RTSport — Product Roadmap & State of the Build

2026-05-08 | Compiled by Wadsworth 📋

Current Architecture (what actually exists)

Layer 1: RTSport Standalone API (port 8001)

Status: ✅ Core backend built and running

Location: ~/.openclaw/shared/build-20260501/backend/
Framework: FastAPI + SQLAlchemy
Database: SQLite (rtsport_test.db) with PostgreSQL migration path
Auth: JWT with role-based access (at/coach/parent/admin)

25 live endpoints, role-based access control enforced.

Layer 2: HoffDesk Proxy Layer (port 8000)

Status: ✅ Partial proxy with mock fallbacks

Location: ~/.openclaw/workspace-socrates/hoffdesk-api/

Layer 3: Frontend (served as static files)

Status: ✅ All role dashboards built

The Two Systems Problem

Right now RTSport runs as two parallel systems:

User → https://hoffdesk.com/rtsport/coach
  → rtsport_mock.py serves coach/dashboard.html
  → dashboard.html JS calls /api/v1/dashboard/coach/status?school_id=schl_001
  → This routes to rtsport_coach_api.py (IN-MEMORY MOCK DATA)
  → NOT the real RTSport API at port 8001

Meanwhile:
  RTSport API at port 8001 has full CRUD, real DB, role guards
  → But the frontend doesn't call it directly
  → The proxy at port 8000 → 8001 only handles /api/v1/rtsport/* paths
  → Coach/Parent dashboard endpoints are LOCAL_PATHS (not proxied)

Root cause: The coach and parent dashboard API endpoints are deliberately excluded from the proxy (LOCAL_PATHS in rtsport_api_proxy.py) because they have mock implementations in rtsport_coach_api.py and rtsport_parent_api.py. The real API at 8001 has its own /dashboard/coach and /dashboard/parent endpoints, but they're unreachable from the frontend.

Auth State — What Works, What Doesn't

Database: Multi-Tenant Design (already built)

Schema: Single database, school_id on every table
Already implemented in models.py

Scale model:
- 1 database, ~10 tables, school_id column on every query
- SQLite for dev/small deployments (<100 schools), PostgreSQL for production
- Indexed by school_id on every table — fast multi-tenant queries
- JWT encodes school_id so a user can't query another school's data

Seed data gap: Only parent@example.com is seeded in the real database. Coach, AT, and admin accounts exist only in the mock Python dicts.

Blockers & Prioritized Work

🔴 Blocking Go-To-Market

🟡 Needed Before Beta

🟢 Post-Beta / v1.1

Go-To-Market Estimate

What's Done

• ✅ Full database schema with multi-tenant design
• ✅ JWT auth with role-based access (bcrypt, token refresh ready)
• ✅ 25 API endpoints with role guards
• ✅ All 5 role dashboards (AT, Coach, Parent, AD, Login)
• ✅ Mobile-first responsive CSS (~3000 lines)
• ✅ Coach dashboard: status cards, injury breakdown, recovery timeline, athlete messages
• ✅ Parent dashboard: child selector, milestones, restrictions, care team, activity feed
• ✅ AT dashboard: roster view, case management UI
• ✅ AD dashboard: admin stats (mock)
• ✅ Sideline entry form (frontend)
• ✅ Shared components (athlete detail, notifications, timeline)
• ✅ HTTPS via Cloudflare, secure in production posture

What Remains

• 🔴 Unify APIs (1-2 days)
• 🔴 Seed data + auth hardening (1 day)
• 🟡 Wire frontend to real API (2-3 days)
• 🟡 Message persistence (1 day)
• 🟡 Polish + bug fixes (1-2 days)

Timeline Estimate

Immediate Recommended Actions

1. Unify APIs — Remove LOCAL_PATHS exclusion in proxy, have coach/parent dashboards call real port 8001 endpoints. Delete mock coach/parent API files.
2. Seed database — Add coach@, at@, admin@ accounts + 10-15 athletes with real cases to rtsport_test.db.
3. Auth guard — Add 10 lines of JS to each dashboard: if (!getAuthToken()) window.location = '/rtsport/login'
4. Kill auto-login — Remove hardcoded credential block from dashboard HTML files.