Backlog and improvement history
Historical snapshot from the squad review completed on 2026-03-23. The tables below preserve the original audit context and are not the current work queue.
Current planning source
Use GitHub issues for current work and GitHub milestones for release planning. Issue status, labels, and milestones replace static counts on this page.
Historical audit snapshot
Sprint A — Quick Wins
| # | Task | Area | Effort |
|---|---|---|---|
| 12 | Finish login flow i18n (3 hardcoded strings in LoginView + 1 in useApi) | Frontend | Small |
| 25 | Use useFormatting() consistently (18 files still use inline toLocaleString) | Frontend | Small |
| 27 | Confirm raw fetch() in JoinView is intentional (add code comment) | Frontend | Tiny |
| 30 | Replace error: any with error: unknown in setup-database.ts | API | Tiny |
Sprint B — Frontend Quality
| # | Task | Area | Effort |
|---|---|---|---|
| 21 | Decompose AppLayout.vue (667 lines → SidebarNav, SettingsDropdown, MobileHeader) | Frontend | Medium |
| 26 | Handle orphaned child records on organization soft-delete | API | Small |
Sprint C — Infrastructure & Ops
| # | Task | Area | Effort |
|---|---|---|---|
| 33 | Add staging environment (bicepparam + GitHub env protection) | Infra | Small |
| 39 | Key Vault integration (when upgrading to Standard SWA tier) | Infra | Medium |
Completed on August 30, 2026: Application Insights, Log Analytics, privacy-bounded backend telemetry, baseline alerts, and a guarded daily ingestion cap (#145).
Sprint D — Performance & Polish
| # | Task | Area | Effort |
|---|---|---|---|
| 35 | Add pagination to list endpoints + pagination UI | Full-stack | Medium |
| 36 | Replace emoji with icon library (Heroicons/Lucide) | Frontend | Medium |
| 38 | Add Cosmos DB query projections (replace SELECT *) | API | Small |
| 42 | Lazy-load locale files (en.ts/no.ts ~800 lines each) | Frontend | Tiny |
Completed in the original audit
Click to expand completed items
P0 — Security & Data Integrity (9/9) ✅
- Replaced custom JWT with
jose+ throws on missing secret - Rate limiting on
/auth/verify-code(5/15min/email) - Capacity race conditions → retry loop with re-check
authTokenspartition key/token→/email- Impersonation audit mandatory
- Added 10 missing Cosmos containers to Bicep (16/16)
- Added
@secure()app settings - Added type verification step to CI pipeline
- Removed
user-scalable=nofrom viewport (WCAG 1.4.4)
P1 — Reliability & Quality (9/11) ✅
- HSTS header (#10)
- Tightened CSP — no
unsafe-inlinein script-src (#11) - Admin error strings internationalized (#13)
- Zod validation schemas (#14)
- Fixed 401 handler — router.push + logout (#15)
- Extracted shared types to models.ts (#16)
- Backend tests for orders (#17)
- Fixed silent E2E test failures (#18)
- ESLint + CI lint pipeline (#19)
- Global Vue error handler (#20)
P2 — Maintainability (5/10) ✅
- Replaced all alert()/confirm() with useToast/useConfirm (#22)
- Added ARIA attributes (#23)
- Added 404 catch-all route + NotFoundView (#24)
- Page Object Model for E2E tests (#28)
- Parallelized dashboard queries with Promise.all (#29)
P3 — Backlog (5/12) ✅
- Frontend unit tests for composables + auth store (#31)
- Dependabot + CODEOWNERS + PR template (#34)
- Lazy-loaded exceljs with dynamic import (#37)
- Fixed orphaned Norwegian i18n keys (#40)
- Added apple-touch-icon.png (#41)
Feature Ideas (unscheduled)
| Feature | Area | Notes |
|---|---|---|
| Cross-Organization Dashboard | Frontend | Super Admin aggregate stats |
| Event Duplication | Full-stack | Clone event as template |
| Batch Order Approval | Full-stack | Approve/reject multiple orders |
| Offline Mode | Frontend | Cache API data in IndexedDB |
| Email Notifications | API | Confirmation emails, reminders |
| Push Notifications | Frontend | PWA push for updates |
| CSV Import Preview | Frontend | Validate before importing |
| Invitation Links / Public Registration | Full-stack | Phase 6 from old roadmap |