Prevent arbitrary lines from being POST-ed and stored in DocumentDB for a user.

Consider an "advanced" feature to allow a user to view their own account data.

The favourite line count updating from JavaScript has been broken.

Tidy up the page header so it looks better on the desktop in terms of text and so that the brand icon is aligned correctly.

Fix sessions being logged out too often/soon.

When the application is re-deployed, user sessions are terminated.

This is because no data protection storage is configured, meaning that session keys are stored in memory, thus they are lost when the process is restarted.

Data protection needs to be configured, along with an appropriate external key ring provider (as described here), so that material can be decrypted across App Service instances in different locations/slots.

Consider changing the homepage title when logged-in to "Line Preferences" to stop the title wrapping on mobile.

Wrap calls to DocumentDb and the TfL API with Polly for resiliency.

Fix mobile scrolling by removing the minimum height CSS rule for the body content.

Fix the sourcemaps so they map directly to the generated TypeScript files.

This StackOverflow answer hopefully holds the key. It probably means converting to Gulp fully and abandoning dotnet bundle though.

When trying to make en-US vs en-GB localisation work (favorite vs. favourite), the en-GB resources were never used for some reason.

Need to work out why this is and fix it so can properly localise based on the supported English Alexa localisations.

Create appropriate icons for Chrome, Safari, Windows etc. (i.e. favicon.ico) from the London Travel logo for use in the site.

Add a createdDate field to users.

It appears that the Facebook setup for authentication needs "publishing" so that arbitrary users (i.e., not admins like me) can sign-in with it.

Store non-standard claims from external services (e.g. Twitter screenname) in the service to add to the principal when users sign in.

Add options to configure, then implement, a client to call the TfL API to get line names and stops.

Need to check that the content in error.html is up-to-date for the latest styling etc.

Implement RFC-6749 section 4.2.2.1 correctly for handling authorisation errors during Alexa account linking.

Setup continuous build, test and deployment to Azure.

The AlexaController class emits incorrect log messages when linking an account due to a missing ! when testing if the signed-in user already has an Alexa access token.

Investigate using TypeScript for the more complicated JavaScript (e.g. for the /and /manage pages) instead of vanilla JavaScript.

Allow the user to persist their line and, optionally their station, preferences in the companion site.

This will then enable functionality for the skill to find the preferences for the linked account for their commute (martincostello/alexa-london-travel#9).

Add a link that redirects the user to the skill on amazon.co.uk so they can install the skill.

Write proper content for the Terms and Conditions page.

Only verify that the DocumentDb database and collection exist on first use, instead of for every request.

Fix the modals not loading when signing in and removing linked accounts.

Using the approach described here, investigate adding Selenium tests for testing the UI when hosted in Kestrel for the integration tests.

That could also be extended for DVTs as part of deployment.

Add an API endpoint that can be called from the skill using the authorization token associated with the linked account to allow the skill to get the user's line/station preferences for use with martincostello/alexa-london-travel#9.

If a user denies access to any social login provider, the site should handle that gracefully, rather than showing the HTTP 500 error page.

Handle trying to link a social account for one account when it has already been linked to another.

Setup resources (development and production) in Microsoft Azure to host the site.

Write the content for the /help page.

When a user is signing-in and permission is denied, redirect them back to the page they came from.

Change the Authorization URL in the Alexa skill configuration in the Amazon Developer Portal set up for #4 to point at the production instance instead of development.

• Allow a user to see if they are linked to Alexa or not from the /manage page.
• Allow a user to delete the Alexa link/token.

As well as to make testing easier, add a "delete account" button to /manage so a user can purge all their data from the application if they wish to.

Stop the /account/sign-in page from being accessible if the user is already signed-in.

As originally envisaged by #5, add infrastructure to support allowing a user to save their favourite station for their home and work commute for use with martincostello/alexa-london-travel#8 and martincostello/alexa-london-travel#28.

Enable account linking from Alexa.

Requirements will include:

• Authorization URL
• Client Id
• Domain list
• Scope(s)
• Redirect URL(s)
• Authorization Grant Type (Implicit Grant)
• Privacy Policy URL
• Message for the user if they have not linked their account yet.

Add a /support page with appropriate content.

Going to /help would redirect to the support page.

Fix the appearance of the Alexa unlock button on mobile as it appears white instead of grey.

Use resource file for text, where possible, mainly just to ensure text is consistent.

Write proper content for the Privacy Policy page.

Separate the registration and sign-in pages to allow them to be presented more clearly to users.

In the testing for #4, it was found that not all of the external authentication services worked when used from the Alexa app to sign-in. These should be fixed, or at least it determined why they don't work.

For example, Google actively disallows its use in embedded browsers so cannot be used at all.

• GitHub
• Microsoft
• Twitter

Fix the favicon not being used on Chrome on iOS.

Enable social login so that no authentication/authorization infrastructure needs managing by the application itself beyond any secret keys required to setup social login.

Enable support for login/linking via:

• Amazon
• Facebook
• GitHub
• Google
• Microsoft
• Twitter
• Account linking

Ideally receive enough permissions/scopes to get first name and email address.

Put the logo after the brand name, it looks better once the image lazy-loads in.

Add GA events for all user interactions (button clicks, link clicks etc.).

See here.