Initial tasks to do.

[RyannKim327]

BetterLucenaCity — Tasks & Milestones

Civic portal: Lucena City, Quezon — Next.js 16 / React 19 / TS / Tailwind 4 / Supabase
Last audited: 2026-09-01 | Branch: feat/administrative (base: main)

Milestones — Accomplished ✓

M0 — Project Scaffolding (2026-08-23)

• Initial commit from Create Next App — Next.js + TS + Tailwind 4 setup
• src directory adoption, BetterLucena → BetterLucenaCity rename
• Docs: README.md, CLAUDE.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, LICENSE.md

M1 — Design System & Layout (2026-08-23 → 08-24)

• Minimalist Material Design 3 (teal/amber) — globals.css tokens, Card/Button/PageHeader
• Layout: sticky Header (backdrop-blur, mobile toggle, ThemeToggle), Footer, Hotlines bar (red banner)
• Theme: theme-provider.tsx (light|dark|system + localStorage + matchMedia) + theme-toggle.tsx (menu, outside click)
• Hotlines feature + marquee experiment (later removed)

M2 — Home Sections (2026-08-24 → 08-25)

• HeroSection (headline + Button CTAs + MapClient)
• AboutSection — 8 cards from LUCENA const (population, barangays, etc.) (lib/sources/shared.ts)
• ServicesSection — lib/data/services.ts (6 services, featured filter) + types/services.ts
• Legal / ordinances static data lib/data/legal-documents.ts (RA 3271, RA 7160, etc.)

M3 — Live Civic Data & Map (2026-08-24 → 08-26)

• LiveDataSection (client, PanelState union) — 3 panels: Weather (Open-Meteo), Earthquakes (Phivolcs via earthquakeapi), DPWH projects
• Proxied API routes: /api/weather, /api/earthquakes, /api/dpwh/projects (+ lib/sources/* + lib/cache.ts in-memory cache 250 entries, stale-while-revalidate)
• LucenaMap — Leaflet + react-leaflet, MapContainer [13.9333,121.6167], GeoJSON boundary via /api/geography/boundary (Nominatim R11124741) + map-client.tsx dynamic(ssr:false)
• Population / land area / income classification glance

M4 — Transparency & Budget (2026-08-25)

• National Budget (GAA) feature — lib/sources/budget.ts (getNationalBudget, LATEST_YEAR) + /api/budget/national + NationalBudgetSection (bar charts, formatPeso)
• Transparency page (revalidate 3600)
• Civic data moved to homepage

M5 — Contributors & Auth (2026-08-26 → 08-28)

• Contributors listing (first 8, next/image fill) — section + /contributors page
• Supabase: user_type enum + users table + RLS (SELECT public, UPDATE own) + handle_new_user() trigger (username dedup)
• OAuth: AuthButtons (Google/GitHub signInWithOAuth → /auth/callback?next=) + supabase/client.ts + server.ts (createServerClient + cookies())
• Contributors from DB — GET /api/contribute/members (username, avatar_url, user_type)

M6 — Supabase & Migrations Hardening (2026-08-29 → 08-30)

• Migrations 20260827→20260830: users, ordinances→legals, ordinance_type enum, announcement→announcements, RLS public read, seeds (6 announcements: traffic 2915, ROAD TF, Undas + 6 legals: RA3271/RA7160/Ord2915/etc.)
• Contribute form + POST /api/contribute validation (category/title/details/consent, URL regex) — auth-gated layout (contribute)
• Admin scaffolding (admin)/admin (currently isAdmin=true placeholder)
• Middleware → proxy.ts migration (Supabase SSR session refresh)

M7 — Session Refactors (2026-08-30 — uncommitted, this workspace)

• Vercel fix: Client-side API fetch — announcements, legal, contributors were Server Component + axios + internalApiUrl() self-calls (fail on Vercel). Migrated to src/components/data/* client components (announcements-list.tsx + legal-list.tsx + contributors-grid.tsx) fetching /api/* in useEffect + Loading/Failed states. Pages stay Server Components for metadata.
• Types by domain — deleted types/sources.ts + types/components.ts (dead lib/data/announcements.ts + contributors.ts removed). Created 10 files: announcements.ts, legal.ts, contributors.ts, services.ts, hotlines.ts, live-data.ts, map.ts (incl. NominatimLookupResponse), budget.ts, ui.ts (PageHeader/Button/Card/AuthButtons), contribute.ts (Category/Payload). Updated all imports (lib/sources, lib/data, api, components).
• API error hardening — announcements route now returns {error} 500, legals + contribute/members already had 500 shapes consistent with client "error" in data.

---

Backlog — Tasks To Do

P0 — Must-fix (Before next deploy)

• AuthZ: Fix admin bypass [security] src/app/(admin)/layout.tsx: isAdmin=true → check supabase.auth.getUser() + users.user_type (Head Maintainer/Maintainer). Gate /admin in middleware.ts/proxy.ts.
• Auth: Open redirect [security] src/app/auth/callback/route.ts ?next= unvalidated → whitelist [/, /contribute, /admin], reject //evil.com.
• Bug: formatDate(null) [data] src/components/data/legal-list.tsx formatDate(doc.date as string) — 3 legals have null date → guard formatDate(string|null) → —.
• API: Contribute POST doesn't persist [api] src/app/api/contribute/route.ts returns 201 {ok:true} with no supabase.from("contributions").insert(). Add contributions migration + insert.
• A11y: Duplicate heading ID [a11y] about.tsx + contributors.tsx both id="about-heading" → rename second to contributors-heading.

P1 — Should-fix

Security & Headers

• Security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS in next.config.ts/proxy.ts.
• Rate limit POST /api/contribute + honeypot/CAPTCHA; validate env vars without ! in proxy.ts.

Data & API Consistency

• Unify ApiError ({error:string} vs {error, allowed[]} vs {error, documents[]}) + zod validation for legals/dpwh/earthquakes/contribute.
• Normalize legals vs legal: /api/legals (DB) vs /api/legal/documents (static dead for UI) vs /api/legal/types — deprecate or doc.
• Deduplicate legalDisclaimer (lib/data/legal-documents.ts vs api/legals/route.ts).
• Fix src/lib/sources/earthquakes.ts radius validated but never filters; budget.ts LATEST_YEAR stale per-request.

Caching & Performance

• Replace src/lib/cache.ts in-memory Map (per-invocation on serverless) with unstable_cache/Redis/Next fetch revalidate.
• Missing Cache-Control on announcements, legals, contribute/members, legal/*; add to all 11 routes.
• Add src/app/loading.tsx / error.tsx / not-found.tsx (currently full-page block on fetch).
• Consolidate axios (9 uses) + fetch (1) + fetchJson (4) → single client.

UI/UX & A11y

• hotlines.tsx returns undefined for non-head, dead // <marquee>, not responsive.
• legal-list role="navigation" div → <nav>/role="group"; contributors-grid key={${i}. ${username}`` → username; earthquakes `key={i}` → stable.
• lucena-map.tsx z-1 invalid → z-[1], add aria-label; about/contributors cards style.
• Wire ContributeForm — (contribute)/contribute/page.tsx is <p>Test</p> orphaned.
• Add AbortController cancel to components/data/* useEffect; add Skip to content.

SEO

• src/app/sitemap.ts, robots.ts, manifest.ts; layout.tsx metadataBase/openGraph/twitter/canonical; per-page description.
• JSON-LD: GovernmentOrganization, Dataset (budget), NewsArticle (announcements).

Code Health

• Remove unused Process interface / populate services[].process; DRY Card vs raw div rounded-card in live-data-section/national-budget-section.
• Delete lib/sources/shared.ts:internalApiUrl (0 imports since client migration); purge dead assets (file.svg etc.) + admin placeholder ((admin)/admin/page.tsx).
• Unify exports: export function vs export default (Header/Footer named, Hero/About default).

P2 — Nice-to-have / Future

• Tests: vitest + playwright — formatPeso/formatDate/isLegalDocType/cache/contribute/middleware/auth/callback; gh-test is eslint && build only now.
• Pagination announcements/legals/members server ?limit&page vs client slice.
• Contributions moderation queue UI (admin approve → publish to announcements/legals).
• Map preload + skeleton (fix CLS), Footer tel: fix (tel:+042... malformed), Button a11y, lang="fil" for Filipino eyebrows.
• i18n / leaflet preload tree-shaking.

Quick Wins (≤2h each)

• formatDate(null) — 5m
• Duplicate heading ID — 2m
• Purge dead assets + internalApiUrl — 10m
• sitemap.ts/robots.ts — 20m
• Security headers — 20m
• hotlines.tsx fix — 15m