# Todo — subscriptions.mycloud.mu

## P1 — Critical

- [x] **Subscription: add quick `active` toggle in list view**
  Added `boolean` column for `active` to the subscription list. Users can click Edit to toggle (the ToggleOperation trait doesn't exist in this version of Backpack Pro).

- [x] **Subscription: `active` column missing from list**
  Added `boolean` column for `active` to `setupListOperation()`.

- [x] **Cron route is unauthenticated**
  Created `VerifyCronToken` middleware. Route now requires `?token=CRON_SECRET`. Added `CRON_SECRET` to `app.php` config and `.env.example`. Cron callers must update their URL: `/cron-jobs?token=your-secret`.

- [x] **Duplicate send risk — no idempotency**
  `Cron::dispatchReminders()` now checks `email_log` before dispatching. If a reminder for the same subscription + subject already exists today, it logs a skip and moves on.

- [x] **User CRUD: password not hashed on Create/Update**
  Replaced `setFromDb()` with explicit fields. Password field uses `type('password')`. The User model's `hashed` cast handles hashing. On update, blank password is stripped from the request so the existing hash is preserved.

---

## P2 — Important

- [x] **Subscription: no `active` filter in list**
  Added Status filter (Active / Inactive) to `setupListOperation()`.

- [x] **Subscription: no reminder-sent tracking**
  Added `getReminderHistoryAttribute()` on the Subscription model (queries `email_log`). Displayed in the Show operation via a `custom_html` column.

- [x] **Product: delete not protected against linked subscriptions**
  Overrode `destroy()` in `ProductCrudController`. Returns a 422 with a friendly message if the product has linked subscriptions.

- [x] **User CRUD: sensitive fields exposed in list and form**
  List now shows only `name`, `email`, `created_at`. Form uses explicit fields — no `password` or `remember_token` in the list.

- [x] **Subscription: no `active` column indicator in Show view**
  `setupShowOperation()` calls `setupListOperation()` first, so the boolean column is inherited.

---

## P3 — Nice to Have

- [x] **Subscription: soft deletes**
  Migration `2026_05_30_000001_add_soft_deletes_to_subscriptions_table.php` adds `deleted_at`. `SoftDeletes` trait added to Subscription model. `DeleteOperation` re-enabled in `SubscriptionCrudController`.
  **Action required:** run `php artisan migrate` on the server.

- [x] **Product: subscription count column in list**
  `getSubscriptionsCountLabel()` method on Product model. Displayed as a `model_function` column in the product list.

- [x] **User CRUD: prevent self-deletion**
  Overrode `destroy()` in `UserCrudController`. Returns 403 if the target ID matches the logged-in user.

- [x] **No Supervisor / queue worker management**
  `supervisor.conf` created at project root with instructions. Update the `command` path before deploying.

- [ ] **Single user role — no RBAC**
  Not implemented — requires a design decision on what roles/permissions are needed.

- [ ] **Email templates: no My Cloud branding**
  Not implemented — requires design assets (logo, colours).