native-update 2.0.0 → 3.1.0

package/docs/REMAINING_FEATURES.md

@@ -1,145 +1,192 @@
 # Remaining Features for Production Readiness
 
-**Last Updated:** 2026-01-16
-**Status:** ✅ Core Features Complete - Optional Enhancements Listed Below
+**Last Updated:** 2026-06-22
+**Status:** ✅ Production Ready — Play-Store-publishable end-to-end as of 2026-05-16. Core features complete. Optional enhancements listed below. Finalization re-verified 2026-06-22 (plugin + website + docs-site builds all green; no automatable gaps remain).
 
-This document tracks remaining optional work and future enhancements.
+This document tracks remaining optional work and future enhancements. It is refreshed alongside major releases; for the authoritative "what shipped when" timeline see the root `CLAUDE.md` Audit Record + `docs/CHANGELOG.md`.
 
 ---
 
-## ✅ COMPLETED Features
+## ✅ COMPLETED Features (as of 2026-05-18)
 
 ### Backend Infrastructure ✅
-- [x] Production-grade update server (Firebase Functions)
-- [x] Database integration (Firestore)
-- [x] Google Drive integration for bundle storage
-- [x] API authentication (Firebase Auth)
-- [x] Admin dashboard (Marketing website)
+
+- [x] Laravel 13 + Nova 5 SaaS backend (`backend/`) — the only backend after v3.0.0
+- [x] MySQL persistence (single source of truth)
+- [x] Google Drive bundle storage (server-side OAuth; encrypted tokens at rest)
+- [x] Identity via Laravel Socialite (Google OAuth)
+- [x] Sanctum personal access tokens for dashboard auth
+- [x] `spatie/laravel-permission` RBAC (`super-admin`, `admin`, `user` roles + per-route `can:` middleware + `Gate::before` super-admin bypass)
+- [x] Mobile API plane (`/api/v1/*`) with per-app `ValidateApiKey` middleware
 - [x] Analytics endpoints
+- [x] PayPal webhook + Stripe subscription model
+- [x] FormRequest validators (UpdateBuildRequest + Create/Update FormRequests for App, ApiKey, SigningKey)
+- [x] Backend policies + Nova canSee guards
+- [x] env-driven CORS allowlist (`backend/config/cors.php`)
 
 ### Native Platform Implementation ✅
-- [x] Complete iOS implementation (7 Swift files)
-- [x] Complete Android implementation (7 Kotlin files)
+
+- [x] Complete iOS implementation (Swift)
+- [x] Complete Android implementation (Kotlin; Play Core update + Play Review + WorkManager background)
 - [x] Platform-specific error handling
-- [x] Background update services
-- [x] App store integration (Play Core, StoreKit)
+- [x] Background update services (BGTaskScheduler / WorkManager)
+- [x] App store integration (Play Core, StoreKit `SKStoreReviewController`)
+
+### Testing Suite ✅
 
-### Testing Suite ✅ IMPLEMENTED
-- [x] Unit tests for TypeScript code (9 test files)
-- [x] Integration tests
-- [x] Unit tests for iOS native code
-- [x] Unit tests for Android native code
-- [x] E2E testing scenarios
+- [x] Backend Pest/PHPUnit tests covering OAuth + Sanctum + Spatie + UpdateBuildRequest + PayPal webhook + BundleUpload + UserLicense (**134/134 passing**)
+- [x] Unit tests for iOS native code (XCTest)
+- [x] Unit tests for Android native code (JUnit/Kotlin)
 
 ### Security Implementation ✅
-- [x] Client-side signature verification
+
+- [x] Client-side signature verification (RSA-SHA256)
 - [x] Certificate pinning architecture
 - [x] SHA-256 checksum verification
-- [x] RSA/ECDSA signature support
+- [x] RSA-2048 / RSA-4096 / EC P-256 / EC P-384 signature support
 - [x] HTTPS enforcement
+- [x] Bundle signing service (CLI tools)
+- [x] Public/private key generation
+- [x] Pre-launch DIY pentest checklist (`docs/security/PRE-LAUNCH-PENTEST-CHECKLIST.md`) covering 10 sections + 9 specific attack paths
+- [x] Encrypted Drive OAuth token storage (Laravel encrypter)
+- [x] Hashed-at-rest Sanctum tokens
 
 ### Developer Tools ✅
-- [x] Complete CLI package (8 commands)
+
+- [x] Complete CLI package (8 commands: `init`, `bundle-create`, `bundle-sign`, `bundle-verify`, `keys-generate`, `backend-create`, `server-start`, `monitor`)
 - [x] Version management system
 - [x] Bundle creation and signing
 - [x] Local testing server
-- [x] Monitor utility
+- [x] Monitor utility (interval+spinner cleanup, signal handlers, failure bail)
 
 ### Documentation ✅
-- [x] Complete API reference (7 files)
+
+- [x] Complete API reference (`docs/api/`)
 - [x] Platform-specific guides
-- [x] Security implementation guide
-- [x] Migration guide
+- [x] Security implementation guide + pentest checklist
+- [x] Migration guide (incl. v2 → v3.0.0 + 2026-05-11 auth-swap notes)
 - [x] Getting started guides
+- [x] Public Docusaurus docs site (`native-update-docs/` sibling repo on Firebase Hosting — 58 pages, ~76k words, full Diátaxis coverage; 7-day refresh cooldown)
 
 ### Example Implementations ✅
-- [x] React + Capacitor example app
-- [x] Node.js + Express backend
-- [x] Firebase Cloud Functions backend
+
+- [x] React + Capacitor example app (with capability cards for app-update / app-review / background-update)
+- [x] Node.js + Express backend example
+
+### CI/CD ✅
+
+- [x] `.github/workflows/ci.yml` — yarn-based CI on every PR
+- [x] `.github/workflows/release.yml` — tag-driven npm publish (with provenance) + GitHub Release
+- [x] `.github/workflows/example-bundle.yml` — release+manual+weekly-cron — build example app, sign, attach signed zip + .sig + metadata to GitHub Release
+
+### Marketing Website + Dashboard ✅
+
+- [x] React 19 + Vite 7 + Tailwind v4 + TanStack Query + Radix primitives
+- [x] Capacitor-wrapped for Play Store distribution
+- [x] All legal pages (Privacy, Terms, Security, Cookies, Data Deletion) rewritten for the Sanctum stack
+- [x] SEO/AEO: per-route static HTML prerender; 30+ AI-bot allow list in robots.txt; llms.txt / llms-full.txt / ai.txt / humans.txt / security.txt / machine-readable pricing.md
+- [x] Per-route JSON-LD (WebSite + Organization + SoftwareApplication + FAQPage + HowTo + Article + Product)
+- [x] Observability: Sentry + Microsoft Clarity + Amplitude (page-view auto-track; silently skip when env keys absent)
+
+### Android Release Readiness ✅ (2026-05-16)
+
+- [x] `signingConfigs.release` wired (keystore path, store password, key alias, key password from env)
+- [x] ProGuard/R8 enabled with sensible Capacitor-aware rules
+- [x] `network_security_config.xml` (HTTPS-only outside debug; localhost cleartext exception for emulator/device dev)
+- [x] Branded launcher icons (15 PNGs across all densities + adaptive)
+- [x] Branded splash assets (11 PNGs)
+- [x] 3 Play Store graphics (feature graphic, promo graphic, TV banner) rendered from SVG via rsvg-convert
+- [x] 10-section BUILD_FOR_PLAY_STORE.md runbook
+- [x] screenshots/CAPTURE-GUIDE.md
+- [x] Play Store full-description.md + data-safety.md written for the Sanctum stack
 
 ---
 
 ## 🟡 Optional Enhancement Features
 
-### 1. Advanced Testing (Optional)
-- [x] iOS XCTest implementation
-- [x] Android JUnit tests
-- [x] E2E test suite with Detox/Appium/Jest
-- [ ] Performance benchmarking suite
-- [ ] Security vulnerability testing
+### 1. Advanced Update Features (Optional)
 
-### 2. Advanced Update Features (Optional)
-- [ ] Delta updates WASM optimization (placeholder exists)
+- [ ] Delta updates WASM optimization (placeholder exists; not yet wired)
 - [ ] A/B testing support
-- [ ] Staged rollouts with percentage targeting
-- [ ] Update scheduling
+- [ ] Update scheduling (calendar-based)
 - [ ] Geographic targeting
 
-### 3. Enterprise Features (Optional)
-- [ ] Multi-tenant SaaS platform
-- [ ] Enterprise SSO integration
-- [ ] Advanced audit logging
-- [ ] Custom branding options
-- [ ] SLA monitoring
+(Note: percentage rollouts + pause/resume + targetSegments JSON column are already shipped on the `builds` table.)
+
+### 2. Enterprise Features (Optional)
+
+- [ ] Multi-tenant SaaS hardening beyond current single-user model (sub-team / org-account / shared ownership)
+- [ ] Enterprise SSO integration (SAML / OIDC providers beyond Google)
+- [ ] Advanced audit logging UI (raw events already persist via `analytics_events` + Nova; UI surfaces TBD)
+- [ ] Custom branding options for white-label SaaS
+- [ ] SLA monitoring + uptime page
+
+### 3. Additional Framework Support (Optional)
 
-### 4. Additional Framework Support (Optional)
 - [ ] Vue example app
 - [ ] Angular example app
 - [ ] Svelte example app
 - [ ] Python backend example
 - [ ] Java backend example
 
-### 5. Community Features (Optional)
+### 4. Community / Content (Optional)
+
 - [ ] Video tutorials
-- [ ] CI/CD integration templates
-- [ ] GitHub Actions workflows
+- [ ] Wikipedia mention (highest-leverage AI-citation source per Princeton GEO study)
+- [ ] Reddit / Product Hunt / AlternativeTo / G2 / Capterra presence
 - [ ] Community plugins directory
 
+### 5. Refactors (Optional, deferred)
+
+- [x] `website/src/pages/DocsPage.tsx` — DONE. Refactored from 1,406 lines into a 166-line shell + `website/src/pages/docs-page/sections/` (per-feature section components). (Verified 2026-06-22.)
+- [ ] Three page components sit marginally over the 500-line soft guideline — `FeaturesPage.tsx` (578), `ExamplesPage.tsx` (523), `dashboard/AnalyticsPage.tsx` (519). Cohesive content-heavy pages that build clean; split only if they grow further.
+
 ---
 
 ## 📊 Completion Summary
 
 | Category | Status | Notes |
 |----------|--------|-------|
-| Core Plugin | ✅ 100% | Fully functional |
-| Native iOS | ✅ 100% | 7 Swift files |
-| Native Android | ✅ 100% | 7 Kotlin files |
-| Backend Examples | ✅ 100% | Node.js + Firebase |
+| Core Plugin | ✅ 100% | TypeScript + Capacitor 8 SDK |
+| Native iOS | ✅ 100% | Swift |
+| Native Android | ✅ 100% | Kotlin |
+| Backend | ✅ 100% | Laravel 13 + Nova 5 + MySQL + Socialite + Sanctum + Spatie RBAC |
+| Example Backends | ✅ 100% | Node.js + Express (Firebase example removed in v3.0.0) |
 | CLI Tools | ✅ 100% | 8 commands |
-| Documentation | ✅ 100% | 55+ files |
-| Marketing Website | ✅ 100% | 24 pages |
-| TypeScript Tests | ✅ 100% | 9 suites implemented and passing |
-| Native Tests | ✅ 100% | iOS + Android native test suites implemented |
-| E2E Tests | ✅ 100% | Jest E2E scenarios implemented |
+| Documentation | ✅ 100% | Repo `/docs/` + public Docusaurus site (58 pages) |
+| Marketing Website + Dashboard | ✅ 100% | React 19 + Vite 7; Capacitor-wrapped for Play Store |
+| Backend Tests | ✅ 100% | 134/134 PHPUnit passing |
+| Native Tests | ✅ 100% | iOS XCTest + Android JUnit |
+| CI/CD | ✅ 100% | 3 GitHub Actions workflows |
+| Android Release Readiness | ✅ 100% | signingConfigs + ProGuard + branded assets + Data Safety + Play Store runbook |
 | Enterprise Features | ⏳ 0% | Future roadmap |
 
 ---
 
 ## 🎯 Priority for Future Development
 
-### High Priority (If Needed)
-1. Performance benchmarking suite
-2. Security vulnerability testing
-3. Delta updates WASM optimization
-
 ### Medium Priority
-1. Additional framework examples
-2. CI/CD templates
-3. Video tutorials
+
+1. Delta updates WASM optimization (working JS-level patching ships today → optional WASM bsdiff/bspatch)
+2. Additional framework examples (Vue / Angular / Svelte / Python / Java)
+3. Wikipedia / Reddit / Product Hunt presence for AI-citation reach
 
 ### Low Priority
-1. Enterprise features
-2. Multi-tenant support
-3. Advanced rollout strategies
+
+1. Enterprise tenant model (sub-team / org accounts)
+2. Enterprise SSO (SAML / OIDC beyond Google)
+3. Custom branding for white-label SaaS
+4. Audit-logging UI in the dashboard
 
 ---
 
 ## 📝 Notes
 
-- Core functionality is complete and production-ready
-- All builds pass with zero errors
-- Native and E2E test code is present; running native-device/integration pipelines still depends on local platform credentials and runtime setup
-- All lint checks pass with zero warnings
-- Firebase rules and indexes are fully configured
-- Optional features can be added based on user demand
-- The plugin is ready for npm publication
+- Core functionality is complete and production-ready; v3.1.0 is on NPM.
+- All builds pass with zero errors (`yarn build` root + website + Docusaurus).
+- All lint checks pass with zero warnings (`yarn lint` root + website).
+- Backend tests pass cleanly (`php artisan test` 134/134).
+- The plugin is ready for production use and the dashboard is Play-Store-publishable end-to-end (2026-05-16 finalization audit closed).
+- Optional features can be added based on user demand.
+- Firestore-backed code paths were intentionally removed in v3.0.0; this is permanent.
+- Firebase Hosting is still the deploy target for the marketing site + Docusaurus docs, but no Firestore / Firebase Auth / Firebase Functions are used.