Roadmap

Roadmap

This page separates what is already in place from ideas that would extend the app. The "in place" list reflects the current code; the "possible next" list is candidate work, not a commitment.

In place

• Role-based access with four roles and a per-route permission decorator.
• Staff account lifecycle: invite, activate, suspend, reactivate, role change, and temporary passwords, each with an audit event.
• Password hashing, password policy, forced password change, account lockout, and IP throttling.
• Opt-in TOTP multi-factor auth with QR enrollment and a login challenge.
• Order entry with multi-line items, an initial status event, and channel tracking.
• Customer, ingredient, product, and product-batch management with search and filters.
• A dashboard with intake and shipping queues and low-stock alerts.
• CSRF protection, a content security policy, safe redirect handling, and an HTTPS redirect under live-prod.
• A Flask-Admin console gated to the Dev Admin role.
• A CLI for database setup, admin creation, demo seeding, and hashed backups.
• A pytest suite plus GitHub Actions CI on Python 3.10 and 3.12, with CodeQL, dependency review, and gitleaks scanning.

Possible next

• Stock movement on fulfillment. Decrement units_available on a lot when an order ships, and surface the running total per product.
• Shipment editing in the UI. Shipments are seeded and modeled, but a dedicated create/edit page for carrier and tracking would round out the shipping flow.
• Reporting. A reports view exists in the permission set; sales-by-channel and low-stock summaries would put it to use.
• External intake. The Google Sheets order source is recorded today; an importer that reads the sheet directly would remove a manual step.
• Expiry alerts. Lots carry an expiry_date; a dashboard card for soon-to-expire stock would help production plan ahead.
• Pagination. List pages load all rows; pagination would keep them fast as data grows.

Notes

ShyneBeauty was built for a Kent State Capstone in Spring 2026. The roadmap above is for portfolio context and does not represent a maintained release plan.