Files

sdarbinyan d03ef2db50 docs: final project closeout - classify TODO, backend spec, status

Classified every TODO.md item into one of DONE/BACKEND/PRODUCT
DECISION/FUTURE VERSION/BUG, verified against source, not against
prior docs:

- BACKEND items (bootstrap content, builder draft/publish, 6 admin
  CRUD domains, media pipeline) confirmed already covered by
  BACKEND_INTEGRATION.md; appended a mapping appendix rather than
  duplicating raw bullets. Fixed 22 stale internal BACKEND_API.md
  cross-references left over from before that file was archived.
- PRODUCT DECISION items (dark mode, brand-color WCAG contrast,
  stars.component token gap, footer Contacts content, advanced
  analytics, payment providers) moved to new docs/PRODUCT_BACKLOG.md.
- FUTURE VERSION items (Angular 22, bundle splitting, cart-modal
  composition cleanup, hero-spacing investigation) moved to new
  docs/FUTURE_FEATURES.md.
- BUG: rewrote docs/KNOWN-ISSUES.md down to the one real, verified,
  currently-reproducible frontend bug (Ed25519 admin-auth error codes
  session-expired/invalid-signature are unreachable -
  toAuthErrorShape() never reads a body error code, only maps HTTP
  status, and no status ever produces those two codes - confirmed by
  reading auth.service.ts + auth-error.model.ts). Condensed the
  "Fixed" history instead of carrying full verbose repro text forward.
- DONE items removed outright (dead-code deletion, dashboard false
  positive, RC-02 fixes, stale "dynamic-renderer unwired"/"178 missing
  keys" claims already disproven by source).

docs/TODO.md rewritten to the exact "no blockers" template - nothing
left qualifies as a release blocker.

New docs/PROJECT_STATUS.md: honest per-area status (frontend/backend/
docs/auth/builder/storefront/admin), known limitations, and explicit
production/backend/demo readiness calls - including correcting an
initial draft's unpushed-commit count (53, not 10, per git log
origin/B2B..HEAD).

New docs/NEXT_PHASE.md: work that can only start once a real backend
exists (gateway swap-in, mock removal, dormant-auth activation, role
enforcement, integration/E2E tests, perf profiling, monitoring,
maintenance-mode UI).

docs/PROJECT_INDEX.md (the stated entry point) updated to link the new
doc set and stop pointing at the now-archived BACKEND_API.md/AUTH.md.
docs/FRONTEND-ROADMAP.md's "Known open items" replaced with pointers
to the new category-split docs instead of a duplicated mixed list.

Not swept: a handful of low-traffic docs (architecture ADRs,
FRONTEND.md, EDITOR.md, ARCHITECTURE.md, PROJECT-STRUCTURE.md,
StaticPages.md, ADMIN.md) still reference the old BACKEND_API.md/
AUTH.md filenames - noted as a known gap in PROJECT_STATUS.md rather
than touched blindly, since they're historical-context docs, not the
navigation entry point.

2026-07-26 12:35:26 +04:00

5.9 KiB

Raw Blame History

Project Status — Final Closeout

Date: 2026-07-26. Branch: B2B. Honest snapshot, verified against source — not aspirational.

Frontend status

Release Candidate, complete. docs/TODO.md has no remaining blockers. npx tsc --noEmit and ng build are clean. Manual smoke testing (home, catalog, cart, dialogs) shows zero console errors. All native browser dialogs replaced with shared components, no known broken-image paths, no raw developer jargon in default admin views, no apology-toned empty states. One real (minor) bug remains open — see docs/KNOWN-ISSUES.md (Ed25519 admin-auth error codes session-expired/invalid-signature are currently unreachable; needs a backend body-error-code contract plus a small frontend fix).

Backend status

Not started. Fully specified. docs/BACKEND_INTEGRATION.md (4,371 lines) is the single canonical spec: every endpoint, DTO, CRUD contract, auth flow, security posture, error model, upload contract, migration guide, and a 34-item top-to-bottom checklist. Only one domain has a real HTTP implementation today — Categories (AdminCategoriesApiGateway). Every other admin domain (Products, Orders, Users, Transactions, Monitoring, Moderation) currently injects its mock gateway class directly and needs a DI token added before it's even swappable. Content-management/builder publish has zero backend call today (in-memory + localStorage only) — the single largest gap.

Documentation status

Consolidated this closeout. One canonical backend doc (BACKEND_INTEGRATION.md) replaces three overlapping ones (archived to docs/archive/: BACKEND_API.md, AUTH.md, BACKEND_API_REMAINING_WORK.md). AUTHENTICATION.md, ERROR_CONTRACT.md, MAINTENANCE_MODE.md stand alone as deep-dive references and are also inlined/cross-referenced in the canonical doc. TODO.md, KNOWN-ISSUES.md, PRODUCT_BACKLOG.md, FUTURE_FEATURES.md are now cleanly separated by category instead of one mixed checklist. PROJECT_INDEX.md (the entry point) updated to reflect all of the above. Not fully swept: some deep architecture ADRs (docs/architecture/foundation/adr/**) and a few secondary docs (FRONTEND.md, EDITOR.md, ARCHITECTURE.md, PROJECT-STRUCTURE.md, StaticPages.md, ADMIN.md) still contain old BACKEND_API.md/AUTH.md references — low-traffic, historical-context docs, not the navigation entry point, left as a known gap rather than touched blindly.

Authentication status

Storefront: live. Telegram/QR session login works end-to-end, is the only way customers authenticate today. Admin: dormant. Ed25519 challenge/response admin auth is fully wired client-side (keypair service, signing flow, guard, interceptor) but the interceptor is not registered in app.config.ts and the guard is not attached to any route — the flow does not run in production today. No token refresh is implemented for either flow. Full detail: docs/AUTHENTICATION.md.

Builder status

Fully functional as an editor of in-memory/localStorage draft state — homepage sections, widgets, languages, navigation, footer, branding, theme, static pages. No save/publish ever reaches a backend. "Publish" today just promotes the local draft signal; nothing is sent over HTTP. This is the single biggest backend gap for going live with real tenant control.

Storefront status

Feature-complete for the audited surfaces (home, catalog, product detail, cart, checkout UI, wishlist/compare, search, static/CMS pages). Runs entirely against mock data providers. i18n complete across en/ru/hy for customer-facing surfaces (near-parity key counts verified). No native browser dialogs, all dynamic images have a graceful placeholder fallback.

Admin status

Backoffice UI is built for every domain (dashboard, products, categories, orders, customers, transactions, users, moderation, media, monitoring, analytics) and runs entirely against mock gateways except Categories. Admin route access is gated by adminAuthGuard, but that guard performs no role checks today — anyone who passes the (currently Telegram-based) auth gate has full admin access regardless of role; the role model exists in code but isn't enforced yet. Monitoring/Analytics reflect this: Monitoring shows merchant-friendly mock activity; Analytics has no real data source and several values are honestly null.

Known limitations

One real frontend bug open (Ed25519 auth error codes unreachable — see KNOWN-ISSUES.md).
Admin role model exists but isn't enforced by any route guard or UI gate yet.
No automated test suite exists for the components touched across recent RC passes (none existed before either).
Bundle has two large lazy chunks (project-editor 320 kB, catalog-container 126 kB) — not release-blocking, tracked in FUTURE_FEATURES.md.
53 local B2B commits not yet pushed to origin (verified 2026-07-26) — pending explicit go-ahead, a process step not a code blocker.
Several product-decision items (dark mode, brand-color contrast, Contacts page content, advanced analytics) are documented but not scheduled — see PRODUCT_BACKLOG.md.

Ready for production?

No. No real backend exists. The frontend is ready to be wired to one the moment it exists — see BACKEND_INTEGRATION.md and NEXT_PHASE.md.

Ready for backend integration?

Yes. This is the primary deliverable of this closeout. Every endpoint, DTO, auth flow, error contract, and migration step a backend engineer needs is documented in BACKEND_INTEGRATION.md, with every frontend-undefined decision explicitly flagged rather than guessed.

Ready for first client demo?

Yes, with one caveat. The storefront and builder can be demoed end-to-end against mock data with no visible rough edges from the RC-02/closeout passes. The caveat: admin/backoffice has no role enforcement, so a demo giving anyone admin access effectively gives them full admin access — fine for a controlled demo, worth stating explicitly if the audience will poke at role-based permission claims.

5.9 KiB Raw Blame History