# Backend implementation tasks

Status date: 2026-07-24

## Phase 1 - isolated backend baseline

- [x] Create `E:\workspace\server\saas-voc-server` as an independent Git repository.
- [x] Keep `moshengqi-server` and `future-server` read-only.
- [x] Add strict environment validation without credential fallbacks.
- [x] Add pooled PostgreSQL access and an idempotent migration runner.
- [x] Add an independent Parse Server application configuration.
- [x] Add the initial domestic VOC schema, constraints, foreign keys, and indexes.
- [x] Seed the `demashi` workspace and JD source metadata.
- [x] Add health, sync, job-status, and snapshot endpoints.
- [x] Add a database-free local-demo server for frontend integration using the normalized Demashi snapshot.
- [x] Add Fmode timeout/retry/authentication behavior behind a server-only client.
- [x] Add unit tests and compile under strict TypeScript settings.
- [x] Add a shared platform repository contract with local-memory and PostgreSQL implementations.
- [x] Add Parse-session authentication, workspace membership, and four-role RBAC.
- [x] Add cursor-paginated product, relation, review, job, import, and platform workflow APIs.
- [x] Add analysis requests, action workflows, alerts, and audit history without fake AI results.
- [x] Cover local platform flows, viewer write denial, Parse session behavior, pagination, and audit writes.
- [x] Make the database-free runtime reusable through a configurable local workspace id.
- [x] Reject partial platform migrations through the health check.
- [x] Add manual sync retry/cancel, local job events, and stale-worker job recovery.
- [x] Protect owner membership and validate action assignees inside the workspace boundary.
- [ ] Run migrations against a newly provisioned PostgreSQL database.
- [x] Smoke-test the local HTTP service under the supported Node 22 runtime.
- [x] Add a Parse REST storage driver that preserves the existing frontend/backend API contract.
- [x] Add isolated master-key-only `Voc*` schemas and remote schema reconciliation.

## Phase 2 - case-data persistence

- [x] Add a batch importer for the normalized Demashi dataset.
- [x] Import 2,817 operating products and 9,717 daily metric rows through bounded Parse REST batches.
- [x] Import 40 competitor relations with deterministic relation keys.
- [x] Add a streaming importer that persists the original Demashi workbook directly through Parse REST.
- [x] Create 37 mapped competitor products and backfill all 37 real product details through the company relay.
- [x] Verify Parse counts and snapshot totals against `demashi-summary.json`.
- [x] Switch `DomesticDatasetService` between static case mode and backend API mode.
- [x] Run desktop/mobile browser smoke tests against Parse REST API mode.

## Phase 3 - real JD source contract

- [x] Verify the existing Fmode gateway health endpoint over public TLS (HTTP 200 on 2026-07-23).
- [x] Complete quota-controlled live JD product and review requests through the existing Fmode gateway using a process-only credential.
- [x] Confirm the catalog JD product-detail path and required `itemId` parameter.
- [x] Confirm the catalog JD review path and optional `page` parameter.
- [x] Confirm the live double-`data` response envelope and first-page review pagination metadata.
- [x] Confirm the live non-empty JD review contract and capture a sanitized fixture for `commentScore`, `commentDate`, and nested `data` arrays.
- [x] Save sanitized product and review contract fixtures without credentials or personal data.
- [x] Implement JD product and review adapters against company-gateway contract fixtures.
- [x] Process queued jobs with partial-failure events and bounded retries.
- [x] Implement idempotent product/review UPSERT and truthful job progress updates.
- [x] Fetch and persist one bounded review page for all 37 mapped competitors (355 sanitized reviews).
- [ ] Verify source UPSERT and snapshot totals against the provisioned PostgreSQL database.

## Phase 4 - deployable closure

- [ ] Provision a dedicated PostgreSQL database and least-privilege runtime role.
- [ ] Provision independent Parse application credentials.
- [ ] Put TLS and same-origin reverse proxying in front of `/parse` and `/api/domestic-voc`.
- [x] Add backend authentication, workspace authorization, and role permission boundaries.
- [ ] Enable and integrate the frontend `AuthGuard` after Parse credentials and the first user are provisioned.
- [x] Add failed-job replay/cancel APIs and automatic stale-job recovery.
- [ ] Add database backup, restore, and retention procedures after infrastructure is provisioned.
- [ ] Resolve or formally accept remaining moderate Parse transitive advisories.
- [x] Complete local end-to-end acceptance with Demashi relations, competitor product detail, and real review evidence.

## Explicitly deferred

- Multi-platform adapters beyond JD.
- Multi-tenant billing, SSO provisioning, and custom roles beyond the four built-in roles.
- Scheduled full-catalog crawling.
- AI reports, sentiment, pain points, or recommendations without review evidence.
- Any reuse of the cross-border production database or credentials.

## 竞品变化驱动 Listing 闭环（2026-08-31）

- [x] 切片 1：按 productId 提供历史快照、字段级 diff 与采集运行/失败记录 API。
- [x] 切片 1：前端新增响应式竞品 Listing 历史详情页与字段筛选。
- [x] 切片 2：竞品变化预警规则（含多竞品同向变化）。
- [x] 切片 3：变化影响分析与可回溯 impactScore。
- [x] 切片 4：竞品驱动 Listing 优化任务（幂等、workspace 隔离、状态机）。
- [x] 切片 5：预警/影响/任务前端工作台与证据抽屉。
- [x] 切片 6：优化前后评分验证闭环（不宣称业务收益）。
- [x] 域函数：评分前后 delta 与 effective 分类，并接入任务 API/工作台。

## Cloud Function migration (2026-09-03)

> **当前状态：暂缓线上托管验收，回归本地前端 + 本地后端代理真实 Parse REST 数据开发。** 不使用静态案例数据；保留云函数实现与部署配置，暂不继续处理线上用户 provisioning 和托管执行验收。

- [x] Implement the allow-listed action registry and unified response/requestId boundary.
- [x] Implement the local action adapter over the existing authenticated domain routes.
- [x] Implement and deploy the managed Parse `Function` record `/saas-voc-gateway`.
- [x] Add managed authentication, workspace membership, RBAC, product scope, cursor reads, audit, idempotent writes, and truthful failure responses.
- [x] Verify Parse Schema/data counts and unauthenticated hosted execution rejection.
- [x] Add a Parse REST managed-task worker that resumes persisted competitor refresh and Listing score jobs, with graceful shutdown.
- [ ] Verify authenticated hosted action execution and all browser pages with a dedicated test Session.
- [ ] Bind the deployed Function to the platform execution registry and verify authenticated hosted action execution.
- [ ] Complete live third-party provider contracts and hosted/background worker execution in the managed environment.