← Operations · Documentation index →
This roadmap distinguishes repository evidence from proposed work.
- pnpm/Turborepo monorepo
- NestJS backend and React/Vite frontend shell
- Shared TypeScript, RBAC, API-contract and database packages
- PostgreSQL/Prisma schema and migrations
- Seeded system roles and permissions
- Seeded administrator
- User CRUD/status/soft deletion
- JWT authentication
- Persistent sessions
- Refresh-token rotation and reuse detection
- Global guards, validation, logging, response and error handling
- Swagger/OpenAPI and Postman assets
- CI build/lint/type-check workflow
- Add meaningful integration and e2e coverage.
- Run tests and OpenAPI validation in CI.
- Add rate limiting and login abuse protections.
- Add audit logging for identity and administration events.
- Implement frontend authentication and protected routing.
- Add user pagination/filtering.
- Add explicit role-assignment administration.
- organization/tenant boundary;
- invitations and onboarding;
- password reset/change;
- multi-factor authentication;
- session/device management;
- notification infrastructure;
- observability and production deployment.
Recommended implementation order:
- organizations and settings;
- products and categories;
- warehouses and inventory;
- customers and suppliers;
- purchasing;
- sales and orders;
- invoicing and payments;
- reporting;
- accounting integration;
- human resources.
Each module should add schema, permissions, API contracts, tests and documentation as one coherent change.