Future architecture

Each priority below maps to the gaps listed in Known limitations.

​

Priority 1: Security hardening

Multi-factor authentication for admin accounts, account lockout with progressive delays, strict CSP with nonce-based script loading, PostgreSQL row-level security as defense-in-depth, and automated dependency scanning in CI.

​

Priority 2: Infrastructure

GitHub Actions for automated test gates on every PR, uptime monitoring (Better Stack or UptimeRobot), Sentry error tracking, centralized log retention, and an API versioning strategy beyond the current single /api/v1 prefix.

​

Priority 3: Entitlement engine

Separate initial and replacement quantity tables per rule set, provisional (temporary or exception) entitlements, a dedicated entitlement history view, and automatic period rollover on cycle boundaries.

​

Priority 4: Order management

Estimated delivery dates, courier tracking integration, partial fulfilment, order templates, and CSV-based batch order creation.

​

Priority 5: Notifications

Push notifications (FCM), SMS via a gateway, user-configurable notification preferences, and a retry queue for failed email sends. The WhatsApp channel value already reserved in the schema would activate here.

​

Priority 6: Reporting

Scheduled report generation and delivery, historical trend comparisons, a custom report builder, and server-side CSV generation for large datasets.

​

Priority 7: Frontend

Auto-generated frontend types from the Prisma schema, a shared type package, visual regression testing, and expanded mobile-responsive layouts.

​

Priority 8: Data management

Data archival to cold storage, GDPR-style per-employee data export, and a configurable audit-log retention policy.