Table of Contents

✅ UNIFIED ROADMAP — calco2la.to
🔥 CRITICAL PATH TO WORKING API
📌 IMMEDIATE TODOs
📊 FUTURE: ADMIN FEATURES

Mirrored from /mnt/DATA/Nextcloud/ADD ideas UG/Products/co2api/revised_roadmap.txt. Origin: product:co2api. Active tasks and changing state belong in Gitea issues; this wiki page is durable project context.

✅ UNIFIED ROADMAP — calco2la.to

✅ CORE DATA MODELS

✅ User model
- UUID primary key, password hashing
- is_confirmed, is_active_now, permission helpers
✅ Role model
- Global roles with is_global
✅ Organization model
- Recursive org trees supported
✅ OrganizationMembership model
- Users ↔ Orgs with scoped roles
✅ Permissions
- Scopes like user:create, org:update
- RolePermission & MembershipPermission
✅ APIKey model
- Secure tokens, expiration, revocation
- Tracks usage_count and last_used_at
✅ Airport model
- IATA, ICAO, city, geodata, valid_from/to
✅ BillingInfo (org-level)
✅ Factor model (stub; extendable)

✅ PERMISSIONS & ROLES

Role templates (admin, org_admin, etc.)
Wildcard permission support
Scoped inheritance based on org hierarchy
Decorators + Jinja2 helpers

✅ AUTHENTICATION & ACCESS CONTROL

Flask-Login session handling
Login, logout, registration
Email confirmation with token
Profile edit modal
☐ Resend confirmation
☐ Session expiration handling

✅ INTERNATIONALIZATION (i18n)

Flask-Babel + URL switching via /lang/


_() support in templates
☐ Admin-set default locale



✅ UI & TEMPLATES



Unified base template w/ header/footer
Login/register/profile/admin views styled
Icons for login/logout/user
☐ Improve flash/toastr messages
☐ Better JS UX (modals/forms)


✅ FLASK-ADMIN REMOVED



Replaced with scoped custom admin UI


✅ EMAIL SERVICES



Register confirmation
Token-based reset
☐ Resend unverified email
☐ Admin address update
☐ SMTP from env + admin config


✅ API KEY MANAGEMENT



secrets.token_urlsafe generation
Scoped access, limits
last_used and usage_count tracked
Create/revoke UI modals
☐ Rotate on expiration
☐ Global usage stats


✅ AIRPORT & FACTOR MANAGEMENT



Airport seed (~200)
Fuzzy matching helpers
Factor model scaffolded
☐ Pagination/search
☐ Versioned factor editing
☐ Permissions for data_modeler


✅ ORGANIZATION & MEMBERSHIP



Recursive org creation
Scoped memberships
☐ Invite by email
☐ Handle orphaned orgs


🔥 API ENDPOINTS



✅ /api/airports

Filtering, pagination, sort
API key auth & usage count
OpenAPI spec


✅ /api/flight

Via support, segment calc (mock)
Full segment unpacking + per-leg stats
OpenAPI schema


☐ /api/factors
☐ Real emission logic (for /flight)
☐ Rate limiting (APIKey)
☐ API versioning (v1, test, latest)
☐ Serve openapi.json
☐ API response caching


✅ TESTING



✅ Unit tests (models, utils)
☐ Integration: login, session
☐ API auth + input tests
☐ CLI test runner
☐ Mock email/token flow


✅ OPTIONAL ENHANCEMENTS



☐ MFA support
☐ Audit log: role/key changes
☐ Admin impersonation
☐ OIDC integration (future)
☐ Profile pictures


🔥 CRITICAL PATH TO WORKING API

✅ Roles & permission system
✅ Org + role hierarchy
✅ Finalize API key model & checks
✅ Normalize airport data
✅ Finalize factor access model
☐ Integrate real CO₂ calc logic
☐ Finalize flight endpoint (with segments)
☐ Docs: Swagger UI + openapi.json
☐ Version support + test endpoint
☐ Rate limiting by API key
☐ Deploy with monitoring


📌 IMMEDIATE TODOs

[Swagger 3.0] Fix Swagger / OpenAPI integration

Flasgger fails loading YAML specs
Validate OpenAPI 3.0.2 compatibility
Enable correct UI rendering


Finalize YAML specs for all endpoints

Fix @swag_from paths
Define common schemas + responses


Real CO₂/fuel/distance calcs (mock → realistic)
Rate limit per API key
Test endpoint to remain mock-only


📊 FUTURE: ADMIN FEATURES

Live usage dashboard (admin)
APIKeyUsage model (optional logging)
Alerts on usage limits
Client SDK generator
GraphQL/visual query interface