# Roadmap

## Vision

Identity Platform is the **central identity infrastructure** for the holding. Every product (Bermooda, Hamsoo, future) connects to it — no product owns identity, the platform does.

---

## Current (v1.0 - MVP)

### Completed
- [x] Custom User model (UUID, email/phone, no username)
- [x] JWT authentication (RS256, access + refresh + ID token)
- [x] Login, refresh, logout endpoints
- [x] Organization CRUD + slug auto-generation
- [x] Membership model (roles: owner/admin/member, statuses)
- [x] OAuth Application registry (client_id/secret, redirect URIs, scopes)
- [x] Session tracking (device, IP, UA, type, revocation)
- [x] SecurityEvent audit log (login, logout, refresh, revoke, MFA, brute-force)
- [x] Rate limiting (per-user, per-IP, endpoint-specific)
- [x] OIDC Discovery (`.well-known/openid-configuration`, JWKS)
- [x] drf-spectacular OpenAPI schema + Swagger UI
- [x] Django admin for all models
- [x] 21 backend tests passing
- [x] Next.js 14 landing page (10 sections, RTL, bilingual fa/en)
- [x] Docker Compose (postgres, redis, api, web)
- [x] Brand-configurable via env vars
- [x] Dark enterprise theme (Adobe-inspired)

---

## v1.1 — Hardening & DX (Q1 2025)

### Backend
- [ ] **Token blacklist** — Redis-backed for instant revocation checking
- [ ] **Key rotation** — Automated RS256 key rotation with overlap window
- [ ] **Device trust** — Remember device, skip MFA on trusted
- [ ] **Account lockout** — Configurable threshold, admin unlock, email notify
- [ ] **Password breach check** — Integrate HaveIBeenPwned on set/change
- [ ] **Email verification flow** — Send code, verify, mark `email_verified`
- [ ] **Phone verification flow** — SMS OTP (provider-agnostic)
- [ ] **Admin API tokens** — Long-lived service tokens with scopes

### Frontend
- [ ] **Admin dashboard** — React admin panel (users, orgs, apps, sessions, events)
- [ ] **Login page** — Branded, MFA-ready, remembers device
- [ ] **Password reset flow** — Request → email → set new
- [ ] **Email/phone verification UI**
- [ ] **Session management UI** — List, revoke, current indicator
- [ ] **Developer portal** — App registration, credentials, logs

### DevOps
- [ ] **CI/CD** — GitHub Actions (test, lint, typecheck, build, deploy)
- [ ] **Staging environment** — Auto-deploy on merge to `main`
- [ ] **Structured logging** — JSON logs, correlation IDs
- [ ] **Metrics** — Prometheus `/metrics` endpoint
- [ ] **Health checks** — `/health/` with DB/Redis connectivity

---

## v1.2 — MFA & Compliance (Q2 2025)

### MFA
- [ ] **TOTP** — Google Authenticator, Authy, 1Password
- [ ] **Backup codes** — 10 single-use codes on enrollment
- [ ] **WebAuthn / Passkeys** — Platform authenticator + cross-device
- [ ] **MFA policies** — Per-org: required/optional, allowed methods
- [ ] **Step-up auth** — Re-auth for sensitive actions (delete org, rotate secret)

### Compliance
- [ ] **GDPR export** — User data download (JSON)
- [ ] **GDPR deletion** — Anonymize on request (retain audit log)
- [ ] **SOC 2 readiness** — Access reviews, evidence collection
- [ ] **Data processing addendum** — Template for customers

---

## v1.3 — Federation & Enterprise (Q3 2025)

### External Identity Providers
- [ ] **SAML 2.0** — SP-initiated, IdP-initiated, metadata exchange
- [ ] **OIDC Federation** — Connect to Google, Microsoft, Okta, Auth0
- [ ] **SCIM 2.0** — Provision/deprovision users from HR systems
- [ ] **Just-in-Time (JIT) Provisioning** — Auto-create on first SSO login

### Enterprise Features
- [ ] **Custom domains** — `auth.customer.com` → platform
- [ ] **White-labeling** — Logo, colors, favicon, email templates per org
- [ ] **Audit log streaming** — Webhook / Kafka / Splunk / Datadog
- [ ] **IP allowlists** — Per-application or per-org
- [ ] **Session policies** — Idle timeout, max duration, concurrent limit

---

## v2.0 — Platform Maturity (Q4 2025)

### Architecture
- [ ] **Multi-region deployment** — Active-active with session sync
- [ ] **Event sourcing** — Identity events as source of truth
- [ ] **GraphQL API** — Flexible queries for complex UIs
- [ ] **Webhooks v2** — Retry, signing, dead-letter, replay

### Developer Experience
- [ ] **SDKs** — Python, TypeScript, Go, Rust
- [ ] **Terraform provider** — Manage orgs, apps, users as code
- [ ] **CLI** — `idp` command for admin tasks
- [ ] **Local dev container** — One-command full stack

### Product Integrations
- [ ] **Bermooda** — Full SSO, org sync, role mapping
- [ ] **Hamsoo** — Full SSO, profile linkage
- [ ] **Template for new products** — Cookiecutter + docs

---

## Backlog / Ideas

| Area | Idea |
|------|------|
| **Security** | Risk-based auth (impossible travel, new device) |
| **Security** | Passwordless login (magic link, passkey-only) |
| **Security** | Hardware key enforcement (YubiKey) |
| **Org** | Nested organizations (parent/child) |
| **Org** | Custom roles & permissions (RBAC builder) |
| **API** | API keys (non-OAuth, for server-to-server) |
| **API** | GraphQL subscriptions (real-time events) |
| **DX** | Storybook for UI components |
| **DX** | Visual regression tests (Chromatic) |
| **Ops** | Chaos engineering (Litmus) |
| **Ops** | Disaster recovery drill (quarterly) |
| **Compliance** | HIPAA BAA template |
| **Compliance** | ISO 27001 controls mapping |

---

## Release Cadence

| Cycle | Duration | Contents |
|-------|----------|----------|
| **Patch** | 2 weeks | Bug fixes, security patches |
| **Minor** | 8 weeks | New features, non-breaking |
| **Major** | 6 months | Breaking changes, architecture shifts |

**Versioning:** SemVer. API version in URL (`/api/v1/`).

---

## Decision Log

| Date | Decision | Rationale |
|------|----------|-----------|
| 2024-01 | RS256 over HS256 | Products verify without private key |
| 2024-01 | UUID PK for User | Immutable, unguessable, distributed-friendly |
| 2024-01 | Modular monolith | Single deploy, clear boundaries, later extract |
| 2024-01 | SQLite for local dev | Zero-config, fast, mirrors Postgres behavior |
| 2024-01 | RTL-first, Persian default | Target market primary language |
| 2024-01 | Env-driven branding | No hardcoded "Identity Platform" |
| 2024-01 | No "military-grade" claims | Honest security marketing |

---

## Contributing

1. Fork → feature branch → PR.