mivanchenko
319218ce21
Test backoffice (smb-crm) / test (push) Has been cancelled
Postgres is now the sole source of truth: delete sheets.py and import_from_sheets.py, strip mirror_entity/mirror_async/_mirror_worker and POST /api/sync from app.py, drop the tab/mirror keys from db.py's TABLES. Re-point n8n/renewal-reminder.json at the CRM's own HTTP API (GET /api/clients, POST /api/activity_log) instead of the Sheets nodes, and drop SHEET_ID/GOOGLE_SA_JSON from deploy env/compose and requests from requirements.txt (PyJWT stays — still used by booking_api.py). Updates docs/README/playbooks accordingly and closes the old #5 (atomic mirror) as moot. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
72 lines
5.1 KiB
Markdown
72 lines
5.1 KiB
Markdown
# TODO / Backlog
|
||
|
||
> **Active engineering work is tracked as Gitea issues:** https://git.mivanchenko.de/BPPP/smb-online/issues
|
||
> This file is the high-level map; the issues hold the detail, labels, and status.
|
||
|
||
## Open (→ Gitea issue)
|
||
|
||
**Bugs**
|
||
- **#1** Booking POST is a plain `INSERT` — reschedule re-fires `EA-<id>` → PK conflict / 500
|
||
(`backoffice/app/app.py:205`; needs `ON CONFLICT DO UPDATE`). `bug` `crm` `booking`
|
||
|
||
**CRM / back office**
|
||
- **#2** Decouple tier from business type → hosting/plan model; realign onboarding form + workflow. `enhancement` `crm`
|
||
- **#3** Extend back-office CRUD beyond Leads & Clients (projects, bookings, invoices, activity). `enhancement` `crm`
|
||
|
||
**Booking**
|
||
- **#7** Proper Orders flow + Orders table/tab (pizzeria demo posts into Leads as a stop-gap). `enhancement` `booking`
|
||
- **#9** Per-client Easy!Appointments isolation (booking is currently one shared EA instance). `enhancement` `booking`
|
||
- **#10** Custom branded slot-grid booking widget (replace raw EA embed). `enhancement` `booking`
|
||
|
||
**Security / ops / infra**
|
||
- **#4** Backups: smb-db `pg_dump` script exists (`deploy/backup/smb-db-backup.sh`); still need
|
||
n8n + Gitea coverage, an **offsite** copy, and a **tested restore**. `ops` `infra`
|
||
- **#6** Harden n8n auth — remove dead `N8N_BASIC_AUTH_*` (password=`password`); confirm strong owner login. `security` `infra`
|
||
- **#11** Rotate the leaked Gitea PAT + establish secrets management. `security` `ops`
|
||
- **#12** CI (Gitea Actions): validate `n8n/*.json` + compose before deploy. Runner infra already
|
||
exists (see deploy pipeline in Done) — this just adds a validate-on-push workflow. `ops` `infra`
|
||
|
||
## Manual / operator follow-ups (not code issues — need you, not more code)
|
||
- **n8n re-import:** load the updated `n8n/onboarding.json` (new "Save credential" node) into the
|
||
live n8n and re-attach the real `__CRM_TOKEN__` / `__EA_AUTH__` bindings — can't be scripted from outside n8n.
|
||
- **happynails credential:** its `username` is still blank — confirm in the EA admin UI and fill it
|
||
in via the dashboard's ✎ edit on the Credentials tab (`C-0002`, cred `CR-1784116056728`).
|
||
- **Deploy pipeline:** press "Run workflow" once in the Gitea UI (Actions → Deploy backoffice) as
|
||
the real end-to-end test; then extend the same pattern to the other `deploy/*` groups
|
||
(`booking/`, `smb-demos/`, `clients/<slug>/`).
|
||
- **Collaborator access:** anyone with **write** on this repo can trigger a deploy — be deliberate
|
||
about who gets write vs. read/PR-only before adding people.
|
||
- **Optional:** encrypt `credentials.secret` at rest (e.g. pgcrypto) if the dashboard is ever
|
||
exposed more broadly than Caddy basic-auth + host security.
|
||
|
||
## Done
|
||
- [x] 2026-08-04 — **Cut Google Sheets entirely** (#13): Postgres is now the sole source of
|
||
truth — deleted the DB→Sheets mirror, the Sheets client, and the one-time importer;
|
||
`renewal-reminder.json` reads from the DB API instead of the Sheets mirror. Moots #5
|
||
(atomic-mirror tech-debt, closed as no longer applicable).
|
||
- [x] 2026-07-15 — **Credentials in the CRM**: `credentials` entity (`X-CRM-Token`-gated even to
|
||
read), dashboard Credentials tab with masked value + reveal/copy;
|
||
`n8n/onboarding.json` now persists the auto-generated EA provider password. Shipped live.
|
||
- [x] 2026-07-15 — **Gitea Actions deploy pipeline** (backoffice): self-hosted `homelab-runner`
|
||
(`act-runner` systemd service), `workflow_dispatch` `deploy-backoffice.yml` that syncs
|
||
`backoffice/`, re-applies the schema, rebuilds/restarts `smb-crm`, health-checks it.
|
||
- [x] 2026-07-14 — **Shared self-hosted booking**: Easy!Appointments stack (`deploy/booking/`),
|
||
auto-provisioning wired into onboarding, `booking-sync` workflow syncing bookings to the CRM
|
||
(**#8** — done differently than first scoped: one shared EA instance replaced the planned
|
||
Tier-B-Cal.com-webhook / Tier-A-GCal-poll split).
|
||
- [x] 2026-07-14 — **Per-client deploy tooling**: `deploy/clients/` isolated-stack model +
|
||
`new-client.sh` scaffolder.
|
||
- [x] 2026-06-30 — Daily **smb-db Postgres backup** script (`deploy/backup/smb-db-backup.sh`:
|
||
`pg_dump` + gzip, 14-day retention, cron on the homelab). (Broader coverage → #4.)
|
||
- [x] 2026-06-25 — Rethink the tier model: **demos are stack-agnostic starters** — dropped
|
||
tier/stack labels + jargon from all three demo pages & the chooser; booking widgets relabelled;
|
||
demo dates render on the current week so nothing looks stale. (Remaining model/schema work → #2.)
|
||
- [x] 2026-06-25 — **DB-first back office**: Postgres source of truth + Sheets mirror + CRUD
|
||
(Read/Add/Edit/Delete for Leads & Clients) + n8n ingest swap (lead-intake/onboarding → DB API).
|
||
Behind Caddy basic-auth, mutations gated by `CRM_API_TOKEN`, audit-logged. (Extensions → #3.)
|
||
- [x] 2026-06-25 — Latency fix (n8n executions 1–4 min → ~6 s; DNS + PostHog telemetry).
|
||
- [x] 2026-06-25 — Chooser reworded to client-friendly, jargon-free copy.
|
||
- [x] 2026-06-25 — Pizzeria demo with online ordering added. (Proper Orders product → #7.)
|
||
- [x] 2026-06-25 — Barbershop "Google Kalender" dot-overlap styling fixed.
|
||
- [x] 2026-06-25 — All three demo pages neutralised (stack-agnostic, non-stale dates).
|