From cded182e988ce471cbbba4052fafdb619e06da18 Mon Sep 17 00:00:00 2001 From: sneak Date: Mon, 6 Jul 2026 20:31:42 +0200 Subject: [PATCH] Update TODO.md --- TODO.md | 156 ++++++++++++++++++++++---------------------------------- 1 file changed, 62 insertions(+), 94 deletions(-) diff --git a/TODO.md b/TODO.md index c257a74..4cd3608 100644 --- a/TODO.md +++ b/TODO.md @@ -1,102 +1,70 @@ -# Webhooker TODO List +# Status -## Phase 1: Security & Infrastructure Hardening -- [ ] Implement proper security headers (HSTS, CSP, X-Frame-Options, etc.) -- [ ] Add request timeouts and context handling -- [ ] Set maximum request/response body sizes -- [ ] Implement rate limiting middleware -- [ ] Add CSRF protection for forms -- [ ] Set up proper CORS handling -- [ ] Implement request ID tracking through entire request lifecycle -- [ ] Add panic recovery with proper error reporting +pre-1.0. Single initial commit on main (2026-03-01), no tags. Early +stage; most of the feature plan is unimplemented and the policy scaffold +is incomplete. -## Phase 2: Authentication & Authorization -- [ ] Create authentication middleware that checks session -- [ ] Implement proper session expiration -- [ ] Add "Remember me" functionality -- [ ] Implement password reset flow -- [ ] Add user registration (if needed) -- [ ] Create authorization middleware for protected routes -- [ ] Add API key authentication for programmatic access +# Next Step -## Phase 3: Database Models & Migrations -- [ ] Create webhook source model (id, user_id, name, target_url, secret, created_at, etc.) -- [ ] Create webhook request log model (id, source_id, request_headers, request_body, response_status, etc.) -- [ ] Create webhook retry model for failed deliveries -- [ ] Add database indexes for performance -- [ ] Create migration system for schema updates +Full policy scaffold in one commit: -## Phase 4: Webhook Source Management UI -- [ ] Implement webhook source list page (/sources) -- [ ] Create webhook source creation form (/sources/new) -- [ ] Build webhook source detail page (/source/{id}) -- [ ] Add webhook source edit functionality (/source/{id}/edit) -- [ ] Implement webhook source deletion with confirmation -- [ ] Add webhook URL generation and display -- [ ] Create secret key generation and management -- [ ] Add webhook testing functionality +- Add LICENSE, REPO_POLICIES.md, .editorconfig, .dockerignore. +- Add .gitea/workflows/check.yml running make check. +- Extend the Makefile with fmt-check, check, docker, and hooks targets + (test/lint/fmt exist; docker-build/docker-run exist but not the + required docker target). +- Make the Dockerfile run make check and pin base images by sha256. -## Phase 5: Webhook Processing Engine -- [ ] Implement actual webhook reception at /webhook/{uuid} -- [ ] Validate incoming webhook requests (headers, body size, etc.) -- [ ] Create webhook forwarding logic to target URLs -- [ ] Implement request/response logging -- [ ] Add webhook signature verification (GitHub, Stripe, etc. formats) -- [ ] Create webhook transformation capabilities (headers, body) -- [ ] Implement timeout handling for outbound requests -- [ ] Add retry logic with exponential backoff +# Completed Steps -## Phase 6: Webhook Logs & Analytics -- [ ] Create webhook request log viewer (/source/{id}/logs) -- [ ] Add filtering and search capabilities for logs -- [ ] Implement request/response body viewer -- [ ] Create analytics dashboard (success rates, response times) -- [ ] Add webhook health monitoring -- [ ] Implement alerting for failed webhooks -- [ ] Create log retention policies +- 2026-03-01: Initial commit: Go module (git.eeqj.de/sneak/webhooker), + cmd/internal/pkg layout, config.yaml, Dockerfile, Makefile with + test/lint/fmt, templates and static assets, README describing the + processor/target delivery design, .gitignore and .golangci.yml. -## Phase 7: Advanced Features -- [ ] Add webhook request replay functionality -- [ ] Implement webhook request batching -- [ ] Create webhook request queuing system -- [ ] Add support for multiple target URLs per source -- [ ] Implement conditional forwarding based on payload -- [ ] Add webhook transformation templates -- [ ] Create webhook debugging tools -- [ ] Implement webhook scheduling/delayed delivery +# Future Steps -## Phase 8: API Development -- [ ] Create RESTful API for webhook source management -- [ ] Implement API authentication and rate limiting -- [ ] Add API documentation (OpenAPI/Swagger) -- [ ] Create API client libraries -- [ ] Implement webhooks-as-a-service API - -## Phase 9: Performance & Scalability -- [ ] Implement caching layer (Redis) -- [ ] Add background job processing (for retries, etc.) -- [ ] Create horizontal scaling capabilities -- [ ] Implement webhook delivery parallelization -- [ ] Add metrics collection (Prometheus) -- [ ] Create performance monitoring dashboard - -## Phase 10: Operations & Maintenance -- [ ] Add comprehensive logging throughout application -- [ ] Create admin dashboard for user management -- [ ] Implement backup and restore procedures -- [ ] Add system health checks and monitoring -- [ ] Create deployment automation (Docker, K8s) -- [ ] Implement zero-downtime deployments -- [ ] Add feature flags for gradual rollouts - -## Nice-to-Have Features -- [ ] Webhook marketplace/templates -- [ ] Team collaboration features -- [ ] Webhook versioning -- [ ] A/B testing for webhooks -- [ ] Webhook analytics export -- [ ] Mobile app for monitoring -- [ ] Slack/Discord/Email notifications -- [ ] Webhook documentation generator -- [ ] GraphQL subscription support -- [ ] WebSocket support for real-time updates \ No newline at end of file +- Compliance (after Next Step): + - Rework README.md into the required sections: Description, Getting + Started, Rationale, Design, TODO, License, Author. + - Keep main green under the new workflow. +- Phase 1, security and infrastructure hardening (also required for 1.0 + as an HTTP service): security headers (HSTS, CSP, X-Frame-Options), + request timeouts and context handling, max request/response body + sizes, rate limiting middleware, CSRF protection on forms, restricted + CORS, request ID tracking through the request lifecycle, panic + recovery with proper error reporting. +- Phase 2, authentication and authorization: session-checking auth + middleware, session expiration, remember-me, password reset, optional + registration, authorization middleware for protected routes, API key + auth for programmatic access. Use bcrypt or argon2 for passwords and + secure cookies per policy. +- Phase 3, database models and migrations: webhook source model, + request log model, retry model for failed deliveries, indexes, + migration system. +- Phase 4, source management UI: source list, create form, detail page, + edit, delete with confirmation, webhook URL generation, secret key + management, webhook testing. +- Phase 5, processing engine: reception at /webhook/{uuid}, request + validation, forwarding to targets, request/response logging, + signature verification (GitHub, Stripe formats), transformation of + headers and body, outbound timeouts, retry with exponential backoff. +- Phase 6, logs and analytics: log viewer per source, filtering and + search, body viewer, analytics dashboard (success rates, response + times), health monitoring, alerting on failures, retention policies. +- Phase 7, advanced features: request replay, batching, queuing, + multiple targets per source, conditional forwarding, transformation + templates, debugging tools, scheduled or delayed delivery. +- Phase 8, API: RESTful source management API, API auth and rate + limiting, OpenAPI docs, client libraries, webhooks-as-a-service API. +- Phase 9, performance and scalability: Redis caching, background job + processing, horizontal scaling, delivery parallelization, Prometheus + metrics, performance dashboard. +- Phase 10, operations: comprehensive logging, admin dashboard for user + management, backup and restore, health checks and monitoring, + deployment automation (Docker, K8s), zero-downtime deploys, feature + flags. +- Nice-to-have: webhook marketplace/templates, team collaboration, + webhook versioning, A/B testing, analytics export, mobile monitoring + app, Slack/Discord/email notifications, documentation generator, + GraphQL subscriptions, WebSocket real-time updates.