Roadmap TODOs
51 open
55 items
○
(security): done - Enforce secure session cookie flags (httponly, secure, samesite).
○
(auth): done - Added router-level admin guard as defense-in-depth for guessed admin URLs.
○
(ops): done - maintenance_mode gate added; public visitors see maintenance.php; admins/owners bypass it.
○
(test): done - mismatched-extension case added: file named .jpg with PNG bytes must produce .png filename.
○
(test): done - retry/backoff tests added: service retries on 5xx, does NOT retry on 4xx.
○
(auth): done - Enforce admin/owner-only access for admin routes.
○
(csrf): done - rotateCsrf() implemented; wire into each sensitive handler.
○
(auth): done - Require admin role for all admin sections except login/logout/setup.
○
(security): done - Added basic login throttling for admin login attempts.
○
(admin): [P3] show per-project sync result detail on sync-all completion page
○
(email): [P3] replace plain-text replies with reusable HTML email templates for consistent branding and readability.
○
(upload): done - MIME validated via finfo and extension derived from MIME map, not from the original filename.
○
(roadmap): [P3] keep source line numbers to improve traceability in roadmap UI.
○
(security): done - Fallback cookie flags for direct controller entry points.
○
(settings): done - contact_form_enabled gate respected; shows disabled-state when setting is off.
○
(download): Replace the placeholder CV PDF with the real file and verify the download route.
○
(news): Verify comment post/refresh flow so new comments are visible immediately after submit.
○
(profile): done - Reintroduced user settings page (language/public profile + skills management).
○
(profile): done - Added missing email notification preference in user settings migration.
○
(profile): [P3] add optional timezone setting support (users.timezone) and persist it in updateSettings().
○
(security): done - Validate login redirect as internal-only URL.
○
(security): done - Added basic login throttling for public login attempts.
○
(cron): done - last-run guard queries MAX(created_at) from project_sync_log; refuses if < 60 min ago.
○
(performance): done - tags loaded in a single batch query instead of one query per news item.
○
(security): done - safeDelete() verifies realpath stays inside uploads/news/ before unlink.
○
(security): done - safeDelete() verifies realpath stays inside uploads/projects/ before unlink.
○
(gallery): [P2] add drag-and-drop sort_order reordering in admin edit view
○
(security): done - safeDelete() verifies realpath stays inside uploads/projects/ before unlink.
○
items that are synced from ReadmeSync.API.
○
item (file, line, text, status, priority)
○
(roadmap): done - preserve manually-set 'done' status across syncs; existing done rows are kept done unless item disappears.
○
(roadmap): done - diff counters (new/kept/removed) now tracked and returned for the sync-all result page.
○
(profile): [P3] include users.timezone in this query after timezone migration lands.
○
(profile): [P3] extend this update with timezone column once users.timezone migration is added.
○
items.
○
(roadmap): done - callApi() retries up to 3 times with exponential backoff (0/400/1200 ms) on HTTP ≥500 or transport errors; bails immediately on 4xx.
○
(i18n): done - hardcoded E-mail/LinkedIn/GitHub headings and PDF suffix replaced with trans() keys. ?>
○
(dev-life): Deduplicate repeated Dev Life entries and trim misleading level labels. ?>
○
(dev-life): Fill or remove the blank Education & Certificates and Current Learning Goals sections. ?>
○
(content): Replace the placeholder FAQ content or remove the FAQ section entirely. ?>
✓
(responsive): [P2][done] Prevent long usernames from breaking navbar layout on standard screens.
○
(nav): done - Games removed from nav while section is WIP; route still works for direct access. ?>
○
(arch): [P2] this DB query runs inside the view on every page load for logged-in users.
○
(ui): done - footer mail button guarded; hides when PORTFOLIO_CONTACT_EMAIL env is empty. ?>
○
(ui): Refine auth heading and input contrast on login/register pages. ?>
✓
(roadmap-ui): [P2][done] Improve roadmap item readability in dark theme and keep cards fully responsive.
✓
(roadmap-ui): [P2][done] Show explicit P2/P3 priority badges in project roadmap detail view.
○
(projects): Remove or replace the Portfolio Website demo link and use a real website screenshot instead of Minecraft art. ?>
○
(ux): [P3] '/blob/main/' is hardcoded — repos may use 'master' or
○
list
○
(ui): done - Live badge removed from ReadmeSync header. ?>
○
(auth): Replace full-name registration with username-based signup and revisit forgot-password / delete-account-data flows. ?>
○
(ui): Refine auth heading and input contrast on login/register pages. ?>
✓
(responsive): [P2][done] Keep admin sidebar navigation scrollable without overlapping footer items.
○
(profile): Reconcile public settings with admin profile settings so duplicated controls have one clear source of truth. ?>