# Project Checklist (tidy & current)

 Below are implemented features and pending items, grouped by area.

 ## Backend
 - [x] Express API: OAuth, server settings, channel/role endpoints, leave
 - [x] Invite endpoints (GET/POST/DELETE) and invite-token issuance
 - [x] Per-command toggles persistence and management
 - [x] Config endpoints for welcome/leave and autorole

 ## Frontend
 - [x] Login, Dashboard, Server Settings pages
	- Login redirects to Dashboard after OAuth and user/guilds are persisted in localStorage
	- Dashboard is protected: user must be logged in to view (redirects to login otherwise)
 - [x] MUI components, responsive layout, mobile fixes
 - [x] Theme switching (persist local) and user settings UI
 - [x] Invite UI: create form, list, copy, delete with confirmation
 - [x] Commands UI (per-command toggles)
 - [x] Live Notifications UI (per-server toggle & config)
	- Channel selection, watched-user list, live status with Watch Live button
	- Real-time updates: adding/removing users via frontend or bot commands publishes SSE `twitchUsersUpdate` and pushes settings to bot
	- Bot commands (`/add-twitchuser`, `/remove-twitchuser`) refresh local cache immediately after backend success
	- Message mode: toggle between Default and Custom; Apply sends `message`/`customMessage` (default fallback if empty); no longer dual free-form fields
	- Collapsible accordion interface: separate Twitch and Kick tabs (Kick tab disabled)

 ## Discord Bot
 - [x] discord.js integration (events and commands)
 - [x] Slash commands: `/create-invite`, `/list-invites`, `/manage-commands`, `/help`
 - [x] Bot used by backend to fetch live guild data and manage invites
 - [x] Bot reads/writes per-guild command toggles via backend/Postgres
 - [x] Backend immediately notifies bot of toggle changes (pushes updated settings to bot cache) so frontend toggles take effect instantly
 - [x] New slash command: `/setup-live` to enable/disable Twitch live notifications for the server (preserves other settings)
 - [x] Frontend: Confirm dialog and working Delete action for Twitch watched users in Live Notifications
 - [x] Live Notifications: bot posts message to configured channel with stream title and link when a watched Twitch user goes live
	- [x] Live Notifications: bot posts rich embed to channel when a watched Twitch user goes live (thumbnail, clickable title, bio/description, category/game, viewers, footer with "ehchadservices" and start datetime)
	- [x] Live Notifications polling frequency set to 5 seconds (configurable via `TWITCH_POLL_INTERVAL_MS`)
	- [x] On bot restart, sends messages for currently live watched users; then sends for new streams once per session
 - [x] Frontend: show "Watch Live" button next to watched user when they are live (links to Twitch)
	- [x] Bi-directional sync: backend POST/DELETE for twitch-users now also pushes new settings to bot process (when `BOT_PUSH_URL` configured)
	- [x] Bot adds/removes users via backend endpoints ensuring single source of truth (Postgres)
	- [x] Live notifications toggle on site enables/disables watching and publishes SSE for real-time updates
	- [x] /manage-commands command has enable/disable buttons that sync with frontend via backend API and SSE for live updating
	- [x] All Twitch-related commands (add, remove, list) and frontend actions communicate with backend and Postgres database
 - [x] Welcome/Leave messages: bot sends configured messages to channels when users join/leave
	- [x] Welcome messages with {user} and {server} placeholders
	- [x] Leave messages with {user} placeholder
	- [x] Autorole assignment on member join
	- [x] All settings managed through Server Settings UI
	- [x] Event handlers properly integrated with API settings
 - [x] Kick live notifications bot integration (temporarily disabled)
	- [x] New slash commands: `/add-kickuser`, `/remove-kickuser`, `/list-kickusers` (commands exist but watcher disabled)
	- [x] Kick API polling and notification posting (watcher removed, API endpoints remain)
	- [x] Per-server Kick user management via backend API (endpoints functional)
	- [x] Frontend tabs: separate Twitch and Kick tabs in Live Notifications accordion (Kick tab disabled)
	- [x] Bot watcher temporarily disabled in index.js startup
 - [x] Dev command filtering: commands marked with `dev: true` are hidden from UI, help, and Discord registration

 ## Database
 - [x] Postgres support via `DATABASE_URL` (backend auto-creates `servers`, `invites`, `users`)
 - [x] Legacy encrypted `backend/db.json` retained (migration planned)
 - [x] Kick.com live notifications: backend API, frontend UI, bot integration
	- Database schema: kickUsers table with userId, username, guildId
	- API endpoints: GET/POST/DELETE /api/servers/:guildId/kick-users
	- Bot commands: /add-kickuser, /remove-kickuser, /list-kickusers
	- Frontend tabs: separate Twitch and Kick tabs in Live Notifications accordion
	- Kick API integration: polling for live status, stream metadata, web scraping fallback for 403 errors
	- Per-server configuration: all settings scoped by guildId
 - [x] Schema: live notification settings stored in server settings (via `liveNotifications` JSON)
	- Fields: `enabled`, `channelId`, `users[]`, `kickUsers[]`, `message`, `customMessage` (custom overrides default if non-empty)
	- Users list preserved when updating other live notification settings (fixed: kickUsers now also preserved)

 ## Security & Behavior
 - [x] Invite DELETE requires short-lived HMAC token (`x-invite-token`)
 - [x] Frontend confirmation dialog for invite deletion
 - [ ] Harden invite-token issuance (require OAuth + admin check)
	- [ ] Template variables for messages (planned): support `{user}`, `{title}`, `{category}`, `{viewers}` replacement in `message` / `customMessage`

 ## Docs & Deployment
 - [x] README and CHANGELOG updated with setup steps and Postgres guidance
 - Core env vars: `DATABASE_URL`, `DISCORD_CLIENT_ID`, `DISCORD_CLIENT_SECRET`, `DISCORD_BOT_TOKEN`, `INVITE_TOKEN_SECRET`, `ENCRYPTION_KEY`, `HOST`, `PORT`, `CORS_ORIGIN`
 - Frontend: set `REACT_APP_API_BASE` to backend URL before build
 - Tailscale: bind backend to your tailnet IP (100.x.y.z) and set `DATABASE_URL` to a Postgres reachable over the tailnet

 Notes:
 - `backend/.env.example` and `frontend/.env.example` are templates — copy to `.env` and fill values.
 - Postgres / pgAdmin: create DB & user, set `DATABASE_URL`; backend auto-creates tables on startup.

 UI tweaks applied:
 - Server cards: uniform sizes, image cropping, name clamping
 - Mobile spacing and typography adjustments
 - Dashboard action buttons repositioned (Invite/Leave under title)
 - Live Notifications: collapsible accordion with tabbed interface for Twitch and Kick tabs (Kick tab disabled)

 - [x] Browser tab now shows `ECS - <Page Name>` (e.g., 'ECS - Dashboard')
 - [x] Dashboard duplicate title fixed; user settings (avatar/themes) restored via NavBar
 - [x] Maintenance page
  - Frontend displays a maintenance page with a loading indicator when the backend is offline; it polls the backend and reloads UI immediately when the backend is available.
	- [x] Global backend health & SSE
		- [x] Added `BackendContext` to centralize health polling and a single shared EventSource
		- [x] Pages (including `ServerSettings`) use the shared event bus for live updates so the whole site receives changes in real-time
		- [ ] Frontend file re-organization
		- [ ] Verify guild-scoped SSE payloads include guildId and frontend filters events by guild (in-progress)
		- [ ] Add debug SSE publish endpoint to help validate real-time flows (done, guarded by DEBUG_SSE)
			- [x] Created `frontend/src/lib/api.js` and refactored some modules to use it
			- [x] Created `frontend/src/components/common` and `frontend/src/components/server`
			- [x] Moved `ConfirmDialog` and `MaintenancePage` to `components/common`
			- [x] Moved `ServerSettings` and `HelpPage` to `components/server`
			- [x] Fixed ESLint warnings: removed unused imports and handlers, added proper dependency management
			- [ ] Remove legacy top-level duplicate files (archival recommended)