# v2.0 Research Summary

**Date:** 2026-05-15

## Stack Additions

- Add `golang.org/x/oauth2` and a small internal provider verification layer for Google/Apple.
- Keep server-managed sessions as the only Xtablo session mechanism.
- Use Postgres tables for social identities, messages, etapes, and events.
- Implement real-time chat as SSE receive + HTMX POST send for v2. This satisfies real-time updates with less client complexity than WebSockets.

## Feature Table Stakes

- Google and Apple sign-in both validate provider identity, then create/link a local user and issue the existing session cookie.
- Each tablo has a persistent message stream with authenticated posting and real-time updates.
- Etapes group tasks one level deep: task -> optional etape; etapes have no parent.
- Events belong to tablos and appear both in tablo context and in each user's planning page.

## Watch Outs

- OAuth state/nonce and ID token validation are non-negotiable.
- Provider subject is the durable identity key; email alone is insufficient.
- Apple profile data can be first-login-only.
- Real-time delivery must be separate from message durability.
- SSE/proxy buffering and keep-alives need manual verification.
- Event authorization must follow tablo access.

## Sources

- Google OpenID Connect: https://developers.google.com/identity/openid-connect/openid-connect
- Google OAuth 2.0 web server flow: https://developers.google.com/identity/protocols/oauth2/web-server
- Apple token validation: https://developer.apple.com/documentation/SigninwithAppleRESTAPI/Generate-and-validate-tokens
- Apple authorization request: https://developer.apple.com/documentation/signinwithapplerestapi/request-an-authorization-to-the-sign-in-with-apple-server.
- Apple client secret creation: https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret
- MDN Server-sent events: https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events
- MDN WebSocket API: https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API
