [2026-02-10] `bun test` conflicts with Playwright-style test files; keep e2e files on `*.pw.ts` and run e2e via Playwright.
+- [2026-02-10] Linux Playwright runtime depends on host packages; browser setup may require `playwright install --with-deps`.
+
+## How We Use This File
+
+- Mark completed items by switching `[ ]` to `[x]`.
+- Mark ongoing work by switching `[ ]` to `[~]`.
+- Add new findings to Discovery Log with date.
+- Keep MVP scope changes in this file first, then implement.