Siteforge/plans/todo.md

Siteforge TODO

Open gaps found in the beta audit (2026-10-09). Items already shipped are in git history (v2.10.0 – v2.10.2).

Security

• Email 2FA codes use Math.random() — switch generateEmailOtp in server/study-helpers.js to crypto.randomInt; compare hashes with timingSafeEqual.
• TOTP replay — verifyTotpCode in server/auth.js accepts a code again within its ±1 step window. Record the last accepted time step per secret (admin + study users) and reject anything at or before it.
• unhandledRejection / uncaughtException handlers in server.js — Node 22 exits on an unhandled rejection; log and (for rejections) keep running.
• Scrub old user data from git history — data/study-users.json (old SHA-256 password hashes), study notes/progress etc. were committed before being untracked in v2.10.0. Needs a history rewrite (git filter-repo) + force-push; old hashes remain recoverable until then.
• CSP 'unsafe-inline' in script-src — needs a nonce setup for the Vite build to remove.

Frontend / performance

• Code splitting — no lazy()/Suspense anywhere; one 1.7 MB JS bundle includes the 7,000-line AdminPage. Lazy-load AdminPage and the study pages.
• React error boundary — a render error currently white-screens the page; add a top-level boundary with a fallback.
• Per-route SEO / link previews — OG tags are fixed in index.html and titles are set client-side (usePageMeta), so non-JS crawlers (iMessage, Facebook, Slack) show the generic preview for /episodes/:id and study lesson URLs. Inject per-route title/description/OG tags server-side.
• Accessibility audit — run axe (contrast, focus order, modal dialogs, image alt text).

Maintenance

• Split the large files — AdminPage.tsx (~7,000 lines), studyPages.tsx (~4,200), App.tsx (~3,600).
• Clear the 11 react-hooks/set-state-in-effect lint warnings (rule downgraded to warn in v2.10.0), then restore it to error.
• Remaining npm audit findings — d3-color (high, via react-simple-maps) and sprintf-js (moderate, via mammoth; fix is a breaking downgrade).
• CI installs with --legacy-peer-deps — resolve the tiptap peer-dependency conflict so plain npm ci works.
• Resend webhook ?token= query form — in logs/URLs; kept because Resend can't send custom headers. Revisit if Resend adds header support or switch to svix signature verification.