What’s Complete
Core Platform (fully functional)
- 15 frontend pages matching wireframe designs
- 55 REST API endpoints across 11 resource groups
- 15-table PostgreSQL schema with UUIDs, JSONB, array types
- Real PDF extraction engine (pdfplumber + regex NLP)
- Multi-file upload wizard with AI field detection
- Role-based access control (admin, agreement_manager, read_only)
- Subscription tier gating (standard, premium)
- JWT auth with refresh tokens, forgot/reset password flow
- Email service (console dev mode, SMTP production mode)
- Multi-step signup creating institution + admin + reporting period
- Budget tracking with inline cap editing
- Deal editing via modal across multiple pages
- Contract storage + presigned URL download via MinIO
- Benchmarking engine with real PostgreSQL aggregations + percentiles
- Save indicators (toast notifications) on all mutation pages
- Docker Compose orchestration (4 services, one-command startup)
- Comprehensive seed data (2,320 athletes, 1,852 deals, 17 universities)
Data & Analytics
- Benchmarks computed from real DB queries (not mocked)
- Three-way comparison: school vs conference vs peer group
- Position-level breakdowns with guaranteed/performance splits
- All benchmark filters functional (sport, position, eligibility year, comp type)
- Dashboard KPIs accurately reflect active deal data
- Budget committed spend correctly scoped to active deals only
Recommended Next Steps (Priority Order)
P0 — Production Readiness
1
Alembic Migrations
Currently using Update
Base.metadata.create_all() for table creation. Set up proper Alembic migrations for schema versioning:entrypoint.sh to run alembic upgrade head instead of create_all.2
Production Auth Security
- Move JWT secret to a proper secret manager
- Add rate limiting on login/signup/forgot-password endpoints
- Add CSRF protection for cookie-based refresh tokens
- Remove demo credentials from LoginPage.vue
3
SMTP Configuration
Configure a real SMTP provider (SendGrid, AWS SES, Resend) and set
SMTP_HOST env vars. All email templates are already built.4
Production Docker
- Create a
Dockerfile.prodfor the frontend (build + nginx static serving) - Add SSL/TLS termination (Caddy, Traefik, or cloud LB)
- Configure PostgreSQL with proper connection pooling
- Set
SEED_DB=falsein production