# Requirements coverage matrix

| Requirement | Implementation |
|---|---|
| Public landing page | Existing UI retained; major copy sections CMS-driven; recruiting studies and recent news loaded from API |
| `/news/` | Published news API + dynamic listing/detail frontend, filters/pagination-ready |
| `/about-us/` | CMS hero/content integration with existing page layout |
| `/locations/` | API-driven locations, filters, detail pages, Leaflet maps and clinic structured data |
| `/join-a-study/` | API-driven study search/filter; guest application; selected-clinic questionnaire; consent |
| Careers | Public openings + guest application/CV upload; admin job/application tracking |
| Responsive/accessibility | Existing responsive UI retained; form labels, loading/error states and keyboard-capable controls added to integrated flows |
| SEO | Metadata defaults, CMS SEO fields, canonical routes, robots, dynamic sitemap, organisation/clinic structured data |
| Admin login | Stateful Sanctum session, CSRF, password reset, optional TOTP 2FA |
| RBAC | Six requested system roles + permission matrix + optional clinic scope per user-role assignment |
| Dashboard metrics | Recruiting studies, new leads, screenings, enrolled participants, recruiting clinics, completed studies |
| Dashboard visualisations | Recruitment trends, top studies, leads by clinic, region recruitment, recruitment pipeline, activity/content updates |
| Study creation | BIO protocol sequence, abbreviation, therapeutic area text field, full title, image, status, clinics, protocol text, dates, target |
| Study Builder | Rich content, inclusion/exclusion criteria, clinic recruitment config, recruitment flow, questionnaires, protocol leads, publish toggle |
| Target automation | Enrollment/completion count checked after status changes; target notifications and optional auto-close-to-enrolling |
| Participants | Search/filter, status updates, profile, contact data, permitted study history, screening notes, questionnaire responses |
| Consent forms | Private PDF storage + authorized upload/download endpoints and participant profile UI |
| Locations | UK/US clinic CRUD, details/status/map coordinates, team assignment and recruitment settings |
| CMS | Pages/sections, rich text, media library, SEO, schedule, version increment, section edit/delete |
| Careers admin | Posting CRUD, location/job type/deadline/status, applications, status tracking, private CV download |
| News admin | Article CRUD, image, rich content, author/location/category/tags, publish status/date, SEO |
| Users/roles | User CRUD, role/location assignment, role CRUD/custom permissions |
| Site settings | General, SMTP, notification templates, recruitment, privacy, analytics, integrations |
| Email notifications | Queued HTML notifications for study applications, careers, contact, password reset and target reached |
| Future CRM/EMR | Durable `integration_events` outbox for recruitment events; vendor integration can be added without API/schema redesign |
| Data retention | `retention_until` + configurable default years; destructive automation intentionally disabled pending approved policy |
| External analytics | First-party CTMS analytics active; optional analytics ID setting reserved, no third-party tracking forced by default |
| Security hardening | CSRF/session auth, location scoping, rate limits, HTML sanitization, private documents, encrypted SMTP password, audit trail, concurrency guards |