Phase2

docs/IMPLEMENTATION_STATUS.md

@@ -2,54 +2,61 @@
 
 Last updated: 2026-06-26
 
-## Current phase: Phase 1 — Authentication & user panel ✅
+## Current phase: Phase 2 — Single-Node Vertical Slice ✅
 
-### Phase 1 completed
+### Phase 2 completed
 
 | Area | Status | Notes |
 |------|--------|-------|
-| Prisma auth models | Done | EmailVerificationToken, PasswordResetToken, TotpCredential, RecoveryCode |
-| Migration | Done | `20260626120000_phase1_auth` + platform role seed |
-| `@hexahost/auth` | Done | Argon2id, tokens, TOTP, recovery codes, username utils |
-| API AuthModule | Done | Register, login, logout, verify, reset, 2FA, `/me`, sessions |
-| Session cookies | Done | `hgc_session`, HttpOnly, Secure in prod, SameSite lax |
-| Account lockout | Done | 5 attempts → 15 min lock |
-| Worker emails | Done | `notifications` queue → nodemailer (Mailpit in dev) |
-| Web auth UI | Done | Login, register, 2FA, forgot/reset, verify, security |
-| Route protection | Done | Middleware cookie check for dashboard/security |
-| Admin bootstrap | Done | `pnpm bootstrap:admin --email … --password …` |
-| Tests | Done | Auth package vitest, API health/auth tests, contracts |
+| Prisma lifecycle models | Done | Allocations, server fields, node enrollment |
+| `@hexahost/contracts` servers | Done | Zod schemas for create/list/action |
+| API ServersModule | Done | CRUD, start/stop, BullMQ jobs |
+| API NodesModule | Done | WebSocket `/api/v1/nodes/ws`, Redis command bridge |
+| API Plans | Done | `GET /api/v1/plans` |
+| Admin nodes | Done | `POST /api/v1/admin/nodes` with enrollment token |
+| Worker provisioning | Done | Port allocation, Redis commands, response wait |
+| Worker lifecycle | Done | start-server, stop-server jobs |
+| Go node-agent | Done | WebSocket, Docker (`itzg/minecraft-server:java21`) |
+| Web server UI | Done | Create, list, detail, start/stop |
+| Dev seed | Done | `pnpm db:seed` — Free plan + local dev node |
+| Migrations | Done | `20260626140000_phase2_game_servers` |
 
-### Abnahmekriterium Phase 1
+### Abnahmekriterium Phase 2
 
-- [x] Registration with email verification flow
-- [x] Login/logout with secure sessions
-- [x] Password reset
-- [x] TOTP 2FA setup and login challenge
-- [x] Session list and revoke
-- [x] Admin bootstrap CLI (no default credentials)
-- [x] Audit events for security actions
-- [x] Unit/integration tests pass
+- [x] User creates server in web panel
+- [x] Provisioning pipeline (API → Worker → Agent)
+- [x] Start/stop lifecycle
+- [x] Node enrollment + heartbeat
+- [x] Connection address shown (`localhost:port`)
+- [ ] Manual Minecraft join validation (requires Docker + agent running locally)
+
+### Local vertical slice
+
+```bash
+pnpm dev:infra
+pnpm db:migrate   # or db:push
+pnpm db:seed
+pnpm dev
+
+# Terminal 2 — Node Agent (requires Go + Docker)
+cd apps/node-agent
+set NODE_ID=00000000-0000-4000-8000-000000000001
+set NODE_TOKEN=local-dev-enrollment-token-change-me-32chars
+set NODE_AGENT_PUBLIC_URL=ws://localhost:3001/api/v1/nodes/ws
+make run
+```
 
 ### Known limitations
 
-- E2E Playwright tests for auth flow not yet added (planned).
-- Email templates are minimal HTML (no branded layout yet).
-- OIDC / Passkeys deferred to later phases.
-- CSRF relies on SameSite cookies + CORS origin check; no double-submit token yet.
+- Single-node only (no scheduler/queue fairness yet).
+- Minecraft image pull on first provision can take several minutes.
+- Node agent on Windows needs Docker Desktop; run agent on host, not in Compose.
+- mTLS for agent deferred; token-based enrollment only.
+- Metrics are basic heartbeat payload only.
 
-### Test commands
+### Next phase: Phase 3 — Console, files, settings
 
-```bash
-pnpm install
-pnpm db:migrate    # or db:push
-pnpm test
-pnpm build
-pnpm bootstrap:admin -- --email admin@localhost --password 'your-secure-password'
-```
-
-### Next phase: Phase 2 — Single-Node Vertical Slice
-
-- GameNode enrollment, Go agent WebSocket
-- Server create, provision, start/stop
-- First playable Minecraft server locally
+- Live console WebSocket
+- File manager
+- server.properties editor
+- Player lists