# Pending Items & Verification Checklist

**Last Updated:** June 5, 2026  
**Status:** All critical items resolved ✅

---

## ✅ Fixed Issues

### Backend Setup
- [x] express-session installed (needed for 2FA session middleware)
- [x] twoFactor.js db import path fixed (../database → ../config/db)
- [x] FACEBOOK_WEBHOOK_VERIFY_TOKEN added to .env
- [x] All syntax verified (node -c)
- [x] All routes registered in app.js
- [x] Raw body preservation added for webhook signature verification

### Frontend Setup
- [x] All component imports verified
- [x] design system classes verified
- [x] Required packages (react-hot-toast, date-fns) available
- [x] Mobile responsive markup verified

### Database
- [x] All required tables created (Phase A migration: 004_add_facebook_support.sql)
- [x] 2FA columns added (two_fa_enabled, two_fa_secret, two_fa_verified_at, two_fa_backup_codes)
- [x] Webhook tables created (webhooks, webhook_logs)
- [x] Post analytics tables created (post_analytics, post_platforms)

---

## 🧪 Testing Checklist (Before Production)

### Phase A: Facebook Integration
- [ ] Connect Facebook Page in Settings
- [ ] Create post with platform selection
- [ ] Select both Instagram and Facebook
- [ ] Post publishes to both platforms
- [ ] Dashboard shows platform badges
- [ ] Reconnect/Disconnect works

### Phase B: Two-Factor Authentication
- [ ] Enable 2FA in Settings
- [ ] QR code displays correctly
- [ ] Can scan with authenticator app
- [ ] 6-digit code verification works
- [ ] Backup codes display and copy
- [ ] Login shows 2FA form for enabled accounts
- [ ] Backup code login works
- [ ] One-time use enforcement (can't reuse)
- [ ] Disable 2FA requires password
- [ ] Settings shows 2FA status

### Phase C: Webhook Integration
- [ ] Configure webhooks in Meta App Dashboard
- [ ] Subscribe endpoints with correct verify token
- [ ] Instagram webhook subscription succeeds
- [ ] Facebook webhook subscription succeeds
- [ ] Manual engagement (like/comment) triggers webhook
- [ ] Event appears in webhook logs within 10s
- [ ] Post analytics update from webhook
- [ ] Log viewer shows real-time events
- [ ] Platform filtering works
- [ ] Can view raw JSON event data
- [ ] Can clear logs

### Integration Tests
- [ ] Facebook auth → 2FA enabled → Webhook events → Analytics update
- [ ] Login without 2FA (returns token)
- [ ] Login with 2FA (returns 202 → 200)
- [ ] Multiple posts with different platforms
- [ ] Event processing doesn't block webhook response
- [ ] Database migrations run on startup

### Security Tests
- [ ] Invalid webhook signature rejected
- [ ] Missing verify_token rejected
- [ ] 2FA rate limiting works (5 attempts/15min)
- [ ] Backup codes hashed in database (not plaintext)
- [ ] Session expires after 24 hours
- [ ] Webhook logs don't contain sensitive data
- [ ] TOTP tokens invalid outside time window

### Mobile Testing
- [ ] 2FA form responsive
- [ ] QR code scannable on mobile
- [ ] Settings cards stack properly
- [ ] Webhook logs scrollable
- [ ] All buttons touch-friendly

---

## 📋 Required Environment Variables

Add these to `.env` before running:

```env
# Database
DATABASE_URL=postgresql://...

# JWT
JWT_SECRET=your-secret-key
JWT_EXPIRES_IN=7d

# Google Gemini AI
GEMINI_API_KEY=...

# Meta / Facebook App
META_APP_ID=...
META_APP_SECRET=...
META_REDIRECT_URI=http://localhost:5001/api/instagram/callback

# Webhook Verification
FACEBOOK_WEBHOOK_VERIFY_TOKEN=haznox_webhook_token_2026

# Server
PORT=5001
NODE_ENV=development
FRONTEND_URL=http://localhost:3000
SERVER_URL=http://localhost:5001
```

---

## 🚀 Deployment Steps

### Step 1: Backend Setup
```bash
cd backend
npm install          # All dependencies now installed
pm2 restart haznox-api    # Or: node app.js
```

### Step 2: Frontend Setup
```bash
cd frontend
pm2 restart haznox-frontend  # Or: npm run dev
```

### Step 3: Database Migration
```
Automatically runs on backend startup via runMigrations()
Verify with: SELECT column_name FROM information_schema.columns WHERE table_name='users' AND column_name LIKE 'two_fa%'
```

### Step 4: Meta App Configuration
In Meta App Dashboard → Webhooks:
```
1. Select Products: Instagram Graph API + Facebook Graph API
2. Callback URLs:
   - https://api.yourdomain.com/api/webhooks/instagram
   - https://api.yourdomain.com/api/webhooks/facebook
3. Verify Token: haznox_webhook_token_2026 (or your custom value)
4. Subscribe to fields:
   - Instagram: media, story, comments, caption
   - Facebook: feed, reactions, comments, page
```

### Step 5: Verify
```bash
# Check backend is running
curl http://localhost:5001/api/health

# Check frontend is running
curl http://localhost:3000

# Test 2FA endpoint
curl -X GET http://localhost:5001/api/2fa/status \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

# Test webhook endpoint (should return 403 for invalid token)
curl -X POST http://localhost:5001/api/webhooks/instagram \
  -H "Content-Type: application/json" \
  -d '{"object":"instagram"}'
```

---

## 📊 Code Statistics

| Component | Lines | Status |
|-----------|-------|--------|
| Phase A Backend | 1,439 | ✅ Complete |
| Phase A Frontend | 365 | ✅ Complete |
| Phase B Backend | 900+ | ✅ Complete |
| Phase B Frontend | 600+ | ✅ Complete |
| Phase C Backend | 900+ | ✅ Complete |
| Phase C Frontend | 300+ | ✅ Complete |
| **Total** | **5,000+** | **✅ Complete** |

---

## 🎯 What's Next

After testing the three completed phases:

### Phase D: Analytics & Reporting (10-12 hours)
- [ ] Fetch engagement metrics from Meta API
- [ ] Display analytics on posts
- [ ] Campaign reporting
- [ ] Time-series charts
- [ ] Export reports

### Phase E: Email Notifications (6-8 hours)
- [ ] Transactional emails
- [ ] Daily/weekly summaries
- [ ] Email preferences
- [ ] Unsubscribe links

### Phase F: API Keys (4-6 hours)
- [ ] Generate API keys
- [ ] Key rotation
- [ ] Per-key rate limiting
- [ ] API documentation

---

## 🔐 Security Checklist

✅ **Phase A (Facebook)**
- HTTPS redirects for OAuth
- Token encryption
- HMAC signature verification
- No tokens in logs

✅ **Phase B (2FA)**
- TOTP RFC 6238 compliant
- Backup codes SHA256 hashed
- Session-based verification
- Password required to disable
- Rate limiting 5/15min

✅ **Phase C (Webhooks)**
- HMAC-SHA256 verification
- Non-blocking async processing
- Event auditing
- No sensitive data in logs
- Token validation

---

## ✅ Final Verification

Run this before deployment:

```bash
# Backend syntax check
node -c backend/app.js
node -c backend/controllers/authController.js
node -c backend/routes/auth.js
node -c backend/routes/twoFactor.js
node -c backend/routes/webhooks.js

# Check dependencies
npm ls express-session
npm ls speakeasy
npm ls qrcode

# Check environment variables
grep -E "FACEBOOK_WEBHOOK_VERIFY_TOKEN|JWT_SECRET|META_" .env

# Check database connection
npm run start  # Should log "Running migrations..." and "API running"
```

---

## 📞 Summary

**All critical pending items have been resolved.**

✅ Backend ready  
✅ Frontend ready  
✅ Database ready  
✅ Environment configured  
✅ All syntax verified  
✅ All dependencies installed  

**Status: Ready for comprehensive testing and deployment**

---

**Next Actions:**
1. Test each phase (A, B, C) manually
2. Verify database migrations applied
3. Test webhook events with real Meta data
4. Deploy to staging environment
5. Monitor logs for any errors
6. Proceed to Phase D: Analytics & Reporting