fix: update documentation and configuration files

docs/TODO.md

@@ -17,11 +17,11 @@
 ## In Progress - UI Development
 
 ### Completed
-- [x] Navigation layout (app.html.erb)
+- [x] Navigation layout (Next.js components)
 - [x] UI Design document (UI_DESIGN.md)
-- [x] Player Profile template (existing)
-- [x] Basic CSS styling
-- [x] Player Schedule view (action + template)
+- [x] Player Profile page (Next.js)
+- [x] Basic CSS styling (Tailwind CSS)
+- [x] Player Schedule page (Next.js)
 - [x] Route for player schedule
 
 ### View Types to Implement
@@ -58,81 +58,73 @@
 - [ ] Bracket visualization
 
 ### Implementation Phases
-- [x] Phase 1: Navigation & Layout (Week 1)
-- [x] Phase 2: Player Profile Enhancements (Week 1-2)
-- [x] Phase 3: Tournament Admin View (Week 2-3)
-- [x] Phase 4: Club Admin View (Week 3-4)
-- [x] Phase 5: Player Schedule View (Week 4)
-- [ ] Phase 6: Authentication & Authorization (Week 5)
-- [ ] Phase 7: Polish & Testing (Week 6)
+- [x] Phase 1: Navigation & Layout
+- [x] Phase 2: Player Profile Enhancements
+- [x] Phase 3: Tournament Admin View
+- [x] Phase 4: Club Admin View
+- [x] Phase 5: Player Schedule View
+- [ ] Phase 6: Authentication & Authorization
+- [x] Phase 7: Polish & Testing
 
 ## Future Enhancements
 
 ### Features
-- [ ] Real-time match updates
-- [ ] Mobile-responsive design
+- [ ] Real-time match updates (WebSockets)
+- [ ] Mobile-responsive design improvements
 - [ ] Email notifications
 - [ ] Import/Export functionality
 - [ ] API for third-party integrations
-- [ ] Login/AAA System (Authentication, Authorization, Accounting)
+- [ ] Advanced analytics charts
 
 ### Technical
 - [ ] Performance optimization
 - [ ] Caching strategy
 - [ ] Security hardening
 - [ ] Deployment pipeline
+- [ ] CI/CD setup
 
-## AAA System (Authentication, Authorization, Accounting)
+## AAA System (Authentication, Authorization, Accounting) - Next.js Implementation
 
-### Authentication
-- [x] Create users table migration
-- [x] Create users repository
-- [x] Create users model/struct
-- [x] Build login page template
-- [x] Build login action
-- [x] Build logout action
-- [x] Add login/logout routes
-- [x] Add BCrypt to Gemfile
-- [x] Install BCrypt
-- [x] Create authorization service
-- [x] Add authorization helpers to base action
-- [x] Add role-based access control
-- [ ] Create registration action and template
-- [ ] Add session management middleware
-- [ ] Add current_user helper to views
+### Authentication (Better Auth + Prisma)
+- [x] Set up Better Auth with Prisma
+- [x] Create users table schema
+- [x] Build login page (`/auth/login`)
+- [x] Build registration page (`/auth/register`)
+- [x] Implement session management with Better Auth
+- [x] Add authentication middleware
 - [ ] Password reset functionality
 - [ ] Email confirmation system
+- [ ] OAuth providers (optional)
 
-### Authorization
-- [x] Define roles (player, tournament_admin, club_admin, system_admin)
-- [x] Create Authorization service
-- [x] Implement permission checks
+### Authorization (RBAC)
+- [x] Define roles in Prisma schema (PLAYER, TOURNAMENT_ADMIN, CLUB_ADMIN)
+- [x] Implement authorization helpers
 - [x] Add authorization to admin dashboard
 - [x] Add authorization to player management
 - [x] Add authorization to tournament management
-- [x] Add 5-minute match edit window
-- [ ] Add role assignment UI
-- [ ] Add permission checks to all routes
+- [x] Add 5-minute match edit window (player role)
+- [ ] Add role assignment UI for club admins
+- [ ] Add permission checks to all API routes
 
-### Accounting
-- [ ] Create activity logging system
+### Accounting (Activity Logging)
+- [ ] Create activity logging system (Prisma model)
 - [ ] Track authentication events
 - [ ] Track tournament management events
 - [ ] Track match recording events
 - [ ] Build audit reports UI
 
 ### Security
-- [ ] Rate limiting on login attempts
-- [ ] IP-based lockout (partially implemented in users repo)
-- [ ] Secure cookie settings
-- [ ] CSRF protection
+- [x] Rate limiting (Better Auth built-in)
+- [ ] IP-based lockout
+- [x] Secure cookie settings (Better Auth)
+- [x] CSRF protection (Next.js built-in)
 - [ ] Security headers
 - [ ] Session fixation prevention
 
 ## Known Issues
 - [ ] Database IDs not resetting between tests (workaround: query by round_number)
 - [ ] Need to clean up debug output from acceptance tests
-- [ ] README is minimal and needs expansion
+- [ ] Password reset flow not yet implemented
 
 ## Next Steps
 1. Design UI mockups for each view type