# Steady

Steady is an ADHD-friendly task manager built with Flask. It provides a modular
application foundation, secure authentication, task and subtask management, a
seven-item Today view, status filters, priorities, progress indicators, and a
single-task Focus Mode with countdowns, time blocks, context cues, positive
completion feedback, forgiving streaks, bulk text capture, and portable JSON
backups with reversible completed-task clearing. Per-user settings control
theme, reading style, completion sound, and future reminder frequency.

## Local setup

```bash
python -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
flask --app app run --debug
```

The development server is available at `http://127.0.0.1:5000`. Copy
`.env.example` to `.env` or export its values in your shell. Replace the sample
`SECRET_KEY` before using the app beyond local development.

## Database migrations

Apply the committed migrations after installing dependencies:

```bash
flask --app app db upgrade
```

When a model changes, generate a migration with
`flask --app app db migrate -m "Describe the schema change"`, review the
generated operations, and commit them so every environment applies the same
schema.

## Tests

```bash
python -m pytest
```

Tests use an isolated in-memory SQLite database and never write to the local
development database.

## Data and backups

After signing in, open `/tasks/transfer` to:

- import up to 200 UTF-8 Markdown or plain-text task lines;
- download a versioned JSON backup without credentials or account identifiers;
- merge or replace tasks from a validated Steady backup; and
- clear completed tasks with an immediate user-scoped undo action.

JSON restore validates the complete file before changing tasks. Keep downloaded
backups private because task descriptions may contain personal information.

## Personalization

Open `/settings/` after signing in to choose Light, Dark, or system-controlled
color mode; enable a dyslexia-friendly local reading style; turn completion
sound on or off; and save a future reminder-frequency preference. The browser
reminder control checks capability only. It does not request notification
permission, register a service worker, or schedule reminders.

## Roles and admin placeholder

Steady recognizes `user`, `admin`, `viewer`, and `coach` roles. Viewers can read
and export their own tasks but cannot mutate task data; the other three roles
retain writes to their own tasks. Ownership checks apply independently of role.

The admin feature is absent by default. Setting `FEATURE_ADMIN=true` before the
application starts registers `/admin/`, which remains restricted to the `admin`
role. It is a data-free placeholder only: user management, role assignment, and
analytics are intentionally not implemented.

## Production and quality

Task lists are paginated at 50 records per page and use an indexed visibility,
status, and due-date query path. Dynamic responses are not cached; static assets
use a bounded cache; and responses include CSP, framing, MIME, referrer,
permissions, and cross-origin policies.

Use [DEPLOYMENT.md](DEPLOYMENT.md) for Gunicorn, environment, TLS/reverse-proxy,
migration, backup, health-check, and rollback guidance. Use
[ACCESSIBILITY.md](ACCESSIBILITY.md) for automated evidence and the mandatory
manual browser, keyboard, zoom, forced-colors, and screen-reader release matrix.

Focused quality checks can be run with:

```bash
python -m pytest tests/polish
node --check app/static/js/main.js
SECRET_KEY=configuration-check-only gunicorn --check-config --config gunicorn.conf.py wsgi:app
```