defiQUG
4f78404f87
- Extend RBAC modules/permissions; Home + drawer + Nav routes for ATF/NCIC/military/judicial/intelligence - Wire Orders/Evidence/Reports/ATF/NCIC/Military/Judicial/Intelligence Compose flows with Hilt ViewModels - Evidence: custody chain merge in repository; list/detail UI; fix transfer entity evidenceId - SyncService: hydrate credential payloads after list pull; CredentialCacheSyncPort API + tests - CredentialCacheMerger hydrateMissingPayloads; CredentialsViewModel refresh/hydrate split - OrderServiceTest; SyncService + CredentialCacheMerger tests; NCIC operator display - docs: OUTSTANDING-PRODUCTION-AND-COMPLIANCE-WORK.md; GAPS updates; README implementation status - Misc doc/build updates (OpenAPI test, compliance matrix, etc.) Made-with: Cursor
60 lines
7.7 KiB
Markdown
60 lines
7.7 KiB
Markdown
# SMOA – Master task list
|
||
|
||
All areas; **status** reflects repo state after the **2026-03** sweep (enterprise auth, OIDC, pinning, CI). Details: [TODO.md](./TODO.md).
|
||
|
||
| # | Area | Task | Status |
|
||
|---|------|------|--------|
|
||
| B1 | Backend | Prod profile, Flyway, PostgreSQL docs | Done |
|
||
| B2 | Backend | Tenant filter (`X-Unit`) | Done |
|
||
| B3 | Backend | Pagination / OpenAPI params | Done |
|
||
| B4 | Backend | ETag for GET `/api/v1/*` | Done |
|
||
| B5 | Backend | Request ID filter | Done |
|
||
| B6 | Backend | API versioning doc | Done |
|
||
| B7 | Backend | Gradle Kotlin plugin + `FAIL_ON_PROJECT_REPOS` fix | Done |
|
||
| B8 | Backend | Test profile (`application-test.yml`), passing tests | Done |
|
||
| A1 | Android | Sync serialization (Gson), PullAPI, BuildConfig API URL/key | Done |
|
||
| A2 | Android | InfrastructureManager STUN/signaling from BuildConfig | Done |
|
||
| A3 | Android | Android 16 target doc | Done |
|
||
| A4 | Android | Knox integration | **Doc:** [KNOX-INTEGRATION.md](docs/reference/KNOX-INTEGRATION.md) (SDK not bundled) |
|
||
| A5 | Android | WebRTC PeerConnection | **Stub** — [WebRTCManager](modules/communications/src/main/java/com/smoa/modules/communications/domain/WebRTCManager.kt); optional AAR |
|
||
| A6 | Android | Connection quality | **Done** — [NetworkEstimatesConnectionQualityMonitor](modules/communications/src/main/java/com/smoa/modules/communications/domain/NetworkEstimatesConnectionQualityMonitor.kt) |
|
||
| A7 | Android | Screen share / file transfer | **Stub** — flags in [VideoTransport](modules/meetings/src/main/java/com/smoa/modules/meetings/domain/VideoTransport.kt) |
|
||
| A8 | Android | SmartCardReader | **Stub** — [SmartCardReader](core/common/src/main/java/com/smoa/core/common/SmartCardReader.kt) (no PC/SC driver) |
|
||
| I1 | iOS | App in Xcode | **External** — create project; contract in [docs/ios/README.md](docs/ios/README.md) |
|
||
| I2 | iOS | Keychain / offline / biometrics / pinning | **Samples:** [docs/ios/SAMPLES.md](docs/ios/SAMPLES.md) |
|
||
| W1 | Web | Scaffold + directory pull | Done |
|
||
| W2 | Web | PWA manifest + service worker | Done |
|
||
| W3 | Web | Offline queue helper | Done (`docs/web-scaffold/offline-queue.js`) |
|
||
| W4 | Web | Deploy + CORS | **Doc:** [DEPLOY.md](docs/web-scaffold/DEPLOY.md) |
|
||
| N1 | Infra | Nginx, docker-compose, k8s example | Done |
|
||
| N2 | Infra | TURN/signaling self-host | **Doc:** [TURN-SIGNALING.md](docs/infrastructure/TURN-SIGNALING.md) |
|
||
| D1 | Domain | NCIC live API | **Legal gate** — CJIS; local **Room** log: [NCICQueryDatabase](modules/ncic/src/main/java/com/smoa/modules/ncic/data/NCICQueryDatabase.kt) |
|
||
| D2 | Domain | ATF eTrace | **Legal gate**; **Room** drafts: [ATFFormDatabase](modules/atf/src/main/java/com/smoa/modules/atf/data/ATFFormDatabase.kt) |
|
||
| D3 | Domain | eIDAS QTSP / EU trust lists | **Product gate** — stub in [EIDASService](core/eidas/src/main/java/com/smoa/core/eidas/domain/EIDASService.kt) |
|
||
| D4 | Domain | JCA digital signatures | **Done:** [DigitalSignatureService](core/signing/src/main/java/com/smoa/core/signing/domain/DigitalSignatureService.kt) |
|
||
| D5 | Domain | Electronic seal verify | **Done:** SHA-256 compare in [ElectronicSealService](core/signing/src/main/java/com/smoa/core/signing/domain/ElectronicSealService.kt) |
|
||
| D6 | Domain | XML/AS4 full stack | **Stub** + [core/as4/README.md](core/as4/README.md) |
|
||
| D7 | Domain | Certificate revocation | Stub UNKNOWN; extend with OCSP/CRL |
|
||
| T1 | Testing | `smoaVerify` in CI | Done — [.gitea/workflows/ci.yml](.gitea/workflows/ci.yml) |
|
||
| T2 | Testing | Android coverage 80%+ | **Plan** — expand over time |
|
||
| T3 | Testing | E2E | **Plan:** [E2E-PLAN.md](docs/testing/E2E-PLAN.md) |
|
||
| X1 | Docs | BUILD.md, TASKS.md, TODO sweep | Done |
|
||
| X2 | Build | **`./gradlew smoaVerify`** (`:backend:test`, `:app:testDebugUnitTest`, `:app:assembleDebug`) + [scripts/build-all.sh](scripts/build-all.sh) | Done |
|
||
| A9 | Android | TLS pinning + `AuthTokenInterceptor` + enterprise settings card | **Done** — [NetworkModule](app/src/main/java/com/smoa/di/NetworkModule.kt), [SECURITY-ENTERPRISE.md](docs/development/SECURITY-ENTERPRISE.md) |
|
||
| A10 | Android | `SecureTokenStore`, OIDC `BuildConfig`, session lock overlay | **Done** — [security package](app/src/main/java/com/smoa/security/), [SessionLockOverlay](app/src/main/java/com/smoa/ui/auth/SessionLockOverlay.kt) |
|
||
| A11 | Android | Play Integrity client + Knox classpath probe | **Done** — [PlayIntegrityVerifier](app/src/main/java/com/smoa/security/PlayIntegrityVerifier.kt), [KnoxEnterpriseProbe](app/src/main/java/com/smoa/security/KnoxEnterpriseProbe.kt) |
|
||
| A12 | Android | Biometric-gated AES key (Keystore) | **Done** — [BiometricSecretsVault](app/src/main/java/com/smoa/security/BiometricSecretsVault.kt); encrypt `CryptoObject` path: **A16** |
|
||
| A13 | Android | **OIDC login flow** (AppAuth) + redirect activity / intent-filter | **Done** — [OidcLoginCoordinator](app/src/main/java/com/smoa/security/OidcLoginCoordinator.kt), manifest `RedirectUriReceiverActivity` |
|
||
| A14 | Android | **Refresh token** — OkHttp `Authenticator` + `SecureTokenStore` | **Done** — [TokenRefreshAuthenticator](app/src/main/java/com/smoa/network/TokenRefreshAuthenticator.kt), token endpoint persisted after OIDC |
|
||
| A15 | Android | Certificate pinning host from **hosted config** (`RemoteEndpointStore`) | **Done** — [NetworkPinningConfig.resolveBackendHost](app/src/main/java/com/smoa/network/NetworkPinningConfig.kt) + [NetworkModule](app/src/main/java/com/smoa/di/NetworkModule.kt) |
|
||
| A16 | Android | **BiometricPrompt.CryptoObject** + keystore encrypt path | **Done** — [BiometricSecretsVault.tryCreateEncryptCryptoObject](app/src/main/java/com/smoa/security/BiometricSecretsVault.kt), [BiometricAuthenticator.authenticateWithCryptoObject](app/src/main/java/com/smoa/auth/BiometricAuthenticator.kt) |
|
||
| A17 | Android | Session lock: **device credential** fallback | **Done** — [BiometricAuthenticator.authenticateForSessionUnlock](app/src/main/java/com/smoa/auth/BiometricAuthenticator.kt); sign-in MFA path allows PIN/pattern |
|
||
| A18 | Android | **Demo** auth + **SSO** when OIDC BuildConfig set | **Hybrid** — [AuthFlowHost](app/src/main/java/com/smoa/ui/auth/AuthFlowHost.kt) organization SSO + local demo; IdP-only when you remove demo UI |
|
||
| A19 | Android | Release **R8** + pinning + Integrity + ProGuard | **Verified** — `./gradlew :app:assembleRelease` succeeds; extend per-tenant release checklists |
|
||
| A20 | Android | **Multi-host** pins | **Done** — `tls_pin_spec` in hosted config + `SMOA_TLS_PIN_SPEC` BuildConfig; [CertificatePinnerFactory.buildFromMultiSpec](app/src/main/java/com/smoa/network/CertificatePinnerFactory.kt) |
|
||
| A21 | Android | Classification / watermark from **remote config** | **Done** — `classification_watermark_*` in [SmoaClientConfigJson](app/src/main/java/com/smoa/config/SmoaClientConfigJson.kt), [ClassificationWatermark](app/src/main/java/com/smoa/ui/components/SmoaChrome.kt) |
|
||
| T4 | Testing | Unit tests: session lock logic, certificate pinning | **Done** — [SessionLockLogicTest](app/src/test/java/com/smoa/security/SessionLockLogicTest.kt), [CertificatePinnerFactoryTest](app/src/test/java/com/smoa/network/CertificatePinnerFactoryTest.kt); `SecureTokenStore` needs on-device / crypto-capable runner |
|
||
| T5 | Testing | UI tests: session lock, user settings | **Partial** — add `@HiltAndroidTest` + Compose rules when CI has an emulator/device |
|
||
| T6 | Testing | CI: `scripts/generate-api-docs.sh` | **Done** — [.gitea/workflows/ci.yml](.gitea/workflows/ci.yml) (step after `smoaVerify`) |
|
||
| B9 | Backend | **Play Integrity** verify endpoint | **Stub** — `POST /api/v1/integrity/verify` returns **501** until Google API wired — [IntegrityAttestationController](backend/src/main/kotlin/com/smoa/backend/api/IntegrityAttestationController.kt) |
|