docs/ROADMAP.md

Rama main · réplica de lectura del repositorio original.

# ActaLog Development Roadmap

**Current Version:** 1.3.3 (Released) · 1.3.4 in progress (CI/supply-chain hardening)
**Last Updated:** 2026-07-04
**Overall Completion:** ~99% of core requirements

> Full per-release detail lives in [`docs/CHANGELOG.md`](CHANGELOG.md). Entries below summarize
> recent releases; the changelog is the source of truth.

---

## Executive Summary

ActaLog is a mobile-first Progressive Web App (PWA) for CrossFit workout tracking. The application is **production-ready** with all core features implemented: user authentication with email verification, three-tier role system (Athlete/Coach/Admin), workout logging, performance tracking and PR detection, import/export (Wodify CSV, JSON backup/restore), subscription billing, social features (notification likes), **full class scheduling** (gym locations, templates, sessions, coach assignments, reservations, waitlist, credit packages, and document management), PR leaderboards, and consistency achievements. The application deploys as a single Docker container with automatic database migrations and seed data across SQLite, PostgreSQL, and MariaDB.

---

## Released Versions

### v1.3.4 (In progress) — CI & supply-chain hardening
**Status:** Build/CI hardening; no application behavior changes.

**Highlights:**
- 🔶 Fixed a silently-broken `.golangci.yml` (v1 keys under `version: 2`) and made lint enforcing via `only-new-issues` (~605 pre-existing findings grandfathered)
- 🔶 New blocking CI gates: `govulncheck` (Go), `npm audit` (web), Trivy image scan (fixable HIGH/CRITICAL)
- 🔶 GitHub Actions pinned to commit SHAs; Docker base images pinned to digests (supply-chain integrity)

### v1.3.3 (Released 2026-07-04) — Maintenance
**Status:** Dependency & toolchain maintenance; no application behavior changes.

**Highlights:**
- ✅ 23 dependency/toolchain updates since v1.3.2 (Node 24, Go & web deps, GitHub Actions)
- ✅ Pinned npm to 11.16.0 in CI + Docker so `npm ci` stays in lockstep with `web/package-lock.json`

### v1.3.2 (Released 2026-05-07) — Admin user lifecycle + protected-user break-glass CLI
See [`docs/CHANGELOG.md`](CHANGELOG.md) for v1.3.0–v1.3.2 detail.

### v1.2.4 (Released 2026-04-28)
**Status:** Security hardening, part two — closes items deferred from v1.2.3.

**Highlights:**
- ✅ Security response headers middleware (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HSTS, project-tuned CSP)
- ✅ Avatar upload validates by magic bytes (`http.DetectContentType`) instead of trusting client `Content-Type`; extension allowlist closes stored-XSS path
- ✅ CI Failure Notify workflow dedupes and auto-closes (no more duplicate "[CI] Workflow failure" issues per Dependabot rebase)

### v1.2.3 (Released 2026-04-03)
**Status:** Security hardening release — OWASP audit remediation.

**Highlights:**
- ✅ Password policy raised to 12-char min + uppercase/lowercase/digit
- ✅ CORS allowlist actually enforced (was inert prior to this release)
- ✅ DOMPurify added to MarkdownRenderer; `serialize-javascript` pinned (RCE/DoS CVEs)
- ✅ Rate limiter IP extraction fixed (leftmost XFF, RemoteAddr port stripped); `rate_limit_exceeded` audit events
- ✅ Admin organizations list shows member count + edit-from-list

### v1.2.1 (Released 2026-04-01)
**Status:** Patch release — security fixes, dependency maintenance, CI hardening.

**Highlights:**
- ✅ Pinned axios to 1.13.5 (supply-chain attack mitigation)
- ✅ Calendar view fixes; admin breadcrumb fixes
- ✅ CI: setup-go uses go-version-file; date-sensitive test fix

### v1.2.0-beta (Released 2026-02-19)
**Status:** Class scheduling Phase 4, PR leaderboards, configurable beta logo

**Highlights:**
- ✅ Class packages (credit system), waitlist management, class notifications
- ✅ User documents / waivers per gym
- ✅ Delete class templates with cascade modes (template only / future sessions / all sessions)
- ✅ PR Leaderboards — gym-wide personal record comparison
- ✅ Consistency achievements
- ✅ Configurable beta logo via `LOGO_VARIANT` environment variable
- ✅ Leaderboard search and header nav icon

---

### v1.1.0-beta (Released 2026-01-xx)
**Status:** Three-tier roles, class scheduling Phase 1-3, coach dashboard

**Highlights:**
- ✅ Renamed "user" role to "athlete"; added "coach" as middle tier
- ✅ `CoachOrAdmin` middleware; coaches bypass subscription checks
- ✅ Dedicated `/api/coaches/` routes (sessions, roster, check-in, no-show, complete)
- ✅ Gym locations, class templates, schedule slots, class sessions with capacity
- ✅ Coach assignments per gym; reservations with check-in flow
- ✅ Coach Dashboard frontend; Admin all-sessions visibility

---

## Early Development History (v0.12 – v0.16)

See [CHANGELOG.md](CHANGELOG.md) for the full release history prior to v1.0.

---

## Version History & Status

### v0.17.0-beta (In Development)
**Status:** Merge/upsert for database restore and import duplicate handling

**Completed:**
- ✅ Three restore modes for database backups: `replace`, `merge`, `skip`
- ✅ Natural key matching (users by email, movements by name, WODs by name)
- ✅ ID remapping for foreign key references during merge/skip restore
- ✅ Detailed restore result statistics (records created, updated, skipped)
- ✅ User workout import: added `updateDuplicates` parameter
- ✅ Wodify import: added `skipDuplicates` and `updateDuplicates` parameters
- ✅ Schema metadata in backup format for type-aware restoration

**Technical Highlights:**
- 9 files modified (domain, service, handler layers)
- 674 lines added, 132 lines removed
- Full backward compatibility with existing backup format
- Tested on SQLite, PostgreSQL, and MariaDB

**API Changes:**
- `POST /api/admin/backups/{filename}/restore` accepts `mode` parameter
- `POST /api/import/user-workouts/confirm` accepts `update_duplicates` form field
- `POST /api/import/wodify/confirm` accepts `skip_duplicates` and `update_duplicates` form fields

---

### v0.16.0-beta (Released)
**Status:** Notification likes feature with social engagement

**Completed:**
- ✅ Domain layer (NotificationLike entity and repository interface)
- ✅ Repository layer with JOIN queries for user details
- ✅ Service layer with LikeNotification marking notifications as unread
- ✅ Handler layer with like/unlike/get likes endpoints
- ✅ Frontend NotificationLikes.vue component
- ✅ Integration into NotificationsView.vue
- ✅ Database migration 0.16.0 with CASCADE DELETE
- ✅ Multi-database support (SQLite, PostgreSQL, MariaDB)

**Social Engagement Features:**
- Users can like any notification (PR achievements, announcements, streaks, milestones)
- Only original recipient sees like count and list of likers
- Liking marks notification as unread for recipient
- Users CAN like their own notifications
- Display: Thumbs up icon with count, comma-separated liker names with "Liked by: " prefix
- CASCADE DELETE when notification is deleted

**Technical Highlights:**
- 5 new files created (domain, repository, service, handler, frontend component)
- 7 files modified (migrations, domain interface, repository, main.go, view, version, CHANGELOG)
- 3 API endpoints (POST/DELETE/GET for likes)
- Complete integration testing with test script
- Build #59 completed successfully

**API Endpoints:**
- `POST /api/notifications/{id}/like` - Like a notification
- `DELETE /api/notifications/{id}/like` - Unlike a notification
- `GET /api/notifications/{id}/likes` - Get all likes with user details

---

### v0.15.0-beta (Released)
**Status:** Admin announcement system for gym-wide notifications

**Completed:**
- ✅ Admin-only endpoint for creating announcements
- ✅ Sends notification to all users in the system
- ✅ Flexible notification system (PR achievements, announcements, etc.)
- ✅ Audit trail for all announcement creation

**Technical Highlights:**
- Admin announcements endpoint added to notification handler
- Route wiring in main.go
- Complete audit logging for announcement operations

**API Endpoints:**
- `POST /api/admin/notifications/announce` - Create announcement for all users (admin only)

---

### v0.14.0-beta (Released)
**Status:** Subscription billing system with dual-level (user + organization) billing

**Completed:**
- ✅ Complete subscription billing backend implementation (domain, repository, service, middleware, handler layers)
- ✅ Dual-level billing: user-level AND organization-level subscriptions
- ✅ Three subscription types: Free, Monthly, Annual + Permanent Free option
- ✅ Flexible access model: users have access if EITHER personal OR any organization subscription is active
- ✅ Manual admin payment control (mark subscriptions as paid/unpaid)
- ✅ Immediate read-only mode when subscriptions expire (no grace period)
- ✅ HTTP 402 Payment Required for blocked operations (POST/PUT/PATCH/DELETE)
- ✅ Read operations allowed when expired (GET/HEAD/OPTIONS for viewing/exporting)
- ✅ Complete audit trail for all subscription operations
- ✅ Migration 0.14.0 with automatic seeding of existing users (permanent free subscriptions)
- ✅ Zero downtime backward compatibility verified
- ✅ Multi-database support tested (SQLite, PostgreSQL, MariaDB)
- ✅ Database version management system with snapshots for all three engines
- ✅ Automation scripts for snapshot creation and verification
- ✅ 10 API endpoints (8 admin, 2 user) for subscription management

**Technical Highlights:**
- 14 new files created (domain, repositories, service, middleware, handler, documentation, scripts)
- 5 files modified (migrations, version, main.go, audit_log, CLAUDE.md)
- Performance-optimized access checking (< 10ms target per authenticated request)
- Version snapshots: SQLite (564 KB), PostgreSQL schema, MariaDB database
- Comprehensive documentation: VERSION_DATABASES.md, MIGRATION_TEST_0.14.0.md
- All existing users seeded with `is_permanent_free = TRUE` for backward compatibility

**Next Phase:** Frontend integration for subscription status display and admin subscription management UI

### v0.12.2-beta (Released)
**Status:** PWA offline functionality fix and user-controlled updates

**Completed:**
- ✅ Fixed service worker API caching pattern for offline access
- ✅ Added robust offline detection (multiple error indicators)
- ✅ Replaced silent auto-reload with user-controlled PWA updates
- ✅ Added offline save notification snackbar
- ✅ New UpdatePrompt component and PWA state management store
- ✅ Fixed WOD service unit tests

**Technical Highlights:**
- Service worker now correctly caches `/api/workouts`, `/api/movements`, `/api/wods`, `/api/templates`
- Axios interceptor detects offline via `Network Error`, `ERR_NETWORK`, `navigator.onLine`, and timeout
- Users see "Update Available" prompt with "Later" and "Update Now" options
- Workouts saved offline show "Saved Offline" notification

### v0.12.1-beta (Released)
**Status:** MySQL/MariaDB compatibility fix and Docker troubleshooting documentation

**Completed:**
- ✅ Fixed database-agnostic timestamp functions for MySQL/MariaDB
- ✅ Fixed hardcoded SQLite `datetime('now')` in refresh token repository
- ✅ Added `getTimestampFunc()` helper for cross-database timestamp support
- ✅ Enhanced Docker host database troubleshooting documentation
- ✅ Added UFW firewall and bind-address configuration guides

**Technical Highlights:**
- Critical fix for MySQL/MariaDB deployments that were failing on seed data import
- Comprehensive troubleshooting guide for connecting Docker containers to host databases
- Firewall configuration for Docker network access (172.17.0.0/16)

### v0.12.0-beta (Released)
**Status:** Mobile PWA stability and Docker metadata improvements

**Completed:**
- ✅ Mobile PWA overflow fix across 27 view files
- ✅ `.mobile-view-wrapper` CSS pattern for consistent mobile layouts
- ✅ OCI-compliant labels added to Docker build scripts
- ✅ Admin User Content view Actions column moved to first position
- ✅ iOS PWA safe-area handling enhanced in App.vue

**Technical Highlights:**
- Systematic fix for horizontal/vertical overflow on mobile devices
- Consistent scrolling behavior with fixed header/footer
- Docker images now include full OCI metadata for registry display
- Improved mobile UX for admin tables

### v0.11.0-beta (Released)
**Status:** Data Change Audit Logging system

**Completed:**
- ✅ Complete audit trail for data modifications
- ✅ Before/after values stored as JSON
- ✅ Admin UI for viewing and filtering data change logs
- ✅ Integration with WOD and Movement services
- ✅ Multi-database support (SQLite, PostgreSQL, MariaDB)

### v0.10.0-beta (Released)
**Status:** Docker deployment infrastructure with automatic seed import

**Completed:**
- ✅ Multi-stage Dockerfile with optimized build process
- ✅ Three docker-compose configurations (SQLite, PostgreSQL, MariaDB)
- ✅ GitHub Actions CI/CD workflow for automated image building
- ✅ Automatic seed data import on first deployment (182 movements, 314 WODs)
- ✅ Entrypoint script orchestrating app startup and seed import
- ✅ Environment-based configuration with graceful degradation
- ✅ Comprehensive Docker and database deployment documentation
- ✅ GitHub Container Registry integration (ghcr.io)

**Technical Highlights:**
- Production-ready Docker deployment with multi-database support
- Automatic seed import using marker file pattern for one-time execution
- Health checks for container monitoring
- Non-root container user for security
- Volume management for persistent data
- Tag-based versioning with automatic builds
- Helper scripts for building and pushing images
- Complete deployment guides (DOCKER.md, DATABASE_DEPLOYMENT.md, TEST.md)

**Use Cases Enabled:**
- Single-command deployment across all platforms
- Automatic population of movements and WODs database
- Seamless GitHub Container Registry integration
- Production deployments with PostgreSQL or MariaDB
- Development deployments with SQLite

### v0.9.0-beta (Released)
**Status:** Intermediate release (features integrated into v0.10.0)

### v0.8.2-beta (Released)
**Status:** Quick Log template selection bug fixes and UX improvements

**Completed:**
- ✅ Fixed crash when selecting templates from Quick Log
- ✅ Fixed WOD names not displaying in template logging
- ✅ Improved UI consistency between Quick Log and Log Workout pages
- ✅ Added clear warning about data preservation when using templates
- ✅ Hidden "Browse Templates" button for cleaner UX when coming from Quick Log

**Technical Highlights:**
- Removed conflicting v-autocomplete configuration causing null errors
- Added optional chaining for defensive null-safety
- Support for both nested and flattened WOD API data formats
- Improved template initialization and performance array handling
- Orange warning UI for important user communication

### v0.8.1-beta (Released)
**Status:** Cross-database backup/restore and schema evolution support

**Completed:**
- ✅ Database-agnostic backup/restore system
- ✅ Cross-database migration support (SQLite ↔ PostgreSQL ↔ MariaDB)
- ✅ Schema evolution handling (forward and backward compatibility)
- ✅ Automatic PostgreSQL sequence reset
- ✅ Data type conversion (boolean handling across databases)
- ✅ Column filtering for missing/extra columns
- ✅ Table introspection for schema differences

**Technical Highlights:**
- Full cross-database migration capability (any database → any database)
- Schema evolution: restore v0.6.0 backups to v0.8.1 (handles missing columns)
- Boolean conversion: `0/1` (SQLite/MySQL) ↔ `false/true` (PostgreSQL)
- PostgreSQL sequence management prevents duplicate key errors
- Zero manual SQL intervention for database migrations
- 100% backward compatible with existing backup/restore

**Use Cases Enabled:**
- Development with SQLite → Production with PostgreSQL (using backup/restore)
- Emergency recovery to different database type
- Multi-tenant migrations using PostgreSQL schemas
- Version upgrades with old backups

### v0.8.0-beta (Released)
**Status:** PostgreSQL migration and multi-database production readiness

**Completed:**
- ✅ PostgreSQL driver migration (lib/pq → pgx/v5)
- ✅ Database schema isolation support (DB_SCHEMA)
- ✅ Connection pooling configuration (PostgreSQL and MySQL/MariaDB)
- ✅ Multi-database testing verification (SQLite, PostgreSQL, MariaDB)
- ✅ Database abstraction layer enhancements
- ✅ Comprehensive migration documentation
- ✅ Docker deployment planning (50+ sub-tasks added to TODO)

**Technical Highlights:**
- 10-30% performance improvement for PostgreSQL workloads
- Support for multi-tenant PostgreSQL deployments via schemas
- Fine-grained connection pool tuning (MaxOpenConns, MaxIdleConns, ConnMaxLifetime)
- Full backward compatibility for SQLite and MySQL/MariaDB
- Production-tested with real databases (PostgreSQL 16, MariaDB 11)

### v0.7.6-beta (Released)
**Status:** Database backup enhancements and comprehensive documentation planning

**Completed:**
- ✅ Backup upload for migration between systems
- ✅ Enhanced audit logging for backup operations
- ✅ Cross-version restore compatibility
- ✅ Comprehensive documentation planning (end-user help, admin guide, test coverage)

### v0.7.5-beta (Released)
**Status:** Admin integration and Remember Me functionality

**Completed:**
- ✅ Admin user management complete integration
- ✅ Remember Me functionality (30-day sessions)
- ✅ Database backup system activation
- ✅ SQLite dumps in all backups
- ✅ PR History date display fixes

### v0.7.4-beta (Released)
**Status:** Quick Log enhancements and admin features

**Completed:**
- ✅ Quick Log buttons on library cards
- ✅ Quick Log on detail pages
- ✅ Admin user management dashboard
- ✅ Template deletion bug fix

### v0.7.0-beta (Released)
**Status:** Wodify Performance Import system

**Completed:**
- ✅ Wodify CSV import with 9 result type parsers
- ✅ Auto-entity creation for movements and WODs
- ✅ Successfully tested with 6+ years of real-world data

### v0.6.0-beta (Released)
**Status:** Database backup/restore system implementation

**Completed:**
- ✅ Full database backup to ZIP with JSON
- ✅ Restore functionality
- ✅ Admin-only access with audit logging

### v0.5.1-beta (Released)
**Status:** Import/Export system complete

**Completed:**
- ✅ WOD export to CSV
- ✅ Movement export to CSV
- ✅ User Workouts export to JSON
- ✅ WOD import with preview and validation
- ✅ Movement import with preview and validation
- ✅ User Workouts import (confirmed working)

### v0.5.0-beta (Released)
**Status:** Core workout system complete

**Features:**
- ✅ Template-based workout architecture
- ✅ WOD management (create, list, search, update, delete)
- ✅ User workout logging with movements and WODs
- ✅ Monthly workout statistics
- ✅ Performance tracking and search

### v0.4.6-beta (Released)
**Features:**
- ✅ Session management (list, revoke, revoke-all)
- ✅ Admin user management (CRUD operations)
- ✅ Account unlock/disable/enable by admins
- ✅ User role management
- ✅ Email verification toggle

### v0.3.1-beta (Released)
**Features:**
- ✅ Email verification system
- ✅ Verification email sending on registration
- ✅ Resend verification functionality

### v0.3.0-beta (Released)
**Features:**
- ✅ Personal Records (PR) tracking for movements
- ✅ PR auto-detection and manual toggle
- ✅ Password reset flow
- ✅ Profile picture upload

### v0.2.0-beta (Released)
**Features:**
- ✅ PWA implementation with service worker
- ✅ Offline support with IndexedDB
- ✅ Background sync queue
- ✅ Auto-update notifications

---

## Completion Analysis

### ✅ Completed Features (98%)

#### Authentication & User Management
- User registration with email verification
- Login/logout with JWT tokens and refresh tokens
- Password reset flow
- Profile management with avatar upload
- Session management
- Admin user management (full CRUD)
- Account lockout after failed login attempts

#### Workout System
- WOD management (10 standard WODs seeded)
- Movement library (31 standard movements seeded)
- Custom WOD and movement creation
- Workout templates (create, list, update, delete)
- User workout logging (movements + WODs)
- Workout history with filtering
- Monthly workout statistics

#### Performance Tracking
- PR tracking for movements (weight-based)
- PR auto-detection when logging workouts
- Manual PR flag toggle
- PR history view
- Retroactive PR flagging
- Performance search and charts

#### Import/Export System
- WOD export/import (CSV) with skip/update duplicate handling
- Movement export/import (CSV) with skip/update duplicate handling
- User Workouts export/import (JSON) with skip/update duplicate handling
- Wodify performance import with skip/update duplicate handling
- Import preview with validation
- Comprehensive duplicate detection and handling across all import types

#### Backup/Restore System
- Full database backup to ZIP with JSON + schema metadata
- Three restore modes: replace, merge, skip
- Natural key matching (users by email, movements/WODs by name)
- ID remapping for foreign key integrity
- Cross-database restore support (SQLite, PostgreSQL, MariaDB)

#### PWA Features
- Service worker with caching strategies
- Web app manifest
- Offline support with IndexedDB
- Background sync queue
- Auto-update notifications
- Installable on mobile/desktop

#### Admin Features
- Admin-only routes with middleware
- Data cleanup tools
- Audit log viewing and cleanup
- User account management UI

#### Security
- JWT authentication with refresh tokens
- Password hashing with bcrypt
- CORS configuration
- Rate limiting middleware (pkg/middleware/rate_limit.go)
- SQL injection protection
- Account lockout protection

#### Subscription System (Frontend Complete)
- Subscription status badge in Settings view
- Subscription expired banner in App.vue
- Admin subscription management view (AdminSubscriptionsView.vue)
- Create/Cancel/MarkAsPaid dialogs
- Subscription store with full state management
- HTTP 402 handling for expired subscriptions

#### Calendar & Timeline
- Calendar view with workout dots (WorkoutCalendarView.vue)
- Timeline view with chronological history (WorkoutTimelineView.vue)
- Month/week navigation

#### Performance Charts (Partial)
- WeightProgressChart.vue component created
- WorkoutFrequencyChart.vue component created
- Not yet integrated into dashboard views

### ⚠️ Incomplete Features (2%)

#### High Priority (Blockers for Production)
1. ~~**User Workouts Import Bug**~~ - ✅ Fixed with duplicate handling
2. ~~**Database Backup/Restore**~~ - ✅ Complete with merge/upsert modes
3. ~~**Calendar/Timeline Views**~~ - ✅ Complete (WorkoutCalendarView.vue, WorkoutTimelineView.vue)
4. **Visual Progress Charts** - Components exist but not integrated into views
5. ~~**WOD PR Tracking**~~ - ✅ Complete with time/AMRAP detection (GetBestTimeForWOD, GetBestRoundsRepsForWOD)
6. **Test Coverage** - Currently ~15%, need 80%+

#### Medium Priority (Enhanced Features)
7. Leaderboard system (by division: rx, scaled, beginner)
8. ~~User settings management UI~~ - ✅ SettingsView.vue exists
9. Workout history filters (by type, movement, date range)
10. Flattened CSV export for spreadsheet analysis
11. ~~PWA icon generation~~ - ✅ All sizes generated from SVG
12. Custom install prompt
13. Admin reporting (activity, performance)

#### Low Priority (Future Enhancements)
14. Workout scheduling (future dates)
15. Push notifications
16. Periodic background sync
17. Web Share API
18. PostgreSQL driver migration (lib/pq → pgx)
19. Accessibility compliance (WCAG 2.1 AA)
20. Redis session storage

---

## Development Plan

### Phase 1: v0.5.1-beta Completion (2-4 hours)
**Goal:** Fix critical import bug

**Tasks:**
- [ ] Debug User Workouts import confirm endpoint
- [ ] Investigate transaction/database constraint issues
- [ ] Add detailed error logging
- [ ] Test import with various scenarios
- [ ] Verify data persistence after import

**Success Criteria:**
- User Workouts import successfully creates workouts
- Data visible in `/api/workouts` and export endpoints
- No silent failures or transaction rollbacks

---

### Phase 2: v0.6.0-beta - Database Backup/Restore (2-3 days)
**Goal:** Production-critical data protection

**Backend Tasks:**
- [ ] Create `internal/service/backup_service.go`
  - [ ] `CreateBackup()` - Export all tables to JSON + files to ZIP
  - [ ] `ListBackups()` - Return backup metadata
  - [ ] `GetBackupMetadata()` - Read metadata from backup file
  - [ ] `DeleteBackup()` - Remove backup with audit log
  - [ ] `RestoreBackup()` - Full restore from backup
- [ ] Create `internal/handler/backup_handler.go`
  - [ ] `POST /api/admin/backups` - Create backup
  - [ ] `GET /api/admin/backups` - List backups
  - [ ] `GET /api/admin/backups/{filename}` - Download backup
  - [ ] `GET /api/admin/backups/{filename}/metadata` - Get metadata
  - [ ] `DELETE /api/admin/backups/{filename}` - Delete backup
  - [ ] `POST /api/admin/backups/{filename}/restore` - Restore backup
- [ ] Wire up routes in `cmd/actalog/main.go`
- [ ] Create `backups/` directory with .gitignore

**Frontend Tasks:**
- [ ] Create `web/src/views/AdminBackupsView.vue`
  - [ ] Backup list table with metadata
  - [ ] Create backup button with progress
  - [ ] Download/delete actions per backup
  - [ ] Restore with strong confirmation dialog
  - [ ] Empty state for no backups
- [ ] Add route `/admin/backups` to router
- [ ] Add navigation link in admin menu

**Testing:**
- [ ] Unit tests for BackupService
- [ ] Integration tests for backup/restore workflow
- [ ] Test with all database drivers (SQLite, PostgreSQL, MySQL)
- [ ] Manual testing: create, download, restore, delete

**Success Criteria:**
- Admin can create full database backups
- Backups include all data + uploaded files
- Restore successfully rebuilds database
- Works across different database drivers

---

### Phase 3: v0.7.0-beta - Enhanced UX (3-4 days)
**Goal:** Calendar views and visual charts

#### 3.1 Calendar/Timeline Views (1-2 days)
- [ ] Create `web/src/views/WorkoutCalendarView.vue`
  - [ ] Calendar component with workout dots
  - [ ] Click date to view workouts
  - [ ] Month/week navigation
  - [ ] Color coding by workout type
- [ ] Create `web/src/views/WorkoutTimelineView.vue`
  - [ ] Chronological timeline with cards
  - [ ] Infinite scroll or pagination
  - [ ] Filters by type, movement, date range
- [ ] Add routes to router
- [ ] Add navigation from dashboard/profile
- [ ] API endpoints (may need new query params)

#### 3.2 Visual Progress Charts (1-2 days)
- [ ] Install chart library (Chart.js or similar)
- [ ] Create `web/src/components/charts/WeightProgressChart.vue`
- [ ] Create `web/src/components/charts/WorkoutFrequencyChart.vue`
- [ ] Create `web/src/components/charts/MovementVolumeChart.vue`
- [ ] Integrate charts into dashboard
- [ ] Add date range selector
- [ ] API endpoints for aggregated data

#### 3.3 WOD PR Tracking (1 day)
- [ ] Update `DetectAndFlagPRs()` service method
  - [ ] Add time-based PR detection (faster time)
  - [ ] Add AMRAP PR detection (more rounds+reps)
- [ ] Update repository methods
  - [ ] `GetBestTimeForWOD()`
  - [ ] `GetBestRoundsRepsForWOD()`
- [ ] Test retroactive PR flagging for WODs
- [ ] Update frontend to show WOD PRs

**Success Criteria:**
- Users can view workouts in calendar format
- Timeline view shows chronological history
- Charts visualize progress over time
- WOD PRs detected for time and AMRAP workouts

---

### Phase 4: v0.8.0-beta - Testing & Polish (2-3 days)
**Goal:** Production stability

- [ ] Increase unit test coverage to 80%+
  - [ ] WODService tests
  - [ ] WorkoutWODService tests
  - [ ] BackupService tests
  - [ ] Repository tests
- [ ] Integration tests for all v0.5.0+ endpoints
- [ ] Frontend component tests (Vitest)
- [ ] End-to-end testing (Playwright or Cypress)
- [ ] Performance testing
- [ ] Security audit
- [ ] Accessibility audit (basic)

**Success Criteria:**
- >80% test coverage
- All critical paths have integration tests
- No high-severity security vulnerabilities
- Basic accessibility compliance

---

### Phase 5: v1.0.0 - Production Release (1-2 days)
**Goal:** Production-ready deployment

- [ ] Generate all PWA icons (72px - 512px)
- [ ] Create apple-touch-icon.png
- [ ] Production HTTPS setup documentation
- [ ] Nginx configuration guide
- [ ] Database migration guide
- [ ] Backup/restore documentation
- [ ] User guide
- [ ] API documentation
- [ ] Deployment checklist
- [ ] Version bump to 1.0.0

**Success Criteria:**
- Application passes production readiness checklist
- All documentation complete
- PWA installable on all platforms
- Zero critical bugs

---

## Post-1.0 Roadmap (v1.1 - v1.3)

### v1.1.0 - Leaderboards (2-3 days)
- Leaderboard system by division (rx, scaled, beginner)
- Ranking algorithm
- User rank display
- Division selector when logging WOD scores

### v1.2.0 - User Settings & Filters (2-3 days)
- Settings management UI
- Notification preferences
- Export format preferences
- Workout history filters (type, movement, date)
- Flattened CSV export for spreadsheets

### v1.3.0 - Admin & Reports (2-3 days)
- Admin dashboard with statistics
- User activity reports
- Performance monitoring
- Global data export
- User data import for migration

---

## Long-Term Vision (v2.0+)

### Future Enhancements
- Workout scheduling (plan future workouts)
- Push notifications for reminders
- Web Share API for workout sharing
- Social features (friend system, comments)
- Coach/athlete relationship features
- Gym/box management
- Nutrition tracking integration
- Wearable device sync (Apple Watch, Garland, etc.)
- Mobile native apps (if PWA limitations encountered)

### Infrastructure Improvements
- PostgreSQL driver migration (lib/pq → pgx)
- Redis for session storage
- Horizontal scaling support
- Advanced caching strategies
- CDN integration
- Multi-region deployment
- Real-time sync with WebSockets

### Enterprise Features
- Multi-tenant support
- Custom branding
- Advanced analytics
- Data warehouse integration
- API for third-party integrations
- Webhooks for events

---

## Estimated Timeline

### Critical Path to v1.0 (Production Ready)
- **Phase 1:** Fix import bug - 2-4 hours
- **Phase 2:** Backup/restore - 2-3 days
- **Phase 3:** UX enhancements - 3-4 days
- **Phase 4:** Testing & polish - 2-3 days
- **Phase 5:** Production prep - 1-2 days

**Total: 10-14 days** of focused development

### Enhanced Features (v1.1 - v1.3)
- **v1.1:** Leaderboards - 2-3 days
- **v1.2:** Settings & filters - 2-3 days
- **v1.3:** Admin features - 2-3 days

**Total: Additional 7-12 days**

### Grand Total
**17-26 days** (3-5 weeks) to feature-complete v1.3

---

## Success Metrics

### v1.0 Release Criteria
- ✅ All high-priority features implemented
- ✅ >80% test coverage
- ✅ Zero critical bugs
- ✅ Database backup/restore functional
- ✅ PWA fully installable on iOS/Android/Desktop
- ✅ Production deployment documentation complete
- ✅ User guide published
- ✅ Security audit passed

### v1.3 Release Criteria
- ✅ All medium-priority features implemented
- ✅ Leaderboards functional
- ✅ User settings configurable
- ✅ Admin reporting operational
- ✅ >85% test coverage
- ✅ Performance benchmarks met
- ✅ Accessibility compliance (basic)

---

## Risk Assessment

### Critical Risks
1. **Database backup/restore complexity** - Multi-database support may have edge cases
   - Mitigation: Thorough testing with all database drivers
2. **Import bug may be schema-related** - Could indicate deeper issues
   - Mitigation: Detailed debugging and transaction logging
3. **Chart library performance** - May slow down on large datasets
   - Mitigation: Data pagination and lazy loading

### Medium Risks
4. **PWA icon generation** - Design consistency across sizes
   - Mitigation: Use automated tools and test on real devices
5. **Test coverage target** - May uncover hidden bugs
   - Mitigation: Gradual increase with regression testing

---

## Notes

- This roadmap is based on current codebase analysis (v0.5.1-beta)
- Timeline assumes single developer working full-time
- Priorities may shift based on user feedback
- Production deployment assumes self-hosted infrastructure
- Cloud deployment (AWS/GCP/Azure) would require additional configuration

**Last Review:** 2025-11-21
**Next Review:** After v0.5.1-beta completion