# Milestone 02: Workflow Core and Hardening

## Implemented in this milestone
- Documentation/config fixes from Milestone 01 review.
- Authorization context with roles, permissions and forced password-change state.
- Authenticated password change endpoint.
- Admin user listing, role assignment and ban/unban endpoints.
- Report ownership workflow with assigned operator and take endpoint.
- Valid report status transitions.
- Citizen report filters scoped to own reports.
- Report media upload validation and metadata storage.

## To do next
- Add broader API tests once the frontend contracts stabilize.
- Add notification delivery for status changes.
- Add moderation flow for abusive reports/messages.
- Add open-data exports and statistics refinements.
- Design CIE/SPID integration.