defiQUG
4f78404f87
- Extend RBAC modules/permissions; Home + drawer + Nav routes for ATF/NCIC/military/judicial/intelligence - Wire Orders/Evidence/Reports/ATF/NCIC/Military/Judicial/Intelligence Compose flows with Hilt ViewModels - Evidence: custody chain merge in repository; list/detail UI; fix transfer entity evidenceId - SyncService: hydrate credential payloads after list pull; CredentialCacheSyncPort API + tests - CredentialCacheMerger hydrateMissingPayloads; CredentialsViewModel refresh/hydrate split - OrderServiceTest; SyncService + CredentialCacheMerger tests; NCIC operator display - docs: OUTSTANDING-PRODUCTION-AND-COMPLIANCE-WORK.md; GAPS updates; README implementation status - Misc doc/build updates (OpenAPI test, compliance matrix, etc.) Made-with: Cursor
7.7 KiB
7.7 KiB
SMOA – Master task list
All areas; status reflects repo state after the 2026-03 sweep (enterprise auth, OIDC, pinning, CI). Details: TODO.md.
| # | Area | Task | Status |
|---|---|---|---|
| B1 | Backend | Prod profile, Flyway, PostgreSQL docs | Done |
| B2 | Backend | Tenant filter (X-Unit) |
Done |
| B3 | Backend | Pagination / OpenAPI params | Done |
| B4 | Backend | ETag for GET /api/v1/* |
Done |
| B5 | Backend | Request ID filter | Done |
| B6 | Backend | API versioning doc | Done |
| B7 | Backend | Gradle Kotlin plugin + FAIL_ON_PROJECT_REPOS fix |
Done |
| B8 | Backend | Test profile (application-test.yml), passing tests |
Done |
| A1 | Android | Sync serialization (Gson), PullAPI, BuildConfig API URL/key | Done |
| A2 | Android | InfrastructureManager STUN/signaling from BuildConfig | Done |
| A3 | Android | Android 16 target doc | Done |
| A4 | Android | Knox integration | Doc: KNOX-INTEGRATION.md (SDK not bundled) |
| A5 | Android | WebRTC PeerConnection | Stub — WebRTCManager; optional AAR |
| A6 | Android | Connection quality | Done — NetworkEstimatesConnectionQualityMonitor |
| A7 | Android | Screen share / file transfer | Stub — flags in VideoTransport |
| A8 | Android | SmartCardReader | Stub — SmartCardReader (no PC/SC driver) |
| I1 | iOS | App in Xcode | External — create project; contract in docs/ios/README.md |
| I2 | iOS | Keychain / offline / biometrics / pinning | Samples: docs/ios/SAMPLES.md |
| W1 | Web | Scaffold + directory pull | Done |
| W2 | Web | PWA manifest + service worker | Done |
| W3 | Web | Offline queue helper | Done (docs/web-scaffold/offline-queue.js) |
| W4 | Web | Deploy + CORS | Doc: DEPLOY.md |
| N1 | Infra | Nginx, docker-compose, k8s example | Done |
| N2 | Infra | TURN/signaling self-host | Doc: TURN-SIGNALING.md |
| D1 | Domain | NCIC live API | Legal gate — CJIS; local Room log: NCICQueryDatabase |
| D2 | Domain | ATF eTrace | Legal gate; Room drafts: ATFFormDatabase |
| D3 | Domain | eIDAS QTSP / EU trust lists | Product gate — stub in EIDASService |
| D4 | Domain | JCA digital signatures | Done: DigitalSignatureService |
| D5 | Domain | Electronic seal verify | Done: SHA-256 compare in ElectronicSealService |
| D6 | Domain | XML/AS4 full stack | Stub + core/as4/README.md |
| D7 | Domain | Certificate revocation | Stub UNKNOWN; extend with OCSP/CRL |
| T1 | Testing | smoaVerify in CI |
Done — .gitea/workflows/ci.yml |
| T2 | Testing | Android coverage 80%+ | Plan — expand over time |
| T3 | Testing | E2E | Plan: E2E-PLAN.md |
| X1 | Docs | BUILD.md, TASKS.md, TODO sweep | Done |
| X2 | Build | ./gradlew smoaVerify (:backend:test, :app:testDebugUnitTest, :app:assembleDebug) + scripts/build-all.sh |
Done |
| A9 | Android | TLS pinning + AuthTokenInterceptor + enterprise settings card |
Done — NetworkModule, SECURITY-ENTERPRISE.md |
| A10 | Android | SecureTokenStore, OIDC BuildConfig, session lock overlay |
Done — security package, SessionLockOverlay |
| A11 | Android | Play Integrity client + Knox classpath probe | Done — PlayIntegrityVerifier, KnoxEnterpriseProbe |
| A12 | Android | Biometric-gated AES key (Keystore) | Done — BiometricSecretsVault; encrypt CryptoObject path: A16 |
| A13 | Android | OIDC login flow (AppAuth) + redirect activity / intent-filter | Done — OidcLoginCoordinator, manifest RedirectUriReceiverActivity |
| A14 | Android | Refresh token — OkHttp Authenticator + SecureTokenStore |
Done — TokenRefreshAuthenticator, token endpoint persisted after OIDC |
| A15 | Android | Certificate pinning host from hosted config (RemoteEndpointStore) |
Done — NetworkPinningConfig.resolveBackendHost + NetworkModule |
| A16 | Android | BiometricPrompt.CryptoObject + keystore encrypt path | Done — BiometricSecretsVault.tryCreateEncryptCryptoObject, BiometricAuthenticator.authenticateWithCryptoObject |
| A17 | Android | Session lock: device credential fallback | Done — BiometricAuthenticator.authenticateForSessionUnlock; sign-in MFA path allows PIN/pattern |
| A18 | Android | Demo auth + SSO when OIDC BuildConfig set | Hybrid — AuthFlowHost organization SSO + local demo; IdP-only when you remove demo UI |
| A19 | Android | Release R8 + pinning + Integrity + ProGuard | Verified — ./gradlew :app:assembleRelease succeeds; extend per-tenant release checklists |
| A20 | Android | Multi-host pins | Done — tls_pin_spec in hosted config + SMOA_TLS_PIN_SPEC BuildConfig; CertificatePinnerFactory.buildFromMultiSpec |
| A21 | Android | Classification / watermark from remote config | Done — classification_watermark_* in SmoaClientConfigJson, ClassificationWatermark |
| T4 | Testing | Unit tests: session lock logic, certificate pinning | Done — SessionLockLogicTest, CertificatePinnerFactoryTest; SecureTokenStore needs on-device / crypto-capable runner |
| T5 | Testing | UI tests: session lock, user settings | Partial — add @HiltAndroidTest + Compose rules when CI has an emulator/device |
| T6 | Testing | CI: scripts/generate-api-docs.sh |
Done — .gitea/workflows/ci.yml (step after smoaVerify) |
| B9 | Backend | Play Integrity verify endpoint | Stub — POST /api/v1/integrity/verify returns 501 until Google API wired — IntegrityAttestationController |