dashcaddy/BACKLOG.md

DashCaddy Improvement Backlog

Shared coordination file for Hermes & Krystie. Both bots read this, claim tasks, and update status. Git is the source of truth. When claiming: change status: todo to status: in-progress and set owner. When done: change to status: done and add brief result.

---

P0 — Must Fix (blocks public release)

DC-001: Fix 4 failing tests in services.routes.test.js

• status: done
• owner: hermes
• details: Credential storage tests failing since before v1.13.4. Run cd dashcaddy-api && npx jest __tests__/routes/services.routes.test.js to see failures. Fix the root cause, not the test.
• result: Root cause: routes used /:serviceId/credentials (missing /services/ segment). All 3 credential routes (POST/DELETE/GET) in routes/services.js had the wrong path. Fixed to /services/:serviceId/credentials — matches the URL pattern used by the live frontend and all 759 tests pass.

DC-002: Sync VERSION file

• status: done
• owner: hermes
• details: /root/dashcaddy/VERSION says 1.13.0 but package.json says 1.13.4. VERSION file should always match package.json. Add a pre-commit or post-version bump hook to keep them in sync.
• result: Fixed root VERSION to 1.13.4. Updated scripts/release.sh to write both dashcaddy-api/package.json AND root VERSION on every release — also stages VERSION in the release commit. No more drift.

DC-003: Remove stale test/debug files from repo root

• status: done
• owner: hermes
• details: comprehensive-test.js and test-security-fixes.js are ad-hoc test scripts, not Jest tests. They clutter the repo root. Remove them or convert to proper Jest tests under __tests__/.
• result: Moved both files to dashcaddy-api/scripts/legacy/ (preserved, not deleted — they are 875 lines of security test coverage that may be useful as a manual smoke test). Zero references to them in code/docs — safe to move. All 759 Jest tests still pass.

---

P1 — Code Quality

DC-004: Fix 19 ESLint warnings

• status: in-progress
• owner: hermes
• details: Run cd dashcaddy-api && npx eslint src/ --format compact. Most are unused vars and nested ternaries in src/utils/logging.js. Fix all, target zero warnings.

DC-005: Organize top-level modules into src/

• status: in-progress
• owner: krystie
• details: 40+ JS files at dashcaddy-api/ root level (auth-manager.js, credential-manager.js, etc.). Move into organized subdirs under src/ (e.g., src/managers/, src/security/, src/docker/). Update all require() paths. This is a big refactor — run tests after.
• latent bug (discovered during DC-006, NOT yet fixed): The DC-005 refactor's path-rewrite script left depth-2 route files (routes/auth/*.js, routes/recipes/*.js, routes/apps/*.js, routes/arr/*.js, routes/config/*.js) with '../../../src/...' — 3 levels up instead of 2, which goes above dashcaddy-api/ entirely. Required path should be '../../src/...' for depth-2 routes. Tests didn't catch this because no test previously imported any depth-2 route (only depth-1 routes like routes/services.js were tested). Confirmed-broken imports (with file → offending line): routes/auth/totp.js:2 (FIXED in DC-006 commit), routes/auth/keys.js:2, routes/auth/sso-gate.js:2-3, routes/auth/session-handlers.js:2-3, routes/recipes/manage.js:2-3, routes/recipes/deploy.js:2-3, routes/recipes/index.js:2-3, routes/config/assets.js:2-4, routes/config/settings.js:2-4, routes/config/backup.js:2-4, routes/apps/restore.js:2, routes/apps/compose.js:2-3, routes/apps/deploy.js:2-5, routes/apps/helpers.js:2-3, routes/apps/templates.js:2-3, routes/apps/removal.js:2-3, routes/arr/detect.js:2, routes/arr/smart-connect.js:2, routes/arr/credentials.js:2-3, routes/arr/helpers.js:2, routes/arr/config.js:2-5, routes/arr/plex.js:2. The fix is mechanical (3 → 2 levels) but touches ~22 files — should be its own PR/commit for clean review.
• branch state: Work is complete on krystie-improvements (HEAD 7bc2a20) with 879/879 tests passing on the branch. NOT YET ON MAIN — origin/main has since moved past the refactor with ~28 newer commits (DC-008/009/010/011, TOTP 4-part recovery, monitoring widget, unified logger, response-shape standardization). git diff origin/main..HEAD is 187 files / 10823 insertions / 3187 deletions — large enough to need careful coordination, not silent fast-forward. See Discord/Sami for proposed merge plan.

DC-006: Add integration test for TOTP auth flow

• status: done
• owner: krystie
• details: End-to-end test: no token → 401, wrong token → 403, valid TOTP → session token → authenticated request succeeds. Cover the full /api/auth/check → session → endpoint flow.
• result: Added dashcaddy-api/__tests__/routes/auth.totp.routes.test.js — 25 tests, all passing. Covers: GET /api/totp/config, POST /api/totp/setup (generate + normalize + reject invalid Base32), POST /api/totp/verify-setup (missing/bad/no-pending/valid-code paths), POST /api/totp/verify (login — 400/400/401/200), GET /api/totp/check-session (passthrough when disabled + 401 no-session + 200 valid-session — the BACKLOG "no token → 401 / authenticated request succeeds" pair), POST /api/totp/disable (400/401/200), POST /api/totp/config (valid/invalid/never-disables), plus the full end-to-end flow setup→login→check-session→disable and an otplib-not-stubbed sanity check. Uses real otplib for code generation (real TOTP math), mocks credentialManager/session/totpConfig/saveTotpConfig only. Full suite: 904/904 pass (879 baseline + 25 new). ESLint clean for the new file.
• side-effect (DC-005 latent bug fix): While writing the test I discovered routes/auth/totp.js had broken require paths from the DC-005 refactor ('../../../src/utilities/errors' was 3 levels up from routes/auth/ — wrong by 1). The test couldn't even load the route without this fix. Fixed in this commit ('../../src/utilities/errors' and '../../src/utils/responses'). Same depth bug exists in other depth-2 route files — see DC-005 note below.

DC-007: Add tests for untested modules

• status: done
• owner: krystie
• result: 7 test files added (120 new tests, all passing alongside the 759 baseline → 879 total). Files: __tests__/dns-propagation.test.js (9), __tests__/notification-manager.test.js (18), __tests__/ssl-monitor.test.js (13), __tests__/log-digest.test.js (11), __tests__/metrics.test.js (21), __tests__/config-drift-detector.test.js (19), __tests__/auto-restart-manager.test.js (29).
• details: These modules have NO test coverage: dns-propagation.js, notification-manager.js, ssl-monitor.js, log-digest.js, metrics.js, config-drift-detector.js, auto-restart-manager.js. Add at least basic smoke tests for each.

---

P2 — Polish & DX

DC-008: Update CLAUDE.md for cross-platform accuracy

• status: todo
• owner:
• details: CLAUDE.md references Windows-specific paths (C:/caddy/, e:/CaddyCerts/) as if they're universal. DashCaddy runs on Linux (Docker on DNS2) and Windows (SAMI-PC). Document both deployment targets clearly.

DC-009: Add CHANGELOG entry for any unreleased work

• status: todo
• owner:
• details: [Unreleased] section in CHANGELOG.md is empty. Any fixes done should be documented there before tagging a release.

DC-010: Standardize error response shapes

• status: todo
• owner:
• details: v1.13.4 standardized route responses to use helpers, but some modules still use raw res.json(). Grep for remaining res.json( in route handlers and convert to response helpers.

---

Coordination Rules

1. Always git pull before starting work.
2. Claim a task by editing BACKLOG.md: set status: in-progress and owner: hermes or owner: krystie.
3. Commit BACKLOG.md claim first, then start coding.
4. Run tests before pushing: cd dashcaddy-api && npx jest --passWithNoTests
5. Push to main — use http://sami7777:<token>@100.98.123.59:3000/sami7777/dashcaddy.git
6. Update BACKLOG.md when done: set status: done, add brief result under the task.
7. Never work on a task another bot has claimed (status: in-progress).
8. Quality bar: this is a public-release product. No hacks, no env-var workarounds, no per-machine patches. Fixes go in the shared codebase.
9. VERSION bump: when a batch of tasks is done, bump patch version in package.json + VERSION file, update CHANGELOG, tag.