Sprint 4: RBAC hardening, rate limiting, pagination fixes, backup docs

- Enforce viewer read-only across all write endpoints (require_roles)
- Add slowapi rate limiting with Redis backend (120 req/min default)
- Wrap layers/stats/members in PaginatedResponse envelope
- Update frontend to consume paginated responses
- Add backup script (deploy/backup.sh) with 7-day retention
- Document MinIO versioning and WAL archiving in DEPLOYMENT.md
- Reverse NDVI layer order (latest first)
- Update ROADMAP.md: all MVP milestones complete (179/182 tasks)

Author: superzero11

DEPLOYMENT.md

@@ -179,12 +179,138 @@ sudo docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --bui
 
 ### Database Backup
 
+OpenFarm includes an automated backup script at `deploy/backup.sh`.
+
+**Manual backup:**
+
 ```bash
-# Create backup
+# Quick one-liner
 sudo docker compose exec db pg_dump -U openfarm openfarm | gzip > backup_$(date +%Y%m%d).sql.gz
 
-# Restore backup
-gunzip -c backup_20260215.sql.gz | sudo docker compose exec -T db psql -U openfarm openfarm
+# Using the backup script (recommended)
+sudo /opt/openfarm/deploy/backup.sh
+```
+
+**Automated daily backups (cron):**
+
+```bash
+# Add to root crontab
+sudo crontab -e
+
+# Daily at 02:00 UTC, 7-day retention (default)
+0 2 * * * /opt/openfarm/deploy/backup.sh >> /var/log/openfarm-backup.log 2>&1
+```
+
+**Configuration (environment variables):**
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `BACKUP_DIR` | `/opt/openfarm/backups` | Local backup directory |
+| `RETENTION_DAYS` | `7` | Days to keep local backups |
+| `UPLOAD_TO_MINIO` | `false` | Upload backups to MinIO/S3 |
+| `MINIO_ALIAS` | `local` | mc alias for MinIO |
+| `MINIO_BUCKET` | `openfarm` | Target bucket |
+
+**Restore from backup:**
+
+```bash
+# From custom format (.dump) — recommended
+sudo docker compose exec -T db pg_restore -U openfarm -d openfarm --clean < backups/openfarm_20260215_020000.dump
+
+# From SQL format (.sql.gz)
+gunzip -c backups/openfarm_20260215.sql.gz | sudo docker compose exec -T db psql -U openfarm openfarm
+```
+
+### MinIO Bucket Versioning
+
+Enable versioning to protect against accidental object deletion/overwrite (COG rasters, photos):
+
+```bash
+# Install MinIO client (mc) if not present
+curl -sSL https://dl.min.io/client/mc/release/linux-arm64/mc -o /usr/local/bin/mc && chmod +x /usr/local/bin/mc
+
+# Configure mc alias
+mc alias set local http://localhost:9000 openfarm openfarm_dev_secret
+
+# Enable versioning on the openfarm bucket
+mc version enable local/openfarm
+
+# Verify
+mc version info local/openfarm
+# Expected: local/openfarm versioning is enabled
+
+# Optional: set lifecycle rule to expire old versions after 30 days
+mc ilm rule add local/openfarm --noncurrent-expire-days 30
+```
+
+**What versioning protects:**
+- `cogs/{org}/{field}/{date}/ndvi.tif` — NDVI raster layers (re-processable but slow)
+- `photos/{org}/{uuid}.{ext}` — Scouting observation photos (not recoverable)
+- `basemap/` — PMTiles basemap (re-downloadable)
+
+### WAL Archiving (Point-in-Time Recovery)
+
+For production deployments requiring point-in-time recovery (PITR), enable PostgreSQL WAL archiving.
+
+**1. Create archive directory:**
+
+```bash
+sudo mkdir -p /opt/openfarm/wal-archive
+sudo chown 999:999 /opt/openfarm/wal-archive  # postgres container UID
+```
+
+**2. Add PostgreSQL config overrides** — create `deploy/postgresql.conf`:
+
+```ini
+# WAL archiving for PITR
+wal_level = replica
+archive_mode = on
+archive_command = 'cp %p /var/lib/postgresql/wal-archive/%f'
+archive_timeout = 300
+```
+
+**3. Mount in Docker Compose** — add to `docker-compose.prod.yml` db service:
+
+```yaml
+db:
+  volumes:
+    - ./deploy/postgresql.conf:/etc/postgresql/conf.d/wal.conf:ro
+    - /opt/openfarm/wal-archive:/var/lib/postgresql/wal-archive
+  command: >
+    postgres
+    -c config_file=/etc/postgresql/postgresql.conf
+    -c include_dir=/etc/postgresql/conf.d
+```
+
+**4. Point-in-Time Recovery procedure:**
+
+```bash
+# Stop the application
+sudo docker compose down
+
+# Create base backup
+sudo docker compose exec db pg_basebackup -U openfarm -D /tmp/basebackup -Ft -z
+
+# To restore to a specific time:
+# 1. Replace the data directory with the base backup
+# 2. Create recovery.signal file
+# 3. Set recovery_target_time in postgresql.conf:
+#    recovery_target_time = '2026-02-15 14:30:00 UTC'
+#    restore_command = 'cp /var/lib/postgresql/wal-archive/%f %p'
+# 4. Start PostgreSQL — it will replay WAL up to the target time
+
+sudo docker compose up -d
+```
+
+**WAL archive maintenance:**
+
+```bash
+# Check archive size
+du -sh /opt/openfarm/wal-archive/
+
+# Prune WAL files older than the oldest base backup (manual)
+# Keep at minimum 7 days of WAL for PITR window
+find /opt/openfarm/wal-archive/ -name "*.gz" -mtime +7 -delete
 ```
 
 ### Restart a Service

ROADMAP.md

@@ -8,7 +8,9 @@ This document outlines where OpenFarm is today and where it's headed. If you'd l
 
 ## Current Status
 
-OpenFarm is in **early alpha**. The core platform (auth, org management, farm/field CRUD, and NDVI monitoring pipeline) is functional end-to-end.
+OpenFarm **Phase 1 MVP is complete**. The platform delivers end-to-end satellite-powered crop intelligence: auth, org management, farm/field CRUD, NDVI monitoring pipeline, alerts, scouting observations, shareable field health reports, and production-grade security hardening — all functional and deployed.
+
+**179 of 182 tasks complete (98%).** The only remaining items are automated testing (API, frontend, E2E).
 
 ---
 
@@ -21,14 +23,13 @@ OpenFarm is in **early alpha**. The core platform (auth, org management, farm/fi
 - [x] RBAC system (`owner` / `admin` / `member` / `viewer`)
 - [x] MapLibre base map with PMTiles + 4 style options
 - [x] Health checks across all services
-- [x] Structured logging (structlog)
-- [x] CI pipeline (ESLint, TypeScript, ruff)
+- [x] Structured logging (structlog + pino)
 
 ## Milestone 1 — Org, Farm & Field Management ✅
 
 - [x] Org CRUD — create, rename, member management, invites, audit log
 - [x] Farm CRUD — create, edit, soft-delete, list with pagination
-- [x] Field CRUD — draw polygon on map, edit vertices, GeoJSON/KML import
+- [x] Field CRUD — draw polygon on map, edit vertices, GeoJSON import
 - [x] Auto area calculation (hectares, geodesic)
 - [x] Dashboard with org stats and quick actions
 - [x] i18n support (English + Spanish)
@@ -40,33 +41,31 @@ OpenFarm is in **early alpha**. The core platform (auth, org management, farm/fi
 - [x] NDVI pipeline: STAC search → band download → NDVI computation → COG → MinIO
 - [x] Zonal statistics (mean, median, min, max, stddev, p10, p90)
 - [x] TiTiler tile serving with JWT auth
-- [x] NDVI tile overlay on map
+- [x] NDVI tile overlay on map with floating legend
 - [x] Time-series chart (Apache ECharts) with percentile bands
 - [x] Alert rules: `ndvi_drop` (15% drop) and `ndvi_threshold` (below 0.3)
 - [x] Job progress tracking with 7-step sub-status
 
-## Milestone 3 — Alerts, Scouting & Sharing 🔧 In Progress
-
-Backend APIs are complete. Frontend UI is the remaining work.
-
-- [x] Alerts API (list, filter by field/farm/status, close/reopen)
-- [ ] **Alerts UI** — list alerts with severity badges, close/acknowledge actions
-- [ ] **Alerts on farm dashboard** — summary of active alerts across fields
-- [x] Scouting API (CRUD observations with geotagged points, photo upload via presigned URLs)
-- [ ] **Scouting UI** — create/list observations, pin on map, photo upload
-- [x] Share API (create/revoke share links with expiry, public report endpoint)
-- [ ] **Share UI** — create link, copy URL, manage active links
-- [ ] **Public report page** (`/share/[token]`) — map, NDVI snapshot, time-series chart, alerts, scouting notes
-
-## Milestone 4 — Polish, Security & QA ⬜ Planned
-
-- [ ] Viewer role enforcement (read-only for viewer members)
-- [ ] Audit log UI in settings page
-- [ ] Floating NDVI legend on map
-- [ ] Pagination consistency across all list endpoints
-- [ ] Frontend structured logging (pino)
-- [ ] Celery worker health check in Docker Compose
-- [ ] Backup/restore documentation (pg_dump, MinIO versioning)
+## Milestone 3 — Alerts, Scouting & Sharing ✅
+
+- [x] Alerts API + UI — list with severity badges, close/acknowledge, notification badges
+- [x] Alerts page with field/farm/status filters
+- [x] Scouting API + UI — create/list observations, pin on map, photo upload via presigned URLs
+- [x] Scouting observations as interactive map markers
+- [x] Share API + UI — create/revoke share links with expiry, copy URL
+- [x] Public report page (`/share/[token]`) — map, NDVI snapshot, time-series chart, alerts, scouting notes
+
+## Milestone 4 — Polish, Security & QA ✅
+
+- [x] Viewer role enforcement — write endpoints restricted to member+ across all routers
+- [x] Rate limiting (slowapi) — 120 req/min default, tighter limits on jobs and uploads, Redis-backed
+- [x] Pagination consistency — all list endpoints use `PaginatedResponse` envelope
+- [x] Audit log UI in settings page — event icons, search, pagination
+- [x] Frontend structured logging (pino)
+- [x] Celery worker health check in Docker Compose
+- [x] Backup script (`deploy/backup.sh`) — automated daily pg_dump, 7-day retention
+- [x] MinIO bucket versioning documentation
+- [x] WAL archiving / PITR documentation
 - [ ] API unit/integration tests
 - [ ] Frontend component tests
 - [ ] E2E acceptance tests
@@ -116,6 +115,9 @@ These are under consideration but not yet committed. Grouped by theme and roughl
 
 ## How to Contribute
 
-Pick any unchecked item above, or browse [open issues](https://github.com/superzero11/OpenFarm/issues). Milestone 3 frontend tasks are the highest-impact contributions right now.
+The MVP is complete! The highest-impact contributions right now are:
+
+1. **Automated tests** — API integration tests, frontend component tests, and E2E acceptance tests (Milestone 4 remaining items)
+2. **Future Ideas** — pick any item from the list above or browse [open issues](https://github.com/superzero11/OpenFarm/issues)
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for setup and guidelines.

apps/web/src/app/[locale]/(authenticated)/settings/page.tsx

@@ -159,8 +159,8 @@ export default function SettingsPage() {
     const loadMembers = useCallback(async () => {
         if (!currentOrg) return;
         try {
-            const list = await orgsApi.members(currentOrg.id);
-            setMembers(list);
+            const res = await orgsApi.members(currentOrg.id);
+            setMembers(res.items);
         } catch (err) {
             toast.error(t("failedLoadMembers"));
         }

apps/web/src/components/field/ndvi-tab.tsx

@@ -90,15 +90,15 @@ export default function NdviTab({ fieldId, onShowLayer }: NdviTabProps) {
     // ── Load layers + stats ──────────────────────────
     const loadData = useCallback(async () => {
         try {
-            const [l, s] = await Promise.all([
+            const [layersRes, statsRes] = await Promise.all([
                 monitoringApi.layers(fieldId),
                 monitoringApi.stats(fieldId),
             ]);
-            setLayers(l);
-            setStats(s);
+            setLayers(layersRes.items);
+            setStats(statsRes.items);
             // Auto-select latest date
-            if (l.length > 0 && !selectedDate) {
-                setSelectedDate(l[l.length - 1].date);
+            if (layersRes.items.length > 0 && !selectedDate) {
+                setSelectedDate(layersRes.items[layersRes.items.length - 1].date);
             }
         } catch {
             // silent — may simply have no data
@@ -373,7 +373,7 @@ export default function NdviTab({ fieldId, onShowLayer }: NdviTabProps) {
                     </CardHeader>
                     <CardContent className="px-3 pb-3 pt-0">
                         <div className="space-y-1 max-h-36 overflow-y-auto">
-                            {[...layers].reverse().map((layer) => {
+                            {layers.map((layer) => {
                                 const isSelected = layer.date === selectedDate;
                                 const stat = stats.find((s) => s.date === layer.date);
                                 return (

apps/web/src/lib/api.ts

@@ -278,7 +278,7 @@ export const orgsApi = {
     get: (orgId: string) => apiFetch<OrgDetail>(`/orgs/${orgId}`, { orgId }),
     create: (name: string) => apiFetch<Org>("/orgs", { method: "POST", body: JSON.stringify({ name }), skipOrg: true }),
     update: (orgId: string, name: string) => apiFetch<Org>(`/orgs/${orgId}`, { method: "PATCH", body: JSON.stringify({ name }), orgId }),
-    members: (orgId: string) => apiFetch<Member[]>(`/orgs/${orgId}/members`, { orgId }),
+    members: (orgId: string) => apiFetch<Paginated<Member>>(`/orgs/${orgId}/members`, { orgId }),
     changeMemberRole: (orgId: string, userId: string, role: string) =>
         apiFetch(`/orgs/${orgId}/members/${userId}`, { method: "PATCH", body: JSON.stringify({ role }), orgId }),
     removeMember: (orgId: string, userId: string) =>
@@ -332,9 +332,9 @@ export const fieldsApi = {
 
 export const monitoringApi = {
     layers: (fieldId: string, type = "NDVI", limit = 50) =>
-        apiFetch<RasterLayer[]>(`/fields/${fieldId}/layers?type=${type}&limit=${limit}`),
+        apiFetch<Paginated<RasterLayer>>(`/fields/${fieldId}/layers?type=${type}&limit=${limit}`),
     stats: (fieldId: string, type = "NDVI", limit = 200) =>
-        apiFetch<FieldStat[]>(`/fields/${fieldId}/stats?type=${type}&limit=${limit}`),
+        apiFetch<Paginated<FieldStat>>(`/fields/${fieldId}/stats?type=${type}&limit=${limit}`),
 };
 
 // ── Jobs ─────────────────────────────────────────────────────────────