# OpenFUT Bridge — TODO

## Reverse Engineering
- [ ] #1 Set up mitmproxy and capture a real FIFA 23 FUT session
- [ ] #2 Document all observed endpoints in `docs/endpoint-map.md`
- [ ] #3 Document FIFA 23 auth flow (token format, headers, session lifecycle)
- [ ] #4 Document request body formats for auth, squad, packs
- [ ] #5 Identify which endpoints are mandatory vs optional for FUT to load
- [ ] #6 Test hosts-file redirect approach on PC
- [ ] #7 Research certificate pinning in FIFA 23 PC build
- [ ] #8 Test RPCS3 network proxy configuration
- [ ] #9 Document response formats EA uses (some differ from request format)
- [ ] #10 Identify any binary/protobuf endpoints (most are JSON but verify)

## Proxy
- [x] #11 Add TLS support (self-signed cert) so FIFA 23 connects via HTTPS
       → `TLS_ENABLED=true` generates cert at startup via rcgen; uses tokio-rustls
       → Cert covers localhost, 127.0.0.1, fut.ea.com, utas.mob.v4.fut.ea.com
- [x] #12 Add replay CLI: `openfut-bridge-replay captures/some_file.json [bridge-url]`
       → Accepts single file or entire captures/ directory
       → TLS: danger_accept_invalid_certs=true so self-signed certs work
- [x] #13 Add `DELETE /_bridge/captures` to wipe capture folder
- [x] #14 Add capture deduplication (same method+path within 1 second)
- [ ] #15 Add request diff tool: show what changed between two captures

## Mapper
- [ ] #16 Implement actual auth endpoint mapping (static token response)
- [ ] #17 Map squad read endpoint when confirmed
- [ ] #18 Map pack details endpoint when confirmed
- [ ] #19 Add X-UT-SID session header pass-through to Core
- [ ] #20 Add phishing token passthrough

## Admin UI
- [x] #21 Build a simple web dashboard for viewing captures (`GET /_bridge/admin`)
       → Auto-refreshes every 10s; shows stats, endpoint table, recent captures
- [x] #22 Add endpoint status page (`GET /_bridge/status`)
       → Reports each unique endpoint as mapped/known/unknown
- [x] #23 Add live capture stream via SSE (`GET /_bridge/captures/stream`)
       → `event: capture` events pushed on each new capture
- [ ] #15 Add request diff tool

## Testing
- [x] #24 Add test for placeholder response format
- [x] #25 Add integration test that fires real HTTP at the Bridge
       → 8 new tests: health, placeholder, captures CRUD, status, TLS cert gen