phase 3 complete

docs/TODO.md

@@ -1,4 +1,4 @@
-# HAGFISH Project todo
+# HAGFISH Project TODO
 
 `GET statbank.hagstova.fo/api/v1/fo/H2/VV/VV01/fisknv_md.px — metadata`
 POST same URL — JSON-stat2 query
@@ -78,14 +78,22 @@ hagfish/
 
 ### Phase 3: API (Axum)
 
-- [ ] 3.1 Set up Axum router in main.rs with Tokio runtime. AppState holds DuckDB connection wrapped in Mutex.
-- [ ] 3.2 Implement GET /api/species — query species lookup table, return JSON array
-- [ ] 3.3 Implement GET /api/landings — parse query params, build DuckDB SQL with WHERE clauses. Support: months, species, gear, zone, measure filters.
-- [ ] 3.4 Implement GET /api/summary — aggregate query: total mass + value by month, top 10 species by value, price/kg trend
-- [ ] 3.5 Implement GET /api/export.parquet — generate and stream Parquet via DuckDB COPY
-- [ ] 3.6 Implement GET /healthz
-- [ ] 3.7 Serve static files via rust-embed
-- [ ] 3.8 Write API tests
+- [x] 3.1 Set up Axum router in main.rs with Tokio runtime. AppState holds DuckDB connection wrapped in Mutex.
+- [x] 3.2 Implement GET /api/species — query species lookup table, return JSON array
+- [x] 3.3 Implement GET /api/landings — parse query params, build DuckDB SQL with WHERE clauses. Support: months, species, gear, zone, measure filters.
+- [x] 3.4 Implement GET /api/summary — aggregate query: total mass + value by month, top 10 species by value, price/kg trend
+- [x] 3.5 Implement GET /api/export.parquet — generate and stream Parquet via DuckDB COPY
+- [x] 3.6 Implement GET /healthz
+- [x] 3.7 Serve static files via rust-embed
+- [x] 3.8 Write API tests
+
+#### Production Hardening (Deferred to Post-Launch)
+
+- [ ] 🔒 DB operation timeouts — Add 30s `tokio::time::timeout()` wrapper around all `spawn_blocking` DB calls
+- [ ] 🔒 CORS hardening — Replace `CorsLayer::permissive()` with explicit allowed origins before production deployment
+- [ ] 🔒 Rate limiting — Optional: add `tower_governor` middleware to prevent abuse on public deployments
+- [ ] ⚠️ Startup config validation — Verify `data_source_url` is reachable, `duckdb_path` is writable before accepting connections
+- [ ] 📊 Metrics export (Prometheus) — Optional: track request counts, latencies, error rates via `prometheus` crate
 
 ### Phase 4: Frontend
 
@@ -111,3 +119,13 @@ hagfish/
 - [ ] 6.2 Write systemd timer (hagfish-ingest.timer + hagfish-ingest.service) — monthly, runs hagfish ingest
 - [ ] 6.3 Taskfile: build (release, static), deploy (rsync binary + config + units, ssh reload)
 - [ ] 6.4 README with ELI5 Technology Choices section (why DuckDB, why Rust, why embedded static assets)
+
+---
+
+## Current Status
+
+**Phase 1**: Complete ✅  
+**Phase 2**: Complete ✅  
+**Phase 3**: Complete ✅ (API operational, tests passing)  
+**Production Hardening**: Deferred ⏸️  
+**Phase 4-6**: Pending — Start after MVP validation