# BillMinder Publishing Checklist

This checklist is based on the current local files. Items marked "appears done" are wired in the app code, but still need dashboard testing before public launch.

## Current File Status

- Appears done: Supabase project URL and anon key are set in `supabase-config.js`.
- Appears done: Supabase project ref is `cmpmnjgpugmkfrgearkx`.
- Appears done: Google Calendar OAuth client ID is built into `app.js` and `main.js`.
- Appears done: The app no longer asks users to paste a Google OAuth client secret.
- Appears done: Stripe checkout, Stripe webhook, checkout return, billing portal, and contact email Edge Function code exists.
- Appears done: Plus and Premium checkout code supports Stripe price IDs and first-month coupon IDs through Supabase secrets.
- Needs rebuild: `dist/BillMinder-darwin-x64/BillMinder.app` is currently missing from the project folder. Rebuild before final release.
- Exists: `download-site/downloads/BillMinder-mac.zip` exists and contains a packaged BillMinder app.

## 1. Supabase

Already wired in files:

- `supabase-config.js` points to `https://cmpmnjgpugmkfrgearkx.supabase.co`.
- `supabase-schema.sql` exists for the database tables and Row Level Security.
- Edge Function source exists for:
  - `create-checkout-session`
  - `stripe-webhook`
  - `checkout-return`
  - `create-billing-portal-session`
  - `contact-email`

Still confirm in Supabase dashboard:

1. Confirm `supabase-schema.sql` has been run in the production project.
2. Confirm Row Level Security is enabled and working.
3. Confirm Email Auth is enabled.
4. Confirm these functions are deployed:
   - `create-checkout-session`
   - `stripe-webhook`
   - `checkout-return`
   - `create-billing-portal-session`
   - `contact-email`
5. Confirm these secrets exist:
   - `STRIPE_SECRET_KEY`
   - `STRIPE_PLUS_PRICE_ID`
   - `STRIPE_PREMIUM_PRICE_ID`
   - `STRIPE_PLUS_COUPON_ID`
   - `STRIPE_PREMIUM_COUPON_ID`
   - `STRIPE_WEBHOOK_SECRET`
   - `BILLMINDER_CHECKOUT_SUCCESS_URL`
   - `BILLMINDER_CHECKOUT_CANCEL_URL`
   - `BILLMINDER_PORTAL_RETURN_URL`
   - `SMTP_HOST`
   - `SMTP_PORT`
   - `SMTP_USER`
   - `SMTP_PASS`
   - `SMTP_FROM`
   - `CONTACT_TO`
6. Test account creation, sign-in, sign-out, and cloud sync.
7. Test that one signed-in user cannot read another user's workspace.
8. Test the contact form sends an email.

## 2. Stripe

Already wired in files:

- Plus checkout uses `STRIPE_PLUS_PRICE_ID`.
- Premium checkout uses `STRIPE_PREMIUM_PRICE_ID`.
- Plus checkout can apply `STRIPE_PLUS_COUPON_ID`.
- Premium checkout can apply `STRIPE_PREMIUM_COUPON_ID`.
- Webhook updates BillMinder billing records after Stripe confirms subscriptions.
- Billing portal code exists for subscription management.

Still confirm in Stripe dashboard:

1. Keep test mode on until the whole app works end to end.
2. Confirm Plus product and price exist.
3. Confirm Premium product and price exist.
4. Confirm the Plus first-month coupon exists.
5. Confirm the Premium first-month coupon exists.
6. Confirm the webhook endpoint points to:
   `https://cmpmnjgpugmkfrgearkx.supabase.co/functions/v1/stripe-webhook`
7. Confirm the webhook listens for:
   - `checkout.session.completed`
   - `customer.subscription.created`
   - `customer.subscription.updated`
   - `customer.subscription.deleted`
   - `invoice.payment_failed`
8. Run a Plus checkout test.
9. Run a Premium checkout test.
10. Confirm the user's plan changes in BillMinder only after the webhook succeeds.
11. Confirm Manage Subscription opens the Stripe billing portal.
12. When ready for launch, switch from Stripe test keys/prices/coupons/webhook to live mode values and update Supabase secrets.

## 3. Google Cloud

Already wired in files:

- Google Calendar scope is:
  `https://www.googleapis.com/auth/calendar.events`
- OAuth client ID currently used by the app:
  `393333500538-cna49rjj7op0imp0igo0dpen1bmlgu6j.apps.googleusercontent.com`
- Calendar events are created, updated, and deleted from the desktop app.

Still confirm in Google Cloud:

1. Confirm the Google Calendar API is enabled.
2. Confirm the OAuth consent screen uses the public BillMinder name.
3. Confirm support email and developer contact email are correct.
4. Confirm the OAuth client ID above belongs to the BillMinder Google Cloud project.
5. Keep the OAuth app in testing until Calendar sync works for test users.
6. Add test users while the OAuth app is in testing.
7. Test connect, sync, auto-sync, disconnect, and event deletion.
8. Before public release, submit Google OAuth verification if Google requires it for non-test users.

## 4. macOS App Release

Already done for testing:

- The app can be packaged with `npm run package:mac`.
- A downloadable zip exists at `download-site/downloads/BillMinder-mac.zip`.

Still needed for a real public release:

1. Rebuild the packaged app:
   `npm run package:mac`
2. Create a valid `assets/billminder.icns` icon.
3. Update the packaging script to use the `.icns` icon.
4. Enroll in the Apple Developer Program if not already done.
5. Sign the app with a Developer ID Application certificate.
6. Notarize the app with Apple.
7. Staple the notarization ticket.
8. Create a final zip or DMG.
9. Put the final notarized file in `download-site/downloads/`.
10. Test the final download on a clean Mac or clean macOS user account.

Without Developer ID signing and notarization, users can download the app, but macOS may show an "unknown developer" or "Apple cannot check it" warning.

## 5. Download Website

Already done in files:

- Basic static site exists in `download-site`.
- Download page points to `downloads/BillMinder-mac.zip`.
- Logo exists at `download-site/assets/billminder-logo.png`.

Still needed:

1. Keep these files together:
   - `download-site/index.html`
   - `download-site/styles.css`
   - `download-site/assets/billminder-logo.png`
   - `download-site/downloads/BillMinder-mac.zip`
2. Publish the whole `download-site` folder to a web host.
3. Test the public download link from the hosted URL.
4. Submit the public URL to Google Search Console if you want it to appear on Google Search.

## 6. Final App Tests

Before launch, test:

1. Signed-out public pages.
2. Create account.
3. Sign in.
4. Cloud sync.
5. Free plan limits.
6. Plus checkout.
7. Premium checkout.
8. Stripe webhook plan updates.
9. Billing portal.
10. Google Calendar connect and sync.
11. Google Calendar disconnect.
12. Bill deletion with linked Calendar event deletion.
13. Contact form delivery.
14. Export and Premium-only features.
15. Download website button.
16. Installing the downloaded Mac app into Applications.

## 7. Legal And Support

Still needed before public launch:

1. Review Privacy Policy.
2. Review Terms & Conditions.
3. Review account/data deletion language.
4. Confirm support email.
5. Confirm whether launch is United States only.
6. If optional cookies or analytics are added later, add a real cookie preference flow.
