# Roadmap

## Goal

A hosted dashboard where staff in each MCCS region sign in and see their own region's queue. It should be customisable per user, and easy to extend with new panels.

## Target architecture

- **Identity:** users sign in (Zoho web OAuth, or Microsoft if MCCS staff use it) only to identify themselves.
- **Data:** one service connection, signed in once by an admin, with its refresh token kept and auto-renewed. Its SDP account must be able to see every region.
- **Regions:** profiles stored in SQLite (sites, groups, technicians, statuses). Checks run once per region and the results are cached, so API traffic grows with regions, not viewers.
- **Access:** users are assigned to regions and the server enforces it. An admin role manages regions and assignments.
- **Extensibility:** each panel is a module with server code to fetch its data and page code to draw it. The weather card is the first example.

## Phases

- [ ] **1. Keep the token alive:** store the Zoho `refresh_token` (currently thrown away in `auth.js`), auto-renew the hourly access token, and save it to a file or the database so it survives restarts.
- [ ] **1b. Admin-only actions:** make `/api/connect` and `/api/check` admin-only.
- [ ] **2. Regions as configuration:** one board service per region, `/api/regions/:id/...` routes, and a region switcher on the page. The current `.env` settings become the first region, "Central".
- [ ] **3. User sign-in:** web OAuth, sessions, user-to-region mapping, admin role. Needs a "Server-based Application" client in the Zoho console and HTTPS on a real hostname.
- [ ] **4. Admin pages:** edit regions and assign users.
- [ ] **5. Deployment:** Dockerfile and docker-compose with `env_file: .env` and a volume for the database and token.
- [ ] **Later:** per-user preferences (default region, hidden columns, sound) and panel modules.

## Open questions

- Are regions a **security boundary** (staff can't see other regions) or a **convenience** (default view with a switcher)?
- Do MCCS staff sign in with Microsoft 365 or Entra ID? That decides between Zoho and Microsoft sign-in.
- Does SDP itself restrict technicians to certain sites? If it does, per-user tokens become an option.

## Done

- Dashboard: stat tiles, technician × status table, live closed feed with the ding.
- Central region scoping by site and group.
- Unassigned counter. Verified to match the ManageEngine "Central Region Unassigned" view on 2026-10-15.
- Weather card (OpenWeatherMap).
- Fixed SDP paging and the date filter (see `NOTES.md`).