Roadmap and Future Plans

Roadmap & Strategic Future Plans

---

1. Roadmap Overview & Milestones

The evolution of StudentAppBackend follows a structured, phased engineering roadmap. Below is the active progress across completed milestones, current workstreams, and scheduled future initiatives.

---

2. Milestone Progress Tracker

gantt
    title Engineering Milestones Progression
    dateFormat  YYYY-MM-DD
    section Completed
    Phase 0 - Server Foundation & Setup            :done, p0, 2026-06-01, 2026-07-15
    Phase 1 - Security Hardening & Authentication  :done, p1, 2026-07-16, 2026-08-15
    Phase 2 - Staging Migration & Validation       :done, p2, 2026-08-16, 2026-09-01
    Phase 3 - Production Cutover Rehearsal         :done, p3, 2026-09-02, 2026-09-10
    Phase 4 - Cutover / Switch (v2.0.0)            :done, p4, 2026-09-11, 2026-09-13
    section In Progress
    Phase 5 - Post-Cutover Verification & Cleanup  :active, p5, 2026-09-14, 2026-09-20
    section Future Workstreams
    Phase 6 - Multi-Tenant School Domain           :p6, 2026-09-21, 2026-10-15
    Phase 7 - Classroom & Teacher Modules          :p7, 2026-10-16, 2026-11-15
    Phase 8 - APNs Push Notifications & Redis      :p8, 2026-11-16, 2026-12-15

Loading

✅ Phase 0: Server Foundation & Toolchain (Completed)

• Set up Swift 6 concurrency foundation and Vapor 4 framework core.
• Configured initial REST routing collections and Leaf/Graphiti integration.
• Established local Docker development environments and Makefile workflows.

✅ Phase 1: Security Hardening & Authentication (Completed)

• Enforced minimum TLS 1.2 with PFS/AEAD cipher suites.
• Added HSTS middleware with subdomain opt-in and preload eligibility.
• Automated local development certificate renewal (CertificateManager).
• Implemented JWT token revocation blacklist in database.
• Implemented 2-phase OTP password recovery via SendGrid.

✅ Phase 2, 3 & 4: PostgreSQL 16 Cutover (Completed - Released in v2.0.0)

• Replaced MySQL driver with FluentPostgresDriver as the default database.
• Built automated data hygiene (01-canonicalize.sql) and pgloader ETL tooling.
• Created pre-migration baseline tag v1.0.0-mysql.
• Merged trial cutover branch into main via PR #51.
• Promoted major release tag v2.0.0.

🔄 Phase 5: Post-Cutover Verification & Cleanup (Active Workstream)

• Issue #47: Maintain read-only MySQL fallback for validation window (24–72 hours).
• Issue #48: Post-migration cleanup of temporary migration artifacts and documentation sync.
• Issue #49: Deprecate and remove FluentMySQLDriver from Package.swift once stability window concludes.
• Issue #50: Final retrospective and migration runbook archiving.

---

3. Strategic Feature Workstreams (Future Plans)

1. Multi-Tenant School Domain Isolation

• Entity Modeling: Introduce School model with primary schoolId foreign key relationships across students, teachers, and classrooms.
• Role Scoping: Upgrade principal and teacher roles to enforce school-bounded query scopes in AuthorizationService.
• Domain Routing: Support custom vanity subdomains (e.g. lincoln.openedschool.com) mapped via Caddy reverse-proxy headers.

2. Classroom & Curriculum Management Modules

• Classroom Entities: Models for Classroom, Subject, Enrollment, and Schedule.
• Teacher Assignment: Teachers assigned to specific classroom rosters with role-scoped grading permissions.
• REST & GraphQL Schema Additions:
  • POST /classrooms: Create classroom (admin/principal).
  • POST /classrooms/:id/enroll: Enroll students in class.
  • GraphQL queries: classroom(id), myClassrooms.

3. Real-Time Push Notifications (Apple APNs)

• Direct integration with Apple Push Notification service (APNs) using vapor/apns or async HTTP client.
• Deliver real-time notifications to the companion iOS application (StudyApp) for:
  • Account security alerts (login from new device).
  • Password reset confirmations.
  • Assignment deadlines and school announcements.

4. Distributed Caching & Rate Limiting (Redis)

• Migrate the current in-memory rate limiter to Redis (vapor/redis) for horizontally scaled deployments.
• Cache revoked JWT tokens in Redis with automatic TTL expiry, reducing database load on high-traffic authentication checkpoints.

5. Metrics & Observability

• OpenTelemetry instrumentation for distributed tracing across Vapor requests.
• Prometheus /metrics endpoint exposing HTTP request latencies, active database connection pool counts, and error rates.