Update TODO.md

TODO.md

@@ -1,102 +1,70 @@
-# Webhooker TODO List
+# Status
 
-## Phase 1: Security & Infrastructure Hardening
+pre-1.0. Single initial commit on main (2026-03-01), no tags. Early
-- [ ] Implement proper security headers (HSTS, CSP, X-Frame-Options, etc.)
+stage; most of the feature plan is unimplemented and the policy scaffold
-- [ ] Add request timeouts and context handling
+is incomplete.
-- [ ] Set maximum request/response body sizes
-- [ ] Implement rate limiting middleware
-- [ ] Add CSRF protection for forms
-- [ ] Set up proper CORS handling
-- [ ] Implement request ID tracking through entire request lifecycle
-- [ ] Add panic recovery with proper error reporting
 
-## Phase 2: Authentication & Authorization
+# Next Step
-- [ ] Create authentication middleware that checks session
-- [ ] Implement proper session expiration
-- [ ] Add "Remember me" functionality
-- [ ] Implement password reset flow
-- [ ] Add user registration (if needed)
-- [ ] Create authorization middleware for protected routes
-- [ ] Add API key authentication for programmatic access
 
-## Phase 3: Database Models & Migrations
+Full policy scaffold in one commit:
-- [ ] Create webhook source model (id, user_id, name, target_url, secret, created_at, etc.)
-- [ ] Create webhook request log model (id, source_id, request_headers, request_body, response_status, etc.)
-- [ ] Create webhook retry model for failed deliveries
-- [ ] Add database indexes for performance
-- [ ] Create migration system for schema updates
 
-## Phase 4: Webhook Source Management UI
+- Add LICENSE, REPO_POLICIES.md, .editorconfig, .dockerignore.
-- [ ] Implement webhook source list page (/sources)
+- Add .gitea/workflows/check.yml running make check.
-- [ ] Create webhook source creation form (/sources/new)
+- Extend the Makefile with fmt-check, check, docker, and hooks targets
-- [ ] Build webhook source detail page (/source/{id})
+  (test/lint/fmt exist; docker-build/docker-run exist but not the
-- [ ] Add webhook source edit functionality (/source/{id}/edit)
+  required docker target).
-- [ ] Implement webhook source deletion with confirmation
+- Make the Dockerfile run make check and pin base images by sha256.
-- [ ] Add webhook URL generation and display
-- [ ] Create secret key generation and management
-- [ ] Add webhook testing functionality
 
-## Phase 5: Webhook Processing Engine
+# Completed Steps
-- [ ] Implement actual webhook reception at /webhook/{uuid}
-- [ ] Validate incoming webhook requests (headers, body size, etc.)
-- [ ] Create webhook forwarding logic to target URLs
-- [ ] Implement request/response logging
-- [ ] Add webhook signature verification (GitHub, Stripe, etc. formats)
-- [ ] Create webhook transformation capabilities (headers, body)
-- [ ] Implement timeout handling for outbound requests
-- [ ] Add retry logic with exponential backoff
 
-## Phase 6: Webhook Logs & Analytics
+- 2026-03-01: Initial commit: Go module (git.eeqj.de/sneak/webhooker),
-- [ ] Create webhook request log viewer (/source/{id}/logs)
+  cmd/internal/pkg layout, config.yaml, Dockerfile, Makefile with
-- [ ] Add filtering and search capabilities for logs
+  test/lint/fmt, templates and static assets, README describing the
-- [ ] Implement request/response body viewer
+  processor/target delivery design, .gitignore and .golangci.yml.
-- [ ] Create analytics dashboard (success rates, response times)
-- [ ] Add webhook health monitoring
-- [ ] Implement alerting for failed webhooks
-- [ ] Create log retention policies
 
-## Phase 7: Advanced Features
+# Future Steps
-- [ ] Add webhook request replay functionality
-- [ ] Implement webhook request batching
-- [ ] Create webhook request queuing system
-- [ ] Add support for multiple target URLs per source
-- [ ] Implement conditional forwarding based on payload
-- [ ] Add webhook transformation templates
-- [ ] Create webhook debugging tools
-- [ ] Implement webhook scheduling/delayed delivery
 
-## Phase 8: API Development
+- Compliance (after Next Step):
-- [ ] Create RESTful API for webhook source management
+    - Rework README.md into the required sections: Description, Getting
-- [ ] Implement API authentication and rate limiting
+      Started, Rationale, Design, TODO, License, Author.
-- [ ] Add API documentation (OpenAPI/Swagger)
+    - Keep main green under the new workflow.
-- [ ] Create API client libraries
+- Phase 1, security and infrastructure hardening (also required for 1.0
-- [ ] Implement webhooks-as-a-service API
+  as an HTTP service): security headers (HSTS, CSP, X-Frame-Options),
-
+  request timeouts and context handling, max request/response body
-## Phase 9: Performance & Scalability
+  sizes, rate limiting middleware, CSRF protection on forms, restricted
-- [ ] Implement caching layer (Redis)
+  CORS, request ID tracking through the request lifecycle, panic
-- [ ] Add background job processing (for retries, etc.)
+  recovery with proper error reporting.
-- [ ] Create horizontal scaling capabilities
+- Phase 2, authentication and authorization: session-checking auth
-- [ ] Implement webhook delivery parallelization
+  middleware, session expiration, remember-me, password reset, optional
-- [ ] Add metrics collection (Prometheus)
+  registration, authorization middleware for protected routes, API key
-- [ ] Create performance monitoring dashboard
+  auth for programmatic access. Use bcrypt or argon2 for passwords and
-
+  secure cookies per policy.
-## Phase 10: Operations & Maintenance
+- Phase 3, database models and migrations: webhook source model,
-- [ ] Add comprehensive logging throughout application
+  request log model, retry model for failed deliveries, indexes,
-- [ ] Create admin dashboard for user management
+  migration system.
-- [ ] Implement backup and restore procedures
+- Phase 4, source management UI: source list, create form, detail page,
-- [ ] Add system health checks and monitoring
+  edit, delete with confirmation, webhook URL generation, secret key
-- [ ] Create deployment automation (Docker, K8s)
+  management, webhook testing.
-- [ ] Implement zero-downtime deployments
+- Phase 5, processing engine: reception at /webhook/{uuid}, request
-- [ ] Add feature flags for gradual rollouts
+  validation, forwarding to targets, request/response logging,
-
+  signature verification (GitHub, Stripe formats), transformation of
-## Nice-to-Have Features
+  headers and body, outbound timeouts, retry with exponential backoff.
-- [ ] Webhook marketplace/templates
+- Phase 6, logs and analytics: log viewer per source, filtering and
-- [ ] Team collaboration features
+  search, body viewer, analytics dashboard (success rates, response
-- [ ] Webhook versioning
+  times), health monitoring, alerting on failures, retention policies.
-- [ ] A/B testing for webhooks
+- Phase 7, advanced features: request replay, batching, queuing,
-- [ ] Webhook analytics export
+  multiple targets per source, conditional forwarding, transformation
-- [ ] Mobile app for monitoring
+  templates, debugging tools, scheduled or delayed delivery.
-- [ ] Slack/Discord/Email notifications
+- Phase 8, API: RESTful source management API, API auth and rate
-- [ ] Webhook documentation generator
+  limiting, OpenAPI docs, client libraries, webhooks-as-a-service API.
-- [ ] GraphQL subscription support
+- Phase 9, performance and scalability: Redis caching, background job
-- [ ] WebSocket support for real-time updates 
+  processing, horizontal scaling, delivery parallelization, Prometheus
+  metrics, performance dashboard.
+- Phase 10, operations: comprehensive logging, admin dashboard for user
+  management, backup and restore, health checks and monitoring,
+  deployment automation (Docker, K8s), zero-downtime deploys, feature
+  flags.
+- Nice-to-have: webhook marketplace/templates, team collaboration,
+  webhook versioning, A/B testing, analytics export, mobile monitoring
+  app, Slack/Discord/email notifications, documentation generator,
+  GraphQL subscriptions, WebSocket real-time updates.