defiQUG
a2dc194a49
- Add Gitea Actions workflow; point README to gitea.d-bis.org/Sankofa_Phoenix/SMOA - Expand .gitignore for Spring H2 data, secrets, Kotlin .kotlin/, tooling - Track docs/api/generated ReDoc bundle; refresh api docs README - Android: network/auth/sync, UI shell, tests; backend credentials/integrity APIs - Docs, scripts (generate-api-docs), modules and core updates Made-with: Cursor
7.1 KiB
7.1 KiB
SMOA – Master task list
All areas; status reflects repo state after the 2026-02 optional-task sweep. Details: TODO.md.
| # | Area | Task | Status |
|---|---|---|---|
| B1 | Backend | Prod profile, Flyway, PostgreSQL docs | Done |
| B2 | Backend | Tenant filter (X-Unit) |
Done |
| B3 | Backend | Pagination / OpenAPI params | Done |
| B4 | Backend | ETag for GET /api/v1/* |
Done |
| B5 | Backend | Request ID filter | Done |
| B6 | Backend | API versioning doc | Done |
| B7 | Backend | Gradle Kotlin plugin + FAIL_ON_PROJECT_REPOS fix |
Done |
| B8 | Backend | Test profile (application-test.yml), passing tests |
Done |
| A1 | Android | Sync serialization (Gson), PullAPI, BuildConfig API URL/key | Done |
| A2 | Android | InfrastructureManager STUN/signaling from BuildConfig | Done |
| A3 | Android | Android 16 target doc | Done |
| A4 | Android | Knox integration | Doc: KNOX-INTEGRATION.md (SDK not bundled) |
| A5 | Android | WebRTC PeerConnection | Stub + WebRTCManager; optional AAR |
| A6 | Android | Connection quality | Done: NetworkEstimatesConnectionQualityMonitor |
| A7 | Android | Screen share / file transfer | Stub flags in VideoTransport |
| A8 | Android | SmartCardReader | Stub (no PC/SC driver) |
| I1 | iOS | App in Xcode | External – create project; contract in docs/ios/README.md |
| I2 | iOS | Keychain / offline / biometrics / pinning | Samples: docs/ios/SAMPLES.md |
| W1 | Web | Scaffold + directory pull | Done |
| W2 | Web | PWA manifest + service worker | Done |
| W3 | Web | Offline queue helper | Done (offline-queue.js) |
| W4 | Web | Deploy + CORS | Doc: DEPLOY.md |
| N1 | Infra | Nginx, docker-compose, k8s example | Done |
| N2 | Infra | TURN/signaling self-host | Doc: TURN-SIGNALING.md |
| D1 | Domain | NCIC live API | Legal gate – CJIS; local Room log: NCICQueryDatabase |
| D2 | Domain | ATF eTrace | Legal gate; Room drafts: ATFFormDatabase |
| D3 | Domain | eIDAS QTSP / EU trust lists | Product gate – stub in EIDASService |
| D4 | Domain | JCA digital signatures | Done: DigitalSignatureService |
| D5 | Domain | Electronic seal verify | Done: SHA-256 compare in ElectronicSealService |
| D6 | Domain | XML/AS4 full stack | Stub + core/as4/README.md |
| D7 | Domain | Certificate revocation | Stub UNKNOWN; extend with OCSP/CRL |
| T1 | Testing | smoaVerify in CI |
Done (.gitea/workflows/ci.yml) |
| T2 | Testing | Android coverage 80%+ | Plan – expand over time |
| T3 | Testing | E2E | Plan: E2E-PLAN.md |
| X1 | Docs | BUILD.md, TASKS.md, TODO sweep | Done |
| X2 | Build | ./gradlew smoaVerify + scripts/build-all.sh (backend test + debug APK) |
Done |
| A9 | Android | TLS pinning + AuthTokenInterceptor + enterprise settings card |
Done — NetworkModule, SECURITY-ENTERPRISE.md |
| A10 | Android | SecureTokenStore, OIDC BuildConfig, session lock overlay |
Done — security/, SessionLockOverlay |
| A11 | Android | Play Integrity client + Knox classpath probe | Done — PlayIntegrityVerifier, KnoxEnterpriseProbe |
| A12 | Android | Biometric-gated AES key scaffold | Done — BiometricSecretsVault; Next: CryptoObject + token wrap |
| A13 | Android | OIDC login flow (AppAuth) + redirect activity / intent-filter | Done — OidcLoginCoordinator, manifest RedirectUriReceiverActivity |
| A14 | Android | Refresh token — OkHttp Authenticator + SecureTokenStore |
Done — TokenRefreshAuthenticator, token endpoint persisted after OIDC |
| A15 | Android | Certificate pinning host from hosted config (RemoteEndpointStore) |
Done — NetworkPinningConfig.resolveBackendHost + NetworkModule |
| A16 | Android | BiometricPrompt.CryptoObject + keystore encrypt path | Done — BiometricSecretsVault.tryCreateEncryptCryptoObject, BiometricAuthenticator.authenticateWithCryptoObject |
| A17 | Android | Session lock: device credential fallback | Done — BiometricAuthenticator.authenticateForSessionUnlock, sign-in MFA path allows PIN/pattern |
| A18 | Android | Demo auth + SSO when OIDC BuildConfig set | Hybrid — AuthFlowHost organization SSO + local demo; full IdP-only when you remove demo UI |
| A19 | Android | Release R8 + pinning + Integrity + ProGuard | Verified — ./gradlew :app:assembleRelease succeeds; extend release checklists per tenant |
| A20 | Android | Multi-host pins | Done — tls_pin_spec in hosted config + SMOA_TLS_PIN_SPEC BuildConfig; CertificatePinnerFactory.buildFromMultiSpec |
| A21 | Android | Classification / watermark from remote config | Done — classification_watermark_* in SmoaClientConfigJson, ClassificationWatermark |
| T4 | Testing | Unit tests: session lock logic, certificate pinning | Done — SessionLockLogicTest, CertificatePinnerFactoryTest; SecureTokenStore needs on-device / crypto-capable runner |
| T5 | Testing | UI tests: session lock, user settings | Partial — add @HiltAndroidTest + Compose rules on emulator when CI has a device |
| T6 | Testing | CI: scripts/generate-api-docs.sh |
Done — .gitea/workflows/ci.yml |
| B9 | Backend | Play Integrity verify endpoint | Stub — POST /api/v1/integrity/verify returns 501 until Google API wired — IntegrityAttestationController |