# TODO / Backlog

> **Active engineering work is tracked as Gitea issues:** https://git.mivanchenko.de/BPPP/smb-online/issues
> This file is the high-level map; the issues hold the detail, labels, and status.

## Open (→ Gitea issue)

**Bugs**
- **#1** Booking POST is a plain `INSERT` — reschedule re-fires `EA-<id>` → PK conflict / 500
  (`backoffice/app/app.py:205`; needs `ON CONFLICT DO UPDATE`). `bug` `crm` `booking`

**CRM / back office**
- **#2** Decouple tier from business type → hosting/plan model; realign onboarding form + workflow. `enhancement` `crm`
- **#3** Extend back-office CRUD beyond Leads & Clients (projects, bookings, invoices, activity). `enhancement` `crm`
- **#5** Make the DB→Sheets mirror atomic (no brief empty-sheet window). `tech-debt` `crm`

**Booking**
- **#7** Proper Orders flow + Orders table/tab (pizzeria demo posts into Leads as a stop-gap). `enhancement` `booking`
- **#9** Per-client Easy!Appointments isolation (booking is currently one shared EA instance). `enhancement` `booking`
- **#10** Custom branded slot-grid booking widget (replace raw EA embed). `enhancement` `booking`

**Security / ops / infra**
- **#4** Backups: smb-db `pg_dump` script exists (`deploy/backup/smb-db-backup.sh`); still need
  n8n + Gitea coverage, an **offsite** copy, and a **tested restore**. `ops` `infra`
- **#6** Harden n8n auth — remove dead `N8N_BASIC_AUTH_*` (password=`password`); confirm strong owner login. `security` `infra`
- **#11** Rotate the leaked Gitea PAT + establish secrets management. `security` `ops`
- **#12** CI (Gitea Actions): validate `n8n/*.json` + compose before deploy. Runner infra already
  exists (see deploy pipeline in Done) — this just adds a validate-on-push workflow. `ops` `infra`

## Manual / operator follow-ups (not code issues — need you, not more code)
- **n8n re-import:** load the updated `n8n/onboarding.json` (new "Save credential" node) into the
  live n8n and re-attach the real `__CRM_TOKEN__` / `__EA_AUTH__` bindings — can't be scripted from outside n8n.
- **happynails credential:** its `username` is still blank — confirm in the EA admin UI and fill it
  in via the dashboard's ✎ edit on the Credentials tab (`C-0002`, cred `CR-1784116056728`).
- **Deploy pipeline:** press "Run workflow" once in the Gitea UI (Actions → Deploy backoffice) as
  the real end-to-end test; then extend the same pattern to the other `deploy/*` groups
  (`booking/`, `smb-demos/`, `clients/<slug>/`).
- **Collaborator access:** anyone with **write** on this repo can trigger a deploy — be deliberate
  about who gets write vs. read/PR-only before adding people.
- **Optional:** encrypt `credentials.secret` at rest (e.g. pgcrypto) if the dashboard is ever
  exposed more broadly than Caddy basic-auth + host security.

## Done
- [x] 2026-07-15 — **Credentials in the CRM**: `credentials` entity (never mirrored to Sheets,
  `X-CRM-Token`-gated even to read), dashboard Credentials tab with masked value + reveal/copy;
  `n8n/onboarding.json` now persists the auto-generated EA provider password. Shipped live.
- [x] 2026-07-15 — **Gitea Actions deploy pipeline** (backoffice): self-hosted `homelab-runner`
  (`act-runner` systemd service), `workflow_dispatch` `deploy-backoffice.yml` that syncs
  `backoffice/`, re-applies the schema, rebuilds/restarts `smb-crm`, health-checks it.
- [x] 2026-07-14 — **Shared self-hosted booking**: Easy!Appointments stack (`deploy/booking/`),
  auto-provisioning wired into onboarding, `booking-sync` workflow syncing bookings to the CRM
  (**#8** — done differently than first scoped: one shared EA instance replaced the planned
  Tier-B-Cal.com-webhook / Tier-A-GCal-poll split).
- [x] 2026-07-14 — **Per-client deploy tooling**: `deploy/clients/` isolated-stack model +
  `new-client.sh` scaffolder.
- [x] 2026-06-30 — Daily **smb-db Postgres backup** script (`deploy/backup/smb-db-backup.sh`:
  `pg_dump` + gzip, 14-day retention, cron on the homelab). (Broader coverage → #4.)
- [x] 2026-06-25 — Rethink the tier model: **demos are stack-agnostic starters** — dropped
  tier/stack labels + jargon from all three demo pages & the chooser; booking widgets relabelled;
  demo dates render on the current week so nothing looks stale. (Remaining model/schema work → #2.)
- [x] 2026-06-25 — **DB-first back office**: Postgres source of truth + Sheets mirror + CRUD
  (Read/Add/Edit/Delete for Leads & Clients) + n8n ingest swap (lead-intake/onboarding → DB API).
  Behind Caddy basic-auth, mutations gated by `CRM_API_TOKEN`, audit-logged. (Extensions → #3.)
- [x] 2026-06-25 — Latency fix (n8n executions 1–4 min → ~6 s; DNS + PostHog telemetry).
- [x] 2026-06-25 — Chooser reworded to client-friendly, jargon-free copy.
- [x] 2026-06-25 — Pizzeria demo with online ordering added. (Proper Orders product → #7.)
- [x] 2026-06-25 — Barbershop "Google Kalender" dot-overlap styling fixed.
- [x] 2026-06-25 — All three demo pages neutralised (stack-agnostic, non-stale dates).