defiQUG
4f78404f87
- Extend RBAC modules/permissions; Home + drawer + Nav routes for ATF/NCIC/military/judicial/intelligence - Wire Orders/Evidence/Reports/ATF/NCIC/Military/Judicial/Intelligence Compose flows with Hilt ViewModels - Evidence: custody chain merge in repository; list/detail UI; fix transfer entity evidenceId - SyncService: hydrate credential payloads after list pull; CredentialCacheSyncPort API + tests - CredentialCacheMerger hydrateMissingPayloads; CredentialsViewModel refresh/hydrate split - OrderServiceTest; SyncService + CredentialCacheMerger tests; NCIC operator display - docs: OUTSTANDING-PRODUCTION-AND-COMPLIANCE-WORK.md; GAPS updates; README implementation status - Misc doc/build updates (OpenAPI test, compliance matrix, etc.) Made-with: Cursor
38 lines
1.8 KiB
Markdown
38 lines
1.8 KiB
Markdown
# Gaps and inconsistencies (cross-cutting audit)
|
|
|
|
**Last reviewed:** 2026-03-24 (credential hydration wired in `SyncService`)
|
|
|
|
Most previously tracked gaps are **implemented**. This file lists only **long-horizon** or **compliance** items.
|
|
|
|
---
|
|
|
|
## Implemented (recent)
|
|
|
|
| Topic | Where |
|
|
|-------|--------|
|
|
| Shared OkHttp + Retrofit refresh | `SyncRetrofitHolder`, `NetworkModule`, `BackendSyncAPI` / `BackendPullAPI` lambdas |
|
|
| Non-blocking hosted config | `ClientConfigRefreshCoordinator.scheduleNonBlockingInitialLoad` |
|
|
| Browser VPN policy flag | `BuildConfig.SMOA_BROWSER_VPN_ENFORCED` / `-Psmoa.browser.vpnEnforced=true`, `VPNManager.setBrowserVpnEnforced` |
|
|
| Room credential cache | `credential_cache` + `CredentialCacheDatabaseModule` |
|
|
| OpenAPI drift process | `docs/development/OPENAPI-SYNCHRONIZATION.md`, `scripts/export-openapi-local.sh` |
|
|
| Credential pull → cache + payloads | `SyncService.startSync`: `CredentialCacheSyncPort.mergeFromPullCredentialsJson` then `hydrateMissingPayloads { pullCredentialDetail }`. UI: `CredentialsViewModel` |
|
|
|
|
---
|
|
|
|
## Remaining (long-term)
|
|
|
|
| Topic | Notes |
|
|
|-------|--------|
|
|
| **Strong multi-tenant isolation** | API key + `X-Unit` are not RLS; see `docs/security/TENANT-THREAT-MODEL.md`. |
|
|
| **AAMVA / ICAO production compliance** | Encoders need jurisdiction QA and official test vectors. |
|
|
| **Automated OpenAPI golden-file CI** | **Partial:** `OpenApiContractIntegrationTest` in `:backend:test` (also `smoaVerify`) asserts key `/v3/api-docs` paths. Full committed golden JSON diff still optional. |
|
|
|
|
---
|
|
|
|
## Related
|
|
|
|
- **[Outstanding production & compliance work (detailed)](./OUTSTANDING-PRODUCTION-AND-COMPLIANCE-WORK.md)** — expands long-horizon items into deliverables, prerequisites, and acceptance criteria.
|
|
- `docs/reference/IDENTITY-TEMPLATE-ALIGNMENT.md`
|
|
- `docs/schemas/`
|
|
- `backend/docs/BACKEND-GAPS-AND-ROADMAP.md`
|