# Sprint 3 Scope - PostgreSQL API Conversion

## Goal

Convert PSP Radar from local JSON API behavior to a production-ready shared PostgreSQL API mode.

## Added

- `server.js` wrapper chooses storage mode.
- `server-local.js` keeps the local JSON demo server.
- `server-postgres.js` implements the same API endpoints against PostgreSQL.
- `DATA_MODE=postgres` now makes Public / Portal / Admin use the same `DATABASE_URL`.
- Production refuses to start with local JSON mode.
- JSON-to-PostgreSQL seed script added.
- Default app settings and demo admin seed added to migration.

## Important

Local demo:

```bash
npm start
```

Shared online database mode:

```bash
DATA_MODE=postgres DATABASE_URL=postgresql://... npm start
```

## Converted API groups

- Public `/api/data`
- Admin `/api/admin/data`
- Supplier application submission
- Supplier application review
- Supplier records update/status
- Complaint/evidence submissions
- Complaint review and publish
- News review
- Published complaint review
- Ads by placement
- Users
- Categories / methodology / ad placement settings
- Audit logs

## Still required before final production

- Replace demo plain password comparison with bcrypt/argon2.
- Move base64 images to S3/R2 object storage.
- Add real sessions/JWT and CSRF protection.
- Add automated integration tests using a test PostgreSQL database.
