Sinau LMS - Roadmap & Development Plan
Version: 0.1.1Date: Jul 22, 2026Status: M2–M5 Backend Complete | Next: M6 FrontendApproach: API-first (Backend Rust complete, then Frontend SvelteKit)
API-first strategy: Build all backend API endpoints and business logic first (M2-M5), then build the frontend (M6). Every feature has both API implementation AND tests.
Benefits:
Backend can be tested independently via curl/httpie/Postman
Frontend is a thin consumer — low coupling
API Tokens enable headless usage before UI exists
Stabilize auth, RBAC, storage, webhooks before UI
Milestone
Description
Status
M2 Foundation API (Auth, Users, Orgs, Courses, Chapters, Activities)
✅ Complete (Sprint 1–3)
M3 Content API (Media, Storage, Clone, Validation, Export)
✅ Complete (Sprint 4–5)
M4 Access Control (RBAC, API Tokens, Webhooks, Folders, Groups)
✅ Complete (Sprint 6–7)
M5 Engagement (Search, Analytics, Enrollments, Communities, Assignments, Certificates)
✅ Complete (Sprint 8–9)
M6 Frontend (SvelteKit 5)
🔲 Next
M7 Production (Docker, CI/CD, Deploy)
🔲 Planned
Test Types (applied to every feature)
Type
Purpose
Tool
Coverage Target
Unit tests Business logic, services, models
Rust built-in
80%+
Integration tests API endpoints with real DB
Rust + test DB
Every route
Contract tests JSON response shape validation
Custom assertions
Key endpoints
Every route MUST have at least one integration test (happy path).
Every service function MUST have at least one unit test.
Auth-protected routes MUST test 401 (no auth) and 403 (wrong role).
CRUD endpoints MUST test: create, read, update, delete.
Run tests on every commit via CI: + .
Test database: separate SQLite file ( or ), never touch dev data.
M2 - Foundation API (Week 1-3) Sprint 1: Project Skeleton (Week 1)
#
Task
Est.
Depends On
Tests
2.1
Initialize Cargo workspace (server/)
2h
-
Compile passes
2.2
Config system (ENV parsing, AppState)
3h
2.1
Unit: config reads ENV correctly
2.3
Database setup (sqlx, SQLite pool)
2h
2.2
Unit: pool connects, migration runs
2.4
Unified error handling (AppError enum)
2h
2.1
Unit: error serializes to JSON
2.5
Health check endpoint (GET /api/health)
1h
2.3
Integration: returns DB status
2.6
Test infrastructure (common helpers, test DB setup)
3h
2.3
Shared test module ready
2.7
Docker Compose skeleton (server only)
2h
2.1
runs
Sprint 2: Auth & Users API (Week 2)
#
Task
Est.
Depends On
Tests
2.8
Migration 001: users + user_identities
2h
2.3
Migration applies cleanly
2.9
Copy auth module from Hompimpah (config, oauth, session)
3h
2.2
Compile passes
2.10
Adapt auth for Sinau (JWT issuer, user creation)
3h
2.9
Unit: JWT issue/validate
2.11
Auth middleware (require_auth, require_role)
2h
2.10
Unit: middleware rejects 401/403
2.12
Auth routes (providers, login, callback, logout, me)
3h
2.11
Integration: full OAuth flow mock
2.13
User service (find_or_create, upsert_identity)
2h
2.8
Unit: find_or_create idempotent
2.14
User routes (GET /users, GET /users/:id, PUT)
2h
2.13
Integration: CRUD + role guard
Sprint 3: Orgs & Courses API (Week 3)
#
Task
Est.
Depends On
Tests
2.15
Migration 002: organizations + user_organizations
2h
2.8
Migration applies cleanly
2.16
Seed default org on startup
1h
2.15
Unit: seed creates default org
2.17
Migration 003: courses
1h
2.15
Migration applies cleanly
2.18
Course service + routes (CRUD + list + published/public)
4h
2.17
Integration: full CRUD + filters
2.19
Migration 004: chapters + course_chapters
1h
2.17
Migration applies cleanly
2.20
Chapter service + routes (CRUD + reorder)
3h
2.19
Integration: CRUD + reorder
2.21
Migration 005: activities + chapter_activities
1h
2.19
Migration applies cleanly
2.22
Activity service + routes (CRUD)
3h
2.21
Integration: full CRUD
M2 Deliverable: All auth, user, org, course, chapter, activity endpoints working. Full test coverage. Testable via curl.
M3 - Content API (Week 3-5) Sprint 4: Media & Storage API (Week 4)
#
Task
Est.
Depends On
Tests
3.1
Storage trait (StorageBackend: local + S3)
3h
2.2
Unit: trait methods
3.2
LocalStorage implementation
2h
3.1
Unit: upload, delete, get_url
3.3
S3Storage implementation (aws-sdk-s3)
3h
3.1
Integration: upload/delete against MinIO
3.4
Migration 007: media table
1h
2.8
Migration applies cleanly
3.5
Media upload endpoint (POST /media/upload)
3h
3.4
Integration: upload, verify file, check metadata
3.6
Static file serving (uploaded files)
2h
3.5
Integration: GET returns uploaded file
3.7
Course thumbnail upload endpoint
2h
3.5
Integration: thumbnail set + get
Sprint 5: Content CRUD API (Week 5)
#
Task
Est.
Depends On
Tests
3.8
Course clone endpoint (POST /courses/:uuid/clone)
3h
2.18
Integration: clone copies all data
3.9
Course meta endpoint (nested chapters + activities)
2h
2.18
Integration: returns full tree
3.10
Activity content validation (TipTap JSON schema)
2h
2.22
Unit: valid/invalid JSON
3.11
Content export endpoint (activity as markdown/HTML)
2h
2.22
Integration: returns formatted content
M3 Deliverable: Media upload (local + S3), course clone, content validation, export. Full test coverage.
M4 - Access Control API (Week 5-7) Sprint 6: RBAC & Ownership (Week 6)
#
Task
Est.
Depends On
Tests
4.1
Role-based route guards (admin/teacher/student)
3h
2.11
Integration: each role tested
4.2
Course ownership check (teacher edits own only)
2h
4.1
Integration: owner/non-owner
4.3
Published/public visibility logic
2h
2.18
Integration: published/unpublished
4.4
Organization CRUD routes
3h
2.15
Integration: full CRUD
4.5
Organization membership management
2h
4.4
Integration: add/remove members
Sprint 7: API Tokens & Webhooks (Week 7)
#
Task
Est.
Depends On
Tests
4.6
Migration 007: api_tokens
1h
2.8
Migration applies cleanly
4.7
Token CRUD endpoint
2h
4.6
Integration: create, list, delete
4.8
Bearer token auth middleware
2h
4.7
Integration: Bearer auth + JWT fallback
4.9
Migration 008: webhooks
1h
2.8
Migration applies cleanly
4.10
Webhook CRUD routes
2h
4.9
Integration: full CRUD
4.11
Event dispatcher + HMAC-SHA256 signing
4h
4.10
Integration: webhook fires on event
4.12
Folder CRUD (group courses)
2h
2.17
Integration: CRUD
4.13
User group CRUD + course access
3h
4.1
Integration: group + access check
M4 Deliverable: Full RBAC, ownership, API tokens, webhooks, folders, groups. All tested.
M5 - Engagement API (Week 7-9) Sprint 8: Search & Analytics (Week 8)
#
Task
Est.
Depends On
Tests
5.1
SQLite FTS5 migration for courses + activities
2h
2.17
Migration applies cleanly
5.2
Search endpoint (GET /search?q=...&type=...)
3h
5.1
Integration: search returns results
5.3
Analytics migration (progress, enrollment, completion)
2h
2.8
Migration applies cleanly
5.4
Progress tracking (mark activity complete)
3h
5.3
Integration: mark + get progress
5.5
Enrollment + completion endpoints
2h
5.3
Integration: enroll + check completion
Sprint 9: Discussions & Assignments (Week 9)
#
Task
Est.
Depends On
Tests
5.6
Migration 009: communities (threads + replies)
2h
2.8
Migration applies cleanly
5.7
Community routes (CRUD, threaded replies)
4h
5.6
Integration: create thread, reply, list
5.8
Migration 010: assignments + submissions
2h
2.8
Migration applies cleanly
5.9
Assignment routes (create, submit, grade)
4h
5.8
Integration: full flow
5.10
Certificate generation endpoint (PDF)
4h
5.4
Integration: cert generated on completion
M5 Deliverable: Complete backend API. Search, analytics, discussions, assignments, certificates. Full test coverage.
M6 - Frontend (Week 9-12) Sprint 10: SvelteKit Shell (Week 9-10)
#
Task
Est.
Depends On
Tests
6.1
Initialize SvelteKit 5 (web/)
2h
M5
Compiles
6.2
API client layer (typed fetch wrappers)
3h
6.1
Unit: client handles errors
6.3
Auth store + OAuth flow (login, callback, logout)
4h
6.2
E2E: login/logout works
6.4
Protected layout (dashboard)
2h
6.3
E2E: unauth redirect to login
Sprint 11: Dashboard (Week 10-11)
#
Task
Est.
Depends On
Tests
6.5
Course list + create/edit pages
4h
6.4
E2E: CRUD course
6.6
Chapter/activity management UI
4h
6.5
E2E: reorder chapters
6.7
TipTap editor integration
4h
6.6
E2E: edit + save content
6.8
Media upload in editor
2h
6.7
E2E: inline image
6.9
User management page (admin)
3h
6.4
E2E: list users
Sprint 12: Public & Settings (Week 11-12)
#
Task
Est.
Depends On
Tests
6.10
Public course view page
3h
6.5
E2E: view published course
6.11
Chapter -> activity navigation
2h
6.10
E2E: navigate content
6.12
Settings page (org, webhooks, API tokens)
3h
6.4
E2E: configure webhook
6.13
Search UI
2h
6.10
E2E: search finds course
6.14
Analytics dashboard (admin)
3h
6.4
E2E: stats visible
M6 Deliverable: Complete frontend consuming backend API. Full user-facing application.
M7 - Production (Week 12-13)
#
Task
Est.
Depends On
Tests
7.1
Multi-stage Dockerfile (server + web)
3h
M6
Docker build succeeds
7.2
Docker Compose production config
2h
7.1
7.3
Traefik routing config
1h
7.2
Domain + TLS works
7.4
PostgreSQL migration test
2h
7.2
All migrations pass on Postgres
7.5
CI pipeline (Woodpecker/GA): test + clippy + build
3h
-
CI green on PR
7.6
Environment documentation (.env.example)
1h
-
Clear setup guide
7.7
README.md + CONTRIBUTING.md
2h
-
Complete docs
7.8
CHANGELOG.md (v0.0.1)
1h
-
Release notes ready
M7 Deliverable: Deployable, tested, documented, production-ready LMS.
Risk
Likelihood
Impact
Mitigation
sqlx SQLite/Postgres syntax mismatch
Medium
Medium
Test migrations on both from day 1
TipTap Svelte extension breaking changes
Low
High
Pin version, test before upgrade
Auth module divergence from Hompimpah
Medium
Low
Document adaptations, share improvements back
OAuth provider API changes
Low
Medium
Abstracted in oauth.rs, easy to fix
Scope creep (adding Tier 2 features early)
High
High
Strict MVP scope, defer to Phase 2
Test DB pollution between tests
Medium
Medium
Use in-memory SQLite per test, clean setup/teardown
S3 integration test requires external service
Medium
Low
Use MinIO Docker sidecar or mock S3 for CI
Metric
Target
Auth flow (Google/GitHub/Keycloak)
Works end-to-end in < 5s
Course CRUD
Create + view in < 2 API calls
Test coverage
80%+ on backend services, 100% route coverage
API response (read)
< 50ms p95 (single entity)
Docker deploy
Fresh deploy in < 5 minutes
CI pipeline
All tests pass in < 3 minutes