Update TODO.md

TODO.md

@@ -1,102 +1,70 @@
-# Webhooker TODO List
+# Status
 
-## Phase 1: Security & Infrastructure Hardening
-- [ ] Implement proper security headers (HSTS, CSP, X-Frame-Options, etc.)
-- [ ] Add request timeouts and context handling
-- [ ] Set maximum request/response body sizes
-- [ ] Implement rate limiting middleware
-- [ ] Add CSRF protection for forms
-- [ ] Set up proper CORS handling
-- [ ] Implement request ID tracking through entire request lifecycle
-- [ ] Add panic recovery with proper error reporting
+pre-1.0. Single initial commit on main (2026-03-01), no tags. Early
+stage; most of the feature plan is unimplemented and the policy scaffold
+is incomplete.
 
-## Phase 2: Authentication & Authorization
-- [ ] Create authentication middleware that checks session
-- [ ] Implement proper session expiration
-- [ ] Add "Remember me" functionality
-- [ ] Implement password reset flow
-- [ ] Add user registration (if needed)
-- [ ] Create authorization middleware for protected routes
-- [ ] Add API key authentication for programmatic access
+# Next Step
 
-## Phase 3: Database Models & Migrations
-- [ ] Create webhook source model (id, user_id, name, target_url, secret, created_at, etc.)
-- [ ] Create webhook request log model (id, source_id, request_headers, request_body, response_status, etc.)
-- [ ] Create webhook retry model for failed deliveries
-- [ ] Add database indexes for performance
-- [ ] Create migration system for schema updates
+Full policy scaffold in one commit:
 
-## Phase 4: Webhook Source Management UI
-- [ ] Implement webhook source list page (/sources)
-- [ ] Create webhook source creation form (/sources/new)
-- [ ] Build webhook source detail page (/source/{id})
-- [ ] Add webhook source edit functionality (/source/{id}/edit)
-- [ ] Implement webhook source deletion with confirmation
-- [ ] Add webhook URL generation and display
-- [ ] Create secret key generation and management
-- [ ] Add webhook testing functionality
+- Add LICENSE, REPO_POLICIES.md, .editorconfig, .dockerignore.
+- Add .gitea/workflows/check.yml running make check.
+- Extend the Makefile with fmt-check, check, docker, and hooks targets
+  (test/lint/fmt exist; docker-build/docker-run exist but not the
+  required docker target).
+- Make the Dockerfile run make check and pin base images by sha256.
 
-## Phase 5: Webhook Processing Engine
-- [ ] Implement actual webhook reception at /webhook/{uuid}
-- [ ] Validate incoming webhook requests (headers, body size, etc.)
-- [ ] Create webhook forwarding logic to target URLs
-- [ ] Implement request/response logging
-- [ ] Add webhook signature verification (GitHub, Stripe, etc. formats)
-- [ ] Create webhook transformation capabilities (headers, body)
-- [ ] Implement timeout handling for outbound requests
-- [ ] Add retry logic with exponential backoff
+# Completed Steps
 
-## Phase 6: Webhook Logs & Analytics
-- [ ] Create webhook request log viewer (/source/{id}/logs)
-- [ ] Add filtering and search capabilities for logs
-- [ ] Implement request/response body viewer
-- [ ] Create analytics dashboard (success rates, response times)
-- [ ] Add webhook health monitoring
-- [ ] Implement alerting for failed webhooks
-- [ ] Create log retention policies
+- 2026-03-01: Initial commit: Go module (git.eeqj.de/sneak/webhooker),
+  cmd/internal/pkg layout, config.yaml, Dockerfile, Makefile with
+  test/lint/fmt, templates and static assets, README describing the
+  processor/target delivery design, .gitignore and .golangci.yml.
 
-## Phase 7: Advanced Features
-- [ ] Add webhook request replay functionality
-- [ ] Implement webhook request batching
-- [ ] Create webhook request queuing system
-- [ ] Add support for multiple target URLs per source
-- [ ] Implement conditional forwarding based on payload
-- [ ] Add webhook transformation templates
-- [ ] Create webhook debugging tools
-- [ ] Implement webhook scheduling/delayed delivery
+# Future Steps
 
-## Phase 8: API Development
-- [ ] Create RESTful API for webhook source management
-- [ ] Implement API authentication and rate limiting
-- [ ] Add API documentation (OpenAPI/Swagger)
-- [ ] Create API client libraries
-- [ ] Implement webhooks-as-a-service API
-
-## Phase 9: Performance & Scalability
-- [ ] Implement caching layer (Redis)
-- [ ] Add background job processing (for retries, etc.)
-- [ ] Create horizontal scaling capabilities
-- [ ] Implement webhook delivery parallelization
-- [ ] Add metrics collection (Prometheus)
-- [ ] Create performance monitoring dashboard
-
-## Phase 10: Operations & Maintenance
-- [ ] Add comprehensive logging throughout application
-- [ ] Create admin dashboard for user management
-- [ ] Implement backup and restore procedures
-- [ ] Add system health checks and monitoring
-- [ ] Create deployment automation (Docker, K8s)
-- [ ] Implement zero-downtime deployments
-- [ ] Add feature flags for gradual rollouts
-
-## Nice-to-Have Features
-- [ ] Webhook marketplace/templates
-- [ ] Team collaboration features
-- [ ] Webhook versioning
-- [ ] A/B testing for webhooks
-- [ ] Webhook analytics export
-- [ ] Mobile app for monitoring
-- [ ] Slack/Discord/Email notifications
-- [ ] Webhook documentation generator
-- [ ] GraphQL subscription support
-- [ ] WebSocket support for real-time updates 
+- Compliance (after Next Step):
+    - Rework README.md into the required sections: Description, Getting
+      Started, Rationale, Design, TODO, License, Author.
+    - Keep main green under the new workflow.
+- Phase 1, security and infrastructure hardening (also required for 1.0
+  as an HTTP service): security headers (HSTS, CSP, X-Frame-Options),
+  request timeouts and context handling, max request/response body
+  sizes, rate limiting middleware, CSRF protection on forms, restricted
+  CORS, request ID tracking through the request lifecycle, panic
+  recovery with proper error reporting.
+- Phase 2, authentication and authorization: session-checking auth
+  middleware, session expiration, remember-me, password reset, optional
+  registration, authorization middleware for protected routes, API key
+  auth for programmatic access. Use bcrypt or argon2 for passwords and
+  secure cookies per policy.
+- Phase 3, database models and migrations: webhook source model,
+  request log model, retry model for failed deliveries, indexes,
+  migration system.
+- Phase 4, source management UI: source list, create form, detail page,
+  edit, delete with confirmation, webhook URL generation, secret key
+  management, webhook testing.
+- Phase 5, processing engine: reception at /webhook/{uuid}, request
+  validation, forwarding to targets, request/response logging,
+  signature verification (GitHub, Stripe formats), transformation of
+  headers and body, outbound timeouts, retry with exponential backoff.
+- Phase 6, logs and analytics: log viewer per source, filtering and
+  search, body viewer, analytics dashboard (success rates, response
+  times), health monitoring, alerting on failures, retention policies.
+- Phase 7, advanced features: request replay, batching, queuing,
+  multiple targets per source, conditional forwarding, transformation
+  templates, debugging tools, scheduled or delayed delivery.
+- Phase 8, API: RESTful source management API, API auth and rate
+  limiting, OpenAPI docs, client libraries, webhooks-as-a-service API.
+- Phase 9, performance and scalability: Redis caching, background job
+  processing, horizontal scaling, delivery parallelization, Prometheus
+  metrics, performance dashboard.
+- Phase 10, operations: comprehensive logging, admin dashboard for user
+  management, backup and restore, health checks and monitoring,
+  deployment automation (Docker, K8s), zero-downtime deploys, feature
+  flags.
+- Nice-to-have: webhook marketplace/templates, team collaboration,
+  webhook versioning, A/B testing, analytics export, mobile monitoring
+  app, Slack/Discord/email notifications, documentation generator,
+  GraphQL subscriptions, WebSocket real-time updates.