rgl_framework/docs/TASKS.md

# Tasks & Improvements

Prioritized backlog of issues, improvements, and feature ideas.

---

## Critical

*No critical issues currently.*

---

## High

### Add proper .gitignore
Current `.gitignore` only has `more_modules`. Missing:
- `rust_core/target/`
- `*.so`
- `rgl_data.db`
- `*.log`
- `.DS_Store`

### Create build script
No Makefile or build automation exists. Need a script for:
- Cross-compile Rust for aarch64-linux-android
- Deploy .so to device via ADB
- Optional: rebuild on file change

### Improve Rust error handling
50+ `unwrap()` calls across Rust codebase. Key areas:
- `bridge.rs`: mutex locks can panic on poisoning — use `unwrap_or_else()` with recovery
- `db.rs`: 30+ unwrap/unwrap_or_default — silent failures on DB errors
- `server.rs`: 15+ unwraps in HTTP handlers
Should introduce proper error types (thiserror crate) or at minimum `unwrap_or_else()` with logging.

### Silent JSON parse failures in db.rs
`execute_batch()` returns `"[]"` on JSON parse error without logging. Should log the error for debugging.

---

## Medium

### Fix BTC module global state
`more_modules/btc/init.lua` uses `btc_visible = false` as a global variable (for mimgui OnFrame). Should be moved to a proper module state mechanism to avoid global namespace pollution.

### Implement WebSocket backpressure
`bridge.rs` broadcast channel has capacity 256. Events are silently dropped when full. Should either increase capacity, add warning logging, or implement backpressure.

### Improve fallback JSON encoder
`rgl_framework.lua` fallback JSON decoder only handles flat `{"key":"value"}` — fails on nested objects, arrays, numbers, booleans. Since cjson is always expected to be present, consider making it a hard requirement instead of silently degrading.

### Add integration tests
Only `db.rs` has tests (6 batch operation tests). Missing:
- Bridge request/response cycle
- Event system overflow/blocking
- HTTP handler edge cases
- Module loading/unloading
- Win-1251 encoding conversion

### Module loading error handling
`load_all_modules()` uses `io.popen('ls ...')` which can fail if directory is deleted between listing and loading. Use `pcall(io.open)` instead.

### Add auth/CORS for web API
Currently any network client can call all APIs. Consider at minimum:
- Bind to localhost only (or configurable)
- Basic auth token
- CORS headers for web clients

---

## Low

### Add rate limiting to API handlers
No protection against API spam. Could add simple per-endpoint rate limits.

### Add request/response logging middleware
No HTTP access logging in Rust. Add optional access log for debugging API calls.

### Optimize broadcast channel capacity
Current 256 capacity is arbitrary. Profile actual event rates and set appropriately.

### Add module versioning
No way to track which version of a module is loaded. Could add `M.version` field and display in admin panel.

### Add deployment documentation
No docs on how to deploy the .so to an Android device, set up the framework, or configure MoonLoader to load the script.

---

## Feature Ideas

### WebSocket command execution
Allow web clients to send commands via WebSocket instead of only HTTP POST. Would enable real-time bidirectional communication.

### Module dependency system
Currently modules load independently. A dependency system would let modules declare required modules and load in order.

### Persistent notification history
In-game notifications disappear after timeout. Could persist to DB and show in admin panel.

### SAMemory integration module
Create a utility module that exposes player position, health, vehicle state via the web UI using the SAMemory library from ../lib.

### Config file support
Use `inicfg.lua` or `jsoncfg.lua` from ../lib for human-editable configuration alongside the DB-based persistence.