It should be possible to login using a physical 2FA token or smartphone passkey via: hardware tokens: - https://yubikey.com/ - https://www.nitrokey.com/#comparison - https://solokeys.com/ passkeys: - passkey overview https://www.tomsguide.com/news/what-are-passkeys & https://arstechnica.com/information-technology/2022/10/passkeys-microsoft-apple-and-googles-password-killer-are-finally-here/ - https://support.apple.com/guide/iphone/sign-in-with-passkeys-iphf538ea8d0/ios - https://developers.google.com/identity/passkeys - fido summary https://fidoalliance.org/passkeys/ This is especially useful for admin accounts, or customer organisational admins. There is significant increase in attacks on sites, where the website is spoofed, and the TOTP style token stolen in real time. The only trusted defence against this is physical h/w tokens and/or webauthn support. update: https://github.com/liveshowy/webauthn_components is making great progress.

Similar to https://livebook.dev/ and https://tiptap.dev/ which enables users to enter rich text that can be used to build blogs/wikis ( with collaboration ). *Supported in `editor_js` implementation

Show active users to admins by using Phoenix Presence (https://hexdocs.pm/phoenix/Phoenix.Presence.html).

Admins usually want to see KPIs in a visual format - display charts using live view - components for displaying stats

In many apps, it is common to have persistent notifications for purposes like a new event/message, missing billing info, unpaid invoices, incomplete profile, etc. These notifications usually manifest themselves with a few features: (1) a notifications menu option with a superscript badge to show that there are unread/new notifications (2) a dropdown from the menu to show a list of notifications (3) archivable/dismissable notifications (4) A component for Flash-like messages with call-to-action buttons, e.g., for important pending tasks like providing billing info. (5) Some such notifications might be dismissable, others not.

API Account tokens, Swagger / OpenAPI Specification

Add a "hamburger" icon to sidebar layout so when you toggle it, the sidebar collapses to show only the menu icons, rather than the menu icon plus the textual description of the menu item. This way, the main content area can be wider if you have a lot of columns to display. Thanks!

Be able to provide option for SAML single sign-on authentication (SSO) between the app (a service provider) and an identity provider.

Support authentication with Passkeys

As of v1.5.0, test coverage is rated at 52.2%. Improving test coverage would be easier for maintainability-minded devs and managers. Gist of coverage results: https://gist.github.com/Rio517/c16d8b82ad62e743a8601537389cfc0f

Ability to create announcements / changelog updates for users. New updates appear in the navbar with a little red dot and the number of new unread announcements. Use https://changelog.announcekit.app as inspiration.

Create content with markdown and display it. Support code blocks and make it easy to add images. Take inspiration from https://fly.io/phoenix-files for the look and feel of a blog posts page.

Any component we make will be added to the Figma design kit to allow easy screen design mockups.

It would be great to have the ability to take membership payments from users/members out of the box. This would complete the experience from sign up to purchase.

A combination of a search and select input implemented in a live view. See https://tailwindui.com/components/application-ui/forms/comboboxes.

Make it possible (if possible) to upgrade Petal versions more easily, then make the service a subscription, so we can continue to get the benefits in our apps. I know this would be hard, but as a solo developer, being able to leverage the improvements in Petal would be huge.

A component that gives you a sortable, filterable and paginated table out of the box.

Add an optional 2FA layer (using nimble_totp?) to the auth login flow, so people can opt to use the 2FA app of their choice (Google Authenticator, Authy, LastPass, etc.).

A common practice is to have a personal account but then also be a part of an organisation or company. - organisation schema - an org can have multiple users - a user can have an admin role in the org - org admins can invite more users, or remove them - an org can have a Stripe payment method

Enable S3 uploads to an authenticated bucket. The current implementation of S3 enables read/write to S3 without dependencies but uses a method that forces the access control list read access permission to be completely open, enabling anyone to view bucket contents without authenticating.

Tigris is a globally distributed S3-compatible object storage service natively integrated with Fly.io. Tigris runs on Fly.io hardware and is fully integrated with flyctl. See https://www.tigrisdata.com/ It would be cool to for instance have things like delete of the uploaded image on change or removal of the avatar.

Today Claude Code, Cursor, Antigravity, Warp, etc... had their place in most developer's stack, it would be good if you write a doc helping this agent to work with your boilerplate. For global framework's side instruction, you can copy paste the Phoenix 1.8 AGENTS.md file, and just add Petal specific instruction, like using petal.gen.live instead of phx.gen.live, how to add component in layout sidebar, how to use org layouts in pages, etc etc...

It would be nice to have the chat history stored. Similar to how it is done with ChatGPT/etc.

Implement user avatars and store them on Cloudinary (cloudinary.com) - a storage service that allows you to resize/modify images simply by altering the URL. This means you don't need to use a tool like ImageMagick to resize/crop/compress your images.

Give an example of a file upload using LiveView and S3.

Add the ability to "impersonate" another a user in the application as a super admin. (ex: (ex: https://github.com/ankane/pretender)) This would allow the developer to debug and trouble shoot production issues more easily.

Convert sign up and register pages to live view.

Support CloudFlare R2 for file uploads, similar to the current support for S3 and Cloudinary.

It's pretty easy to set up the app to use UUID by default for ids and foreign keys, however, there are places in the code that break, for example, HashId. I'm removing the HashId.encode/decodes but I'm not sure if that is "safe"? It'd be nice if the code supported UUID or ints in these places out of the box. What I've found so far: 1. HashId 2. Passing the ID into an Echo Query (user_id = user_id |> Ecto.UUID.dump!())

Resend bills itself as "The best API to reach humans instead of spam folders. Build, test, and deliver transactional emails at scale." https://resend.com/

Upgrade Petal Pro to Phoenix 1.7

Handy for easy sign up/log in

It would be great to add a petal.gen.html generator to generate controller, views, and context for an HTML resource using Petal Components. Petal Components can be used in regular HEEx templates and not everything should be a LiveView.

A user can register/sign in with just their email address - they get sent a 4 digit code to enter.

Same as phx.gen.live but the templates output uses Petal Pro's layouts and the form components from Petal Components

Add a working dockerfile and ensure all the config is correct for fly.io deployments right off the bat

Use gettext in non-admin areas.

As described in this blog article: https://fly.io/phoenix-files/make-your-liveview-feel-faster/

Make it easy to create background jobs with the state saved in your db

Version 2.0.0 was released on 23rd Aug 2022 https://github.com/tailwindlabs/heroicons/releases/tag/v2.0.0 and has a bunch of new icons, renames etc. It would be nice to migrate to it. Until then, the link at https://petal.build/components/heroicons should be updated to https://v1.heroicons.com/ to avoid confusion.

Components can be annoying to type with the dot syntax <.blah>. It would be nice to have snippets like button => <.button label="" />