docs: final project closeout - classify TODO, backend spec, status
Classified every TODO.md item into one of DONE/BACKEND/PRODUCT
DECISION/FUTURE VERSION/BUG, verified against source, not against
prior docs:
- BACKEND items (bootstrap content, builder draft/publish, 6 admin
CRUD domains, media pipeline) confirmed already covered by
BACKEND_INTEGRATION.md; appended a mapping appendix rather than
duplicating raw bullets. Fixed 22 stale internal BACKEND_API.md
cross-references left over from before that file was archived.
- PRODUCT DECISION items (dark mode, brand-color WCAG contrast,
stars.component token gap, footer Contacts content, advanced
analytics, payment providers) moved to new docs/PRODUCT_BACKLOG.md.
- FUTURE VERSION items (Angular 22, bundle splitting, cart-modal
composition cleanup, hero-spacing investigation) moved to new
docs/FUTURE_FEATURES.md.
- BUG: rewrote docs/KNOWN-ISSUES.md down to the one real, verified,
currently-reproducible frontend bug (Ed25519 admin-auth error codes
session-expired/invalid-signature are unreachable -
toAuthErrorShape() never reads a body error code, only maps HTTP
status, and no status ever produces those two codes - confirmed by
reading auth.service.ts + auth-error.model.ts). Condensed the
"Fixed" history instead of carrying full verbose repro text forward.
- DONE items removed outright (dead-code deletion, dashboard false
positive, RC-02 fixes, stale "dynamic-renderer unwired"/"178 missing
keys" claims already disproven by source).
docs/TODO.md rewritten to the exact "no blockers" template - nothing
left qualifies as a release blocker.
New docs/PROJECT_STATUS.md: honest per-area status (frontend/backend/
docs/auth/builder/storefront/admin), known limitations, and explicit
production/backend/demo readiness calls - including correcting an
initial draft's unpushed-commit count (53, not 10, per git log
origin/B2B..HEAD).
New docs/NEXT_PHASE.md: work that can only start once a real backend
exists (gateway swap-in, mock removal, dormant-auth activation, role
enforcement, integration/E2E tests, perf profiling, monitoring,
maintenance-mode UI).
docs/PROJECT_INDEX.md (the stated entry point) updated to link the new
doc set and stop pointing at the now-archived BACKEND_API.md/AUTH.md.
docs/FRONTEND-ROADMAP.md's "Known open items" replaced with pointers
to the new category-split docs instead of a duplicated mixed list.
Not swept: a handful of low-traffic docs (architecture ADRs,
FRONTEND.md, EDITOR.md, ARCHITECTURE.md, PROJECT-STRUCTURE.md,
StaticPages.md, ADMIN.md) still reference the old BACKEND_API.md/
AUTH.md filenames - noted as a known gap in PROJECT_STATUS.md rather
than touched blindly, since they're historical-context docs, not the
navigation entry point.
2026-07-26 12:35:26 +04:00
# Known Issues
2026-07-15 20:25:12 +04:00
docs: final project closeout - classify TODO, backend spec, status
Classified every TODO.md item into one of DONE/BACKEND/PRODUCT
DECISION/FUTURE VERSION/BUG, verified against source, not against
prior docs:
- BACKEND items (bootstrap content, builder draft/publish, 6 admin
CRUD domains, media pipeline) confirmed already covered by
BACKEND_INTEGRATION.md; appended a mapping appendix rather than
duplicating raw bullets. Fixed 22 stale internal BACKEND_API.md
cross-references left over from before that file was archived.
- PRODUCT DECISION items (dark mode, brand-color WCAG contrast,
stars.component token gap, footer Contacts content, advanced
analytics, payment providers) moved to new docs/PRODUCT_BACKLOG.md.
- FUTURE VERSION items (Angular 22, bundle splitting, cart-modal
composition cleanup, hero-spacing investigation) moved to new
docs/FUTURE_FEATURES.md.
- BUG: rewrote docs/KNOWN-ISSUES.md down to the one real, verified,
currently-reproducible frontend bug (Ed25519 admin-auth error codes
session-expired/invalid-signature are unreachable -
toAuthErrorShape() never reads a body error code, only maps HTTP
status, and no status ever produces those two codes - confirmed by
reading auth.service.ts + auth-error.model.ts). Condensed the
"Fixed" history instead of carrying full verbose repro text forward.
- DONE items removed outright (dead-code deletion, dashboard false
positive, RC-02 fixes, stale "dynamic-renderer unwired"/"178 missing
keys" claims already disproven by source).
docs/TODO.md rewritten to the exact "no blockers" template - nothing
left qualifies as a release blocker.
New docs/PROJECT_STATUS.md: honest per-area status (frontend/backend/
docs/auth/builder/storefront/admin), known limitations, and explicit
production/backend/demo readiness calls - including correcting an
initial draft's unpushed-commit count (53, not 10, per git log
origin/B2B..HEAD).
New docs/NEXT_PHASE.md: work that can only start once a real backend
exists (gateway swap-in, mock removal, dormant-auth activation, role
enforcement, integration/E2E tests, perf profiling, monitoring,
maintenance-mode UI).
docs/PROJECT_INDEX.md (the stated entry point) updated to link the new
doc set and stop pointing at the now-archived BACKEND_API.md/AUTH.md.
docs/FRONTEND-ROADMAP.md's "Known open items" replaced with pointers
to the new category-split docs instead of a duplicated mixed list.
Not swept: a handful of low-traffic docs (architecture ADRs,
FRONTEND.md, EDITOR.md, ARCHITECTURE.md, PROJECT-STRUCTURE.md,
StaticPages.md, ADMIN.md) still reference the old BACKEND_API.md/
AUTH.md filenames - noted as a known gap in PROJECT_STATUS.md rather
than touched blindly, since they're historical-context docs, not the
navigation entry point.
2026-07-26 12:35:26 +04:00
Real, reproducible, currently-open frontend bugs only. Everything that needed a product/business decision moved to `docs/PRODUCT_BACKLOG.md` ; everything nice-to-have moved to `docs/FUTURE_FEATURES.md` ; everything backend-shaped moved to `docs/BACKEND_INTEGRATION.md` . Re-verified against source 2026-07-26.
2026-07-15 20:25:12 +04:00
## Open
docs: final project closeout - classify TODO, backend spec, status
Classified every TODO.md item into one of DONE/BACKEND/PRODUCT
DECISION/FUTURE VERSION/BUG, verified against source, not against
prior docs:
- BACKEND items (bootstrap content, builder draft/publish, 6 admin
CRUD domains, media pipeline) confirmed already covered by
BACKEND_INTEGRATION.md; appended a mapping appendix rather than
duplicating raw bullets. Fixed 22 stale internal BACKEND_API.md
cross-references left over from before that file was archived.
- PRODUCT DECISION items (dark mode, brand-color WCAG contrast,
stars.component token gap, footer Contacts content, advanced
analytics, payment providers) moved to new docs/PRODUCT_BACKLOG.md.
- FUTURE VERSION items (Angular 22, bundle splitting, cart-modal
composition cleanup, hero-spacing investigation) moved to new
docs/FUTURE_FEATURES.md.
- BUG: rewrote docs/KNOWN-ISSUES.md down to the one real, verified,
currently-reproducible frontend bug (Ed25519 admin-auth error codes
session-expired/invalid-signature are unreachable -
toAuthErrorShape() never reads a body error code, only maps HTTP
status, and no status ever produces those two codes - confirmed by
reading auth.service.ts + auth-error.model.ts). Condensed the
"Fixed" history instead of carrying full verbose repro text forward.
- DONE items removed outright (dead-code deletion, dashboard false
positive, RC-02 fixes, stale "dynamic-renderer unwired"/"178 missing
keys" claims already disproven by source).
docs/TODO.md rewritten to the exact "no blockers" template - nothing
left qualifies as a release blocker.
New docs/PROJECT_STATUS.md: honest per-area status (frontend/backend/
docs/auth/builder/storefront/admin), known limitations, and explicit
production/backend/demo readiness calls - including correcting an
initial draft's unpushed-commit count (53, not 10, per git log
origin/B2B..HEAD).
New docs/NEXT_PHASE.md: work that can only start once a real backend
exists (gateway swap-in, mock removal, dormant-auth activation, role
enforcement, integration/E2E tests, perf profiling, monitoring,
maintenance-mode UI).
docs/PROJECT_INDEX.md (the stated entry point) updated to link the new
doc set and stop pointing at the now-archived BACKEND_API.md/AUTH.md.
docs/FRONTEND-ROADMAP.md's "Known open items" replaced with pointers
to the new category-split docs instead of a duplicated mixed list.
Not swept: a handful of low-traffic docs (architecture ADRs,
FRONTEND.md, EDITOR.md, ARCHITECTURE.md, PROJECT-STRUCTURE.md,
StaticPages.md, ADMIN.md) still reference the old BACKEND_API.md/
AUTH.md filenames - noted as a known gap in PROJECT_STATUS.md rather
than touched blindly, since they're historical-context docs, not the
navigation entry point.
2026-07-26 12:35:26 +04:00
1. **Ed25519 admin-auth error codes `session-expired` and `invalid-signature` are unreachable — dead UI. **
`AuthError.code` is documented as routing to a dedicated recovery screen per code
(`core/auth/models/auth-error.model.ts:1-4` ), but `toAuthErrorShape()` in
`core/auth/services/auth.service.ts:110-118` derives the code for any real
`HttpErrorResponse` * exclusively * from `authErrorCodeFromStatus(error.status)`
(line 112) — it never reads the caller-supplied `fallbackCode` parameter for
real HTTP errors, and never reads any body-level error code from the response.
`authErrorCodeFromStatus()` (`auth-error.model.ts:21-32` ) only ever returns
`'unauthorized'` , `'forbidden'` , or `'backend-unavailable'` — there is no status
or body condition anywhere in the codebase that produces `'session-expired'` or
`'invalid-signature'` . Both screens exist and are wired, but are permanently
unreachable from any real backend response today.
- **Fix requires both sides**: a backend that returns a distinguishable
`error.code` in the response body (see `docs/ERROR_CONTRACT.md` ), and a small
frontend change to `toAuthErrorShape()` to prefer that body code over the
blanket status-based fallback.
- Found: 2026-07-26, Backend Finalization Sprint documentation pass (traced while
writing `docs/AUTHENTICATION.md` /`docs/ERROR_CONTRACT.md` ).
## Fixed (this cycle)
Condensed — full detail in commit history and `docs/RELEASE_REPORT.md` .
- App-wide query-param routing broken (P0) — `language.guard.ts` legacy redirect percent-encoded query strings into the path.
- Backoffice Categories CRUD broken end-to-end (P0) — wrong provider-mode fallback always picked the real HTTP gateway with no backend present.
- Cart/builder native `confirm()` /`alert()` (16 call sites) replaced with shared `app-confirm-dialog` / toast service.
- `getMainImage()` no-photo fallback and footer payment-icon assets referenced files that didn't exist — both fixed, `onerror` fallback added everywhere.
- Backoffice Monitoring showed raw HTTP/queue/webhook strings by default — now friendly wording with technical detail collapsed behind a `<details>` .
- Category/subcategory empty states used apology wording ("Oops!") for a normal zero-results state.
- `pages/category` , `pages/search` , `pages/item-detail` , `pages/info/**` , `pages/legal/**` (40+ files) were unrouted dead code — deleted.
- `dynamic-renderer/` was believed unwired — verified it's the live homepage rendering pipeline, no action needed.
- `admin/products/:id/edit` missing `canDeactivate` guard — added, mirrors categories.
- `primeng` /`primeicons` unused dependency — removed.
- Builder static-page body editor hidden inside a mislabeled collapsed section — un-hidden, relabeled.
- Several project-editor/admin-categories correctness bugs (footer icon id collisions, features toggle only driving one flag, languages silent duplicate no-op, static-pages slug collision, branding `socialImageUrl` never read, media-picker facade filter leakage between dialogs, categories draft-recovery/drag-reorder bugs, hardcoded locale-tab order) — see git history for the full per-bug list.
