# Absurdities NG - features and decisions

## Delivered in Phase 1
**Member accounts.** Register with email and/or phone (Nigerian formats normalised to +234), unique username, display name,
optional state. Sign in with username, email or phone. Password reset by email. Email verification. Rate limits and a
honeypot on registration. Suspended or banned members cannot sign in.
**Custom usernames and URLs.** `/users/{username}`; 3-30 characters (letters, numbers, underscore); live availability check with
suggestions; reserved words blocked (login, admin, shop, etc.); change allowed every 30 days; the old URL redirects for 90 days.
**Two-factor authentication.** TOTP (any authenticator app) plus 10 single-use recovery codes. Optional for members, who see a
persistent reminder banner until they enable it; compulsory for advertisers and for every staff account. Passwords are required
to disable it or regenerate codes. A code cannot be reused within its 30-second window.
**Staff panel** at cytadel.absurdities.ng with its own login and session. Roles: Admin (maximum 2; the first is the undeletable
Super Admin), Manager, Supervisor, Finance Officer, Ad Reviewer, Legal & Takedown Officer. Only the Super Admin can create,
suspend or delete the second Admin. Managers manage Supervisors only. Temporary passwords are shown once and must be changed.
Lockout after repeated failures, optional per-person IP allowlist, session ends if the password changes or the account is suspended.
**Undo delete.** Deleting a staff account shows an Undo button for about 10 seconds, and the account stays restorable from
"Recently deleted" for 90 days (30 days for members when member deletion arrives), then a nightly job removes it for good.
**Audit log.** Every sensitive action is recorded; the database refuses edits or deletions of log rows.
**Database.** The whole platform's tables (posts, Champions, groups, CMS and themes, ads, shop, notifications, search, Sniffer,
RSS pings and more) already exist and are tested, so later phases only add code.

## Decisions on record
Anonymous posting is always available; identity is stored encrypted and each look-up is logged. Reactions are Support,
Needs evidence, Not an absurdity (no dislike). Champion claims move through claimed, in progress, fix reported, resolved.
Ads and profit-sharing are two separate switches, both OFF at launch; external ads (e.g. AdSense) fill only when no direct ad matches.
Social auto-posting uses official accounts only and only after approval. Search is open to everyone and never exposes hidden,
pending or anonymous-author data. Shop is off by default; print-on-demand and pre-orders first, stocked inventory later; Paystack.

## Not in Phase 1 (planned order)
2: posts, media, locations, moderation, anonymity, reactions, comments, search, share buttons.
3: Champions, groups, theme engine. 4: CMS/SEO, hero editor, RSS and pings, push, admin screens for feature switches.
5: analytics, ads, revenue share, shop. 6: Flutter app (may move earlier: Android camera capture is core).