Stride/docs/APP_PROGRESS.md

Stride local application

Updated: 2026-10-01

Delivered

• Flask application factory and Jinja UI; local Waitress server on loopback port 5000.
• SQLite for local development, PostgreSQL driver/configuration, Alembic migrations.
• Name/email/password signup, generated profile identifier, session login/logout.
• CSRF checks, password hashing, login rate limits and no-store responses.
• Local first-account setup imports the existing Garmin cache privately.
• FIT upload, owner-specific cached imports, checksummed sync files and deduplication by source identity. Cross-source file-versus-Garmin reconciliation remains a follow-up.
• Overview with distance/time/pace totals and weekly volume; activity pages with route maps, pace/heart-rate charts and recorded laps.
• Profile editing and time-zone selection.
• Activity sharing choices: private or accepted friends. No public activity access.
• Friend requests by exact email, recipient acceptance, decline/cancel/remove, friends feed and friendship-gated profiles. Full routes shown without masking.
• Local JavaScript assets with upstream licenses; OpenStreetMap tiles are fetched by the browser with attribution. Select an appropriate tile service for deployment.

Validation

• Offline sync and application tests cover FIT decoding, original downloads, retries, credential redaction, ownership, private/friend visibility, CSRF, friend acceptance/removal and preservation of full start/finish coordinates.
• Real local Garmin files imported into a temporary in-memory database successfully.
• Schema migrations applied to local SQLite.
• Browser checks use an isolated synthetic fixture: overview chart and route map render; the real application remains ready for the user to create their account.

Next increments

1. Web token upload with encrypted per-user sessions and connection validation.
2. Background imports, retries, refresh locking and scheduled Garmin polling.
3. Email verification and account recovery before broader hosted signup.
4. PostgreSQL integration checks and Dokku Docker deployment/backup process.
5. Deletion/export controls, pagination at larger activity counts and moderation.

Current local development choices are not a claim of production readiness.