# Todo

## Never deployed

`lifecycle: alpha` puts this role into the CI deploy matrix before it has ever run against a real
host, deliberately: the first CI round is its first execution. Everything below the first live
`make compose-deploy apps=web-app-socialhome` is design-by-source-reading.

Open items that only a live run can settle:

- `index.html` ships an inline pre-paint theme bootstrap, and the rendered header is
  `script-src-elem 'self' https://cdn.…` with no hash, so it is blocked and the first paint
  flashes the wrong theme. Pinning `csp.hashes.script-src-elem` fixes it but has to be re-pinned
  on every image bump; the flash is the cheaper trade until the theme matters.
- `meta/csp.yml` whitelists `blob:` on `script-src` for the audio worklet the DM composer builds
  with `URL.createObjectURL`; worklet modules load under `script-src`, not `worker-src`. The
  bundle registers no service worker and constructs no `Worker`. Whether the Preact bundle also
  needs `unsafe-inline` for style attributes is unknown until a browser reports violations.
- The published image is multi-arch, but only `linux/amd64` has been exercised.
- `Dockerfile.sh` exposes 8124 for aiolibdatachannel signalling beside 8099. Nothing listens on
  it at rest, so only 8099 is published; whether it binds lazily during a call is untested.

## Blocked personas

`PERSONA_ADMINISTRATOR_BLOCKED=true`
: Social Home 2026.6.16 imports `logout` from `client/src/store/auth.ts` in exactly one place —
  `client/src/main.tsx` wires it as the 401 handler via `setUnauthorizedHandler(logout)`. No
  component renders a logout control, so `personas/utils/logout.js` has nothing to click and the
  admin journey cannot complete. The alternative — injecting a `[data-injected-logout]` button via
  `templates/javascript.js.j2` — was rejected: the model
  (`roles/web-app-prometheus/templates/javascript.js.j2`) points the button at
  `OIDC.CLIENT.LOGOUT_URL`, which only exists for OIDC-gated roles, and this role deliberately runs
  without SSO. Path back: upstream ships a logout control (or an in-app logout endpoint we can
  target), then drop the flag and keep the `adminInteraction` already wired in the spec.

`PERSONA_BIBER_BLOCKED=true`
: The app authenticates against its own `platform_users` table. There is no OIDC client and no
  auto-provisioning, so the biber account never exists inside Social Home. Path back: upstream
  grows an OIDC/trusted-header auth path.

## Deferred wiring

- `SH_MAX_STORAGE_BYTES` is pinned to 4 GiB in `vars/main.yml` so the app's media cap stays inside
  `services.socialhome.min_storage` (5 GB). Raising one without the other lets the volume outgrow
  its declared budget.
- `SH_APPS_CATALOG_URL` is emptied so the container never fetches the app catalog from github.com.
  Set it to a self-hosted catalog when one exists.
- `SH_CORS_ALLOWED_ORIGINS` is unset — the SPA is same-origin. Needed only if a third-party client
  should talk to the API.
- The GFS / global-server side of upstream (`Dockerfile.gfs`) is not deployed. Only the household
  instance (`Dockerfile.sh`) is.