revised todos

Author: tionis

TODO.md

@@ -1,20 +1,13 @@
 # ToDo Next
-- [ ] Migrate token handling to an encrypted-at-rest model (Option 2) to ensure tokens in the config cannot be used if leaked, while maintaining O(1) lookup performance on the hot path.
-  - [ ] Implement a simple, well-documented API endpoint to "mint" (encrypt) tokens using the server's secret.
-  - [ ] Update config loading logic to decrypt tokens in `config.yaml` upon fetch/refresh.
-  - [ ] Ensure request authentication remains a fast memory lookup against the decrypted tokens.
+- Migrate away from the forgejo/http request based token/auth management to a locally managed one. For this I want to rely on SSO via OIDC (with SCIM and backchannel logout) with a local sqlite database.
+- The database should have point in time recovery, either via a native litestream integration or as a sidecard process in the container
 
-
-# Ideas for the future
-> Some of the feature below might be better handled by a workflow engine or serverless functions platform
-- [ ] migrate away from quasi stateless forgejo backend to a stateful sqlite one, that auto restored litestream backup on startup and stream litestream backups to target location during operation
-- [ ] use new backend to implement url shortening service under $patchwork_domain/s/...
-- [ ] add oidc integration for auth to manage data, tokens etc
+# Ideas for the future (once a database is in place)
+- [ ] use new backend to implement url shortening service under $patchwork\_domain/s/...
 - [ ] embed a mqtt server using sqlite db for persistence
   - [ ] add token management platform (using some permission system based on namespaces)
   - [ ] add data from mqtt broker to prometheus data
 - [ ] replace ntfy endpoint abstraction with https://containrrr.dev/shoutrrr/v0.8/ to allow users to easily add many different notification services
-- [ ] look into adding data storage for small scripts
+- [ ] look into adding data storage for small scripts (per-user or per-script databases?)
 - [ ] add web endpoints for mqtt broker (subscribe to mqtt patterns using SSE, send messages using a simple POST)
-- [ ] look into optional integration into a mosquitto-logger service (idea would be to integrate it, but make it optional and allow users to start the logger without the rest of the server)
-- [ ] think about integrating simple file sharing using s3 backend with pre-signed urls etc (or direct rclone integration instead)
+- [ ] think about integrating simple file sharing using s3 backend with pre-signed urls etc (or direct rclone integration instead)