698 lines
22 KiB
Markdown
698 lines
22 KiB
Markdown
# ColaFlow Next Sprint Action Plan
|
|
|
|
**Plan Date**: 2025-11-03
|
|
**Sprint Name**: M1 Sprint 2 - Authentication and Testing Completion
|
|
**Sprint Goal**: Complete M1 critical path with authentication and comprehensive testing
|
|
**Duration**: 2 weeks (2025-11-04 to 2025-11-15)
|
|
|
|
---
|
|
|
|
## Sprint Overview
|
|
|
|
### Sprint Objectives
|
|
|
|
1. Implement JWT authentication system (critical blocker)
|
|
2. Complete Application layer testing to 80% coverage
|
|
3. Implement SignalR real-time notifications
|
|
4. Polish and prepare for deployment
|
|
|
|
### Success Metrics
|
|
|
|
| Metric | Current | Target | Priority |
|
|
|--------|---------|--------|----------|
|
|
| M1 Completion | 83% | 100% | Critical |
|
|
| Application Test Coverage | 40% | 80% | High |
|
|
| Authentication | 0% | 100% | Critical |
|
|
| SignalR Implementation | 0% | 100% | Medium |
|
|
| Critical Bugs | 0 | 0 | Critical |
|
|
|
|
---
|
|
|
|
## Prioritized Task List
|
|
|
|
### Priority 1: Critical (Must Complete)
|
|
|
|
#### Task 1.1: JWT Authentication System
|
|
|
|
**Estimated Effort**: 7 days
|
|
**Assigned To**: Backend Agent + Frontend Agent
|
|
**Dependencies**: None (can start immediately)
|
|
**Acceptance Criteria**:
|
|
- User registration API working
|
|
- Login API returning valid JWT tokens
|
|
- All API endpoints protected with [Authorize]
|
|
- Role-based authorization working (Admin, ProjectManager, Developer, Viewer)
|
|
- Frontend login/logout UI functional
|
|
- Token refresh mechanism working
|
|
- 100% test coverage for authentication logic
|
|
|
|
**Detailed Subtasks**:
|
|
|
|
**Day 1: Architecture and Design** (Backend Agent + Architect Agent)
|
|
- [ ] Research authentication approaches (ASP.NET Core Identity vs custom)
|
|
- [ ] Design JWT token structure (claims, expiration, refresh strategy)
|
|
- [ ] Define user roles and permissions matrix
|
|
- [ ] Design database schema for users and roles
|
|
- [ ] Document authentication flow (registration, login, refresh, logout)
|
|
- [ ] Review security best practices (password hashing, token storage)
|
|
|
|
**Day 2: Database and Domain** (Backend Agent)
|
|
- [ ] Create User aggregate root (Domain layer)
|
|
- [ ] Create Role and Permission value objects
|
|
- [ ] Add UserCreated, UserLoggedIn domain events
|
|
- [ ] Create EF Core User configuration
|
|
- [ ] Generate and apply authentication migration
|
|
- [ ] Write User domain unit tests
|
|
|
|
**Day 3: Application Layer Commands** (Backend Agent)
|
|
- [ ] Implement RegisterUserCommand + Handler + Validator
|
|
- [ ] Implement LoginCommand + Handler + Validator
|
|
- [ ] Implement RefreshTokenCommand + Handler + Validator
|
|
- [ ] Implement ChangePasswordCommand + Handler + Validator
|
|
- [ ] Add password hashing service (bcrypt or PBKDF2)
|
|
- [ ] Write command handler tests
|
|
|
|
**Day 4: API Layer and Middleware** (Backend Agent)
|
|
- [ ] Create AuthenticationController (register, login, refresh, logout)
|
|
- [ ] Configure JWT authentication middleware
|
|
- [ ] Add [Authorize] attributes to all existing controllers
|
|
- [ ] Implement role-based authorization policies
|
|
- [ ] Add authentication integration tests
|
|
- [ ] Update API documentation
|
|
|
|
**Day 5: Frontend Authentication State** (Frontend Agent)
|
|
- [ ] Create authentication context/store (Zustand)
|
|
- [ ] Implement token storage (localStorage with encryption)
|
|
- [ ] Add API client authentication interceptor
|
|
- [ ] Implement token refresh logic
|
|
- [ ] Add route guards for protected pages
|
|
- [ ] Handle 401 unauthorized responses
|
|
|
|
**Day 6: Frontend UI Components** (Frontend Agent)
|
|
- [ ] Create login page with form validation
|
|
- [ ] Create registration page with form validation
|
|
- [ ] Add user profile dropdown in navigation
|
|
- [ ] Implement logout functionality
|
|
- [ ] Add "Forgot Password" flow (basic)
|
|
- [ ] Add role-based UI element visibility
|
|
|
|
**Day 7: Testing and Integration** (QA Agent + Backend Agent + Frontend Agent)
|
|
- [ ] End-to-end authentication testing
|
|
- [ ] Test protected route access
|
|
- [ ] Test role-based authorization
|
|
- [ ] Security testing (invalid tokens, expired tokens)
|
|
- [ ] Test token refresh flow
|
|
- [ ] Performance testing (token validation overhead)
|
|
|
|
**Risk Assessment**:
|
|
- Risk: Authentication breaks existing functionality
|
|
- Mitigation: Comprehensive integration tests, gradual rollout
|
|
- Risk: Password security vulnerabilities
|
|
- Mitigation: Use proven libraries (bcrypt), security review
|
|
|
|
---
|
|
|
|
#### Task 1.2: Complete Application Layer Testing
|
|
|
|
**Estimated Effort**: 3 days (parallel with authentication)
|
|
**Assigned To**: QA Agent + Backend Agent
|
|
**Dependencies**: None
|
|
**Acceptance Criteria**:
|
|
- Application layer test coverage ≥80%
|
|
- All P2 Query Handler tests written (7 test files)
|
|
- All P2 Command Handler tests written (2 test files)
|
|
- Integration tests for all controllers (Testcontainers)
|
|
- 100% test pass rate maintained
|
|
|
|
**Detailed Subtasks**:
|
|
|
|
**Day 1: Query Handler Tests** (QA Agent)
|
|
- [ ] Write UpdateTaskCommandHandlerTests (3 test cases)
|
|
- [ ] Write AssignTaskCommandHandlerTests (3 test cases)
|
|
- [ ] Write GetStoriesByEpicIdQueryHandlerTests (2 test cases)
|
|
- [ ] Write GetStoriesByProjectIdQueryHandlerTests (2 test cases)
|
|
- [ ] All tests passing, coverage measured
|
|
|
|
**Day 2: Query Handler Tests (Continued)** (QA Agent)
|
|
- [ ] Write GetTasksByStoryIdQueryHandlerTests (2 test cases)
|
|
- [ ] Write GetTasksByProjectIdQueryHandlerTests (3 test cases)
|
|
- [ ] Write GetTasksByAssigneeQueryHandlerTests (2 test cases)
|
|
- [ ] Verify all Application layer commands and queries have tests
|
|
- [ ] Run coverage report, identify remaining gaps
|
|
|
|
**Day 3: Integration Tests** (QA Agent + Backend Agent)
|
|
- [ ] Set up Testcontainers for integration testing
|
|
- [ ] Write ProjectsController integration tests (5 endpoints)
|
|
- [ ] Write EpicsController integration tests (4 endpoints)
|
|
- [ ] Write StoriesController integration tests (7 endpoints)
|
|
- [ ] Write TasksController integration tests (8 endpoints)
|
|
- [ ] Write AuthenticationController integration tests (when available)
|
|
|
|
**Risk Assessment**:
|
|
- Risk: Test writing takes longer than estimated
|
|
- Mitigation: Focus on P1 tests first, defer P3 if needed
|
|
- Risk: Integration tests require complex setup
|
|
- Mitigation: Use Testcontainers for clean database state
|
|
|
|
---
|
|
|
|
### Priority 2: High (Should Complete)
|
|
|
|
#### Task 2.1: SignalR Real-time Notifications
|
|
|
|
**Estimated Effort**: 3 days
|
|
**Assigned To**: Backend Agent + Frontend Agent
|
|
**Dependencies**: Authentication (should be implemented after JWT)
|
|
**Acceptance Criteria**:
|
|
- SignalR Hub configured and running
|
|
- Task status changes broadcast to connected clients
|
|
- Frontend receives and displays real-time updates
|
|
- Kanban board updates automatically when other users make changes
|
|
- Connection failure handling and reconnection logic
|
|
- Performance tested with 10+ concurrent connections
|
|
|
|
**Detailed Subtasks**:
|
|
|
|
**Day 1: Backend SignalR Setup** (Backend Agent)
|
|
- [ ] Install Microsoft.AspNetCore.SignalR package
|
|
- [ ] Create ProjectHub for project-level events
|
|
- [ ] Create TaskHub for task-level events
|
|
- [ ] Configure SignalR in Program.cs
|
|
- [ ] Add SignalR endpoint mapping
|
|
- [ ] Integrate authentication with SignalR (JWT token in query string)
|
|
- [ ] Write SignalR Hub unit tests
|
|
|
|
**Day 2: Backend Event Integration** (Backend Agent)
|
|
- [ ] Add SignalR notification to UpdateTaskStatusCommandHandler
|
|
- [ ] Add SignalR notification to CreateTaskCommandHandler
|
|
- [ ] Add SignalR notification to UpdateTaskCommandHandler
|
|
- [ ] Add SignalR notification to DeleteTaskCommandHandler
|
|
- [ ] Define event message formats (JSON)
|
|
- [ ] Test SignalR broadcasting with multiple connections
|
|
|
|
**Day 3: Frontend SignalR Integration** (Frontend Agent)
|
|
- [ ] Install @microsoft/signalr package
|
|
- [ ] Create SignalR connection management service
|
|
- [ ] Implement auto-reconnection logic
|
|
- [ ] Add SignalR listeners to Kanban board
|
|
- [ ] Update TanStack Query cache on SignalR events
|
|
- [ ] Add toast notifications for real-time updates
|
|
- [ ] Handle connection status UI (connected, disconnected, reconnecting)
|
|
|
|
**Risk Assessment**:
|
|
- Risk: SignalR connection issues in production
|
|
- Mitigation: Robust reconnection logic, connection status monitoring
|
|
- Risk: Performance impact with many connections
|
|
- Mitigation: Performance testing, connection pooling
|
|
|
|
---
|
|
|
|
#### Task 2.2: API Documentation and Polish
|
|
|
|
**Estimated Effort**: 1 day
|
|
**Assigned To**: Backend Agent
|
|
**Dependencies**: None
|
|
**Acceptance Criteria**:
|
|
- All API endpoints documented in OpenAPI spec
|
|
- Scalar documentation complete with examples
|
|
- Request/response examples for all endpoints
|
|
- Authentication flow documented
|
|
- Error response formats documented
|
|
|
|
**Detailed Subtasks**:
|
|
- [ ] Review all API endpoints for complete documentation
|
|
- [ ] Add XML documentation comments to all controllers
|
|
- [ ] Add example request/response bodies to OpenAPI spec
|
|
- [ ] Document authentication flow in Scalar
|
|
- [ ] Add error code reference documentation
|
|
- [ ] Generate Postman/Insomnia collection
|
|
- [ ] Update README with API usage examples
|
|
|
|
---
|
|
|
|
### Priority 3: Medium (Nice to Have)
|
|
|
|
#### Task 3.1: Frontend Component Tests
|
|
|
|
**Estimated Effort**: 2 days
|
|
**Assigned To**: Frontend Agent + QA Agent
|
|
**Dependencies**: None
|
|
**Acceptance Criteria**:
|
|
- Component test coverage ≥60%
|
|
- Critical components have comprehensive tests
|
|
- User interaction flows tested
|
|
|
|
**Detailed Subtasks**:
|
|
- [ ] Set up React Testing Library
|
|
- [ ] Write tests for authentication components (login, register)
|
|
- [ ] Write tests for project list page
|
|
- [ ] Write tests for Kanban board (without drag & drop)
|
|
- [ ] Write tests for form components
|
|
- [ ] Write tests for API error handling
|
|
|
|
**Risk Assessment**:
|
|
- Risk: Time constraints may prevent completion
|
|
- Mitigation: Defer to next sprint if Priority 1-2 tasks delayed
|
|
|
|
---
|
|
|
|
#### Task 3.2: Frontend Polish and UX Improvements
|
|
|
|
**Estimated Effort**: 2 days
|
|
**Assigned To**: Frontend Agent + UX-UI Agent
|
|
**Dependencies**: None
|
|
**Acceptance Criteria**:
|
|
- Responsive design on mobile devices
|
|
- Loading states for all async operations
|
|
- Error messages are clear and actionable
|
|
- Accessibility audit passes WCAG AA
|
|
|
|
**Detailed Subtasks**:
|
|
- [ ] Mobile responsive design audit
|
|
- [ ] Add skeleton loaders for all loading states
|
|
- [ ] Improve error message clarity
|
|
- [ ] Add empty state designs
|
|
- [ ] Accessibility audit (keyboard navigation, screen readers)
|
|
- [ ] Add animations and transitions (subtle)
|
|
- [ ] Performance optimization (code splitting, lazy loading)
|
|
|
|
---
|
|
|
|
#### Task 3.3: Performance Optimization
|
|
|
|
**Estimated Effort**: 2 days
|
|
**Assigned To**: Backend Agent
|
|
**Dependencies**: None
|
|
**Acceptance Criteria**:
|
|
- API P95 response time <500ms
|
|
- Database queries optimized with projections
|
|
- Redis caching for frequently accessed data
|
|
- Query performance tested under load
|
|
|
|
**Detailed Subtasks**:
|
|
- [ ] Add Redis caching layer
|
|
- [ ] Optimize EF Core queries with Select() projections
|
|
- [ ] Add database indexes for common queries
|
|
- [ ] Implement query result caching
|
|
- [ ] Performance testing with load generation tool
|
|
- [ ] Identify and fix N+1 query problems
|
|
- [ ] Add response compression middleware
|
|
|
|
**Risk Assessment**:
|
|
- Risk: Premature optimization
|
|
- Mitigation: Only optimize if performance issues identified
|
|
|
|
---
|
|
|
|
## Task Assignment Matrix
|
|
|
|
| Task | Agent | Duration | Dependencies | Priority |
|
|
|------|-------|----------|--------------|----------|
|
|
| Auth Architecture | Backend + Architect | 1 day | None | P1 |
|
|
| Auth Database | Backend | 1 day | Auth Architecture | P1 |
|
|
| Auth Commands | Backend | 1 day | Auth Database | P1 |
|
|
| Auth API | Backend | 1 day | Auth Commands | P1 |
|
|
| Auth Frontend State | Frontend | 1 day | Auth API | P1 |
|
|
| Auth Frontend UI | Frontend | 1 day | Auth Frontend State | P1 |
|
|
| Auth Testing | QA + Backend + Frontend | 1 day | Auth Frontend UI | P1 |
|
|
| Query Handler Tests | QA | 2 days | None | P1 |
|
|
| Integration Tests | QA + Backend | 1 day | None | P1 |
|
|
| SignalR Backend | Backend | 2 days | Auth API | P2 |
|
|
| SignalR Frontend | Frontend | 1 day | SignalR Backend | P2 |
|
|
| API Documentation | Backend | 1 day | Auth API | P2 |
|
|
| Component Tests | Frontend + QA | 2 days | None | P3 |
|
|
| Frontend Polish | Frontend + UX-UI | 2 days | None | P3 |
|
|
| Performance Opt | Backend | 2 days | None | P3 |
|
|
|
|
---
|
|
|
|
## Sprint Schedule (2 Weeks)
|
|
|
|
### Week 1: Authentication and Testing
|
|
|
|
**Monday (Day 1)**:
|
|
- Backend: Auth architecture design
|
|
- QA: Start Query Handler tests (parallel)
|
|
- Morning standup: Align on auth approach
|
|
|
|
**Tuesday (Day 2)**:
|
|
- Backend: Auth database and domain
|
|
- QA: Continue Query Handler tests
|
|
- Evening: Review auth domain design
|
|
|
|
**Wednesday (Day 3)**:
|
|
- Backend: Auth application commands
|
|
- QA: Finish Query Handler tests, start integration tests
|
|
- Evening: Demo auth commands working
|
|
|
|
**Thursday (Day 4)**:
|
|
- Backend: Auth API layer and middleware
|
|
- QA: Continue integration tests
|
|
- Evening: Test auth API endpoints
|
|
|
|
**Friday (Day 5)**:
|
|
- Frontend: Auth state management
|
|
- Backend: Support frontend integration
|
|
- QA: Auth integration testing
|
|
- Evening: Weekly review, adjust plan if needed
|
|
|
|
### Week 2: Real-time and Polish
|
|
|
|
**Monday (Day 6)**:
|
|
- Frontend: Auth UI components
|
|
- Backend: Start SignalR backend setup
|
|
- Morning: Sprint progress review
|
|
|
|
**Tuesday (Day 7)**:
|
|
- QA + Backend + Frontend: End-to-end auth testing
|
|
- Backend: Continue SignalR backend
|
|
- Evening: Auth feature complete demo
|
|
|
|
**Wednesday (Day 8)**:
|
|
- Backend: SignalR event integration
|
|
- Frontend: Start SignalR frontend integration
|
|
- Backend: API documentation
|
|
|
|
**Thursday (Day 9)**:
|
|
- Frontend: Finish SignalR frontend integration
|
|
- Frontend + QA: Start component tests (if time allows)
|
|
- Evening: Real-time feature demo
|
|
|
|
**Friday (Day 10)**:
|
|
- Frontend + UX-UI: Polish and UX improvements
|
|
- QA: Final testing and bug fixes
|
|
- Backend: Performance optimization (if time allows)
|
|
- Afternoon: Sprint retrospective and M1 completion celebration
|
|
|
|
---
|
|
|
|
## Risk Management
|
|
|
|
### High Risks
|
|
|
|
**Risk 1: Authentication Implementation Complexity**
|
|
- **Probability**: Medium
|
|
- **Impact**: High (blocks deployment)
|
|
- **Mitigation**:
|
|
- Use proven libraries (ASP.NET Core Identity)
|
|
- Follow security best practices documentation
|
|
- Allocate buffer time (1-2 days)
|
|
- Security review before completion
|
|
|
|
**Risk 2: Testing Takes Longer Than Estimated**
|
|
- **Probability**: Medium
|
|
- **Impact**: Medium (delays sprint)
|
|
- **Mitigation**:
|
|
- Focus on P1 critical tests first
|
|
- Defer P3 nice-to-have tests if needed
|
|
- QA agent can work in parallel
|
|
|
|
**Risk 3: SignalR Integration Issues**
|
|
- **Probability**: Low
|
|
- **Impact**: Medium (degrades UX)
|
|
- **Mitigation**:
|
|
- Can defer to next sprint if needed
|
|
- Not critical for M1 MVP
|
|
- Allocate extra day if problems arise
|
|
|
|
### Medium Risks
|
|
|
|
**Risk 4: Frontend-Backend Integration Issues**
|
|
- **Probability**: Low
|
|
- **Impact**: Medium
|
|
- **Mitigation**:
|
|
- Daily integration testing
|
|
- Clear API contract documentation
|
|
- Quick feedback loops
|
|
|
|
**Risk 5: Performance Bottlenecks**
|
|
- **Probability**: Low
|
|
- **Impact**: Low (current performance acceptable)
|
|
- **Mitigation**:
|
|
- Performance optimization is P3 (optional)
|
|
- Can be addressed in next sprint
|
|
|
|
---
|
|
|
|
## Communication Plan
|
|
|
|
### Daily Standups
|
|
|
|
**Time**: 9:00 AM daily
|
|
**Participants**: All agents
|
|
**Format**:
|
|
1. What did you complete yesterday?
|
|
2. What will you work on today?
|
|
3. Any blockers or dependencies?
|
|
|
|
### Mid-Sprint Review
|
|
|
|
**Time**: Friday, Week 1 (Day 5)
|
|
**Participants**: All agents + Product Manager
|
|
**Agenda**:
|
|
1. Review sprint progress (actual vs planned)
|
|
2. Demo completed features (authentication)
|
|
3. Identify risks and adjust plan if needed
|
|
4. Confirm Week 2 priorities
|
|
|
|
### Sprint Retrospective
|
|
|
|
**Time**: Friday, Week 2 (Day 10)
|
|
**Participants**: All agents + Product Manager
|
|
**Agenda**:
|
|
1. Review sprint achievements
|
|
2. Discuss what went well
|
|
3. Discuss what could be improved
|
|
4. Identify action items for next sprint
|
|
5. Celebrate M1 completion
|
|
|
|
---
|
|
|
|
## Definition of Done
|
|
|
|
### Sprint Definition of Done
|
|
|
|
**Feature Level**:
|
|
- [ ] Code implemented and peer-reviewed
|
|
- [ ] Unit tests written and passing
|
|
- [ ] Integration tests written and passing
|
|
- [ ] API documentation updated
|
|
- [ ] Frontend UI implemented (if applicable)
|
|
- [ ] Manual testing completed
|
|
- [ ] No critical bugs
|
|
|
|
**Sprint Level**:
|
|
- [ ] All Priority 1 tasks completed
|
|
- [ ] At least 80% of Priority 2 tasks completed
|
|
- [ ] M1 completion ≥95%
|
|
- [ ] Test coverage ≥80% (Application layer)
|
|
- [ ] All tests passing (100% pass rate)
|
|
- [ ] Build with zero errors and warnings
|
|
- [ ] Sprint retrospective completed
|
|
|
|
### M1 Milestone Definition of Done
|
|
|
|
**Functional Requirements**:
|
|
- [x] Complete CRUD for Projects, Epics, Stories, Tasks
|
|
- [x] Kanban board with drag & drop
|
|
- [ ] User authentication and authorization
|
|
- [ ] Real-time updates with SignalR
|
|
- [ ] Audit logging for all operations (with user context)
|
|
|
|
**Quality Requirements**:
|
|
- [x] Domain layer test coverage ≥80% (96.98% achieved)
|
|
- [ ] Application layer test coverage ≥80%
|
|
- [ ] Integration tests for all API endpoints
|
|
- [x] Zero critical bugs
|
|
- [x] Build with zero errors and warnings
|
|
|
|
**Documentation Requirements**:
|
|
- [x] API documentation (Scalar)
|
|
- [x] Architecture documentation
|
|
- [ ] User guide (basic)
|
|
- [ ] Deployment guide
|
|
|
|
**Deployment Requirements**:
|
|
- [x] Docker containerization
|
|
- [ ] Environment configuration
|
|
- [ ] Database migrations (including auth tables)
|
|
- [ ] CI/CD pipeline (basic)
|
|
|
|
---
|
|
|
|
## Success Criteria
|
|
|
|
### Sprint Success
|
|
|
|
**Must Achieve (Minimum Viable Sprint)**:
|
|
1. JWT authentication fully working
|
|
2. All API endpoints secured
|
|
3. Application layer test coverage ≥75%
|
|
4. Zero critical bugs
|
|
|
|
**Target Achievement (Successful Sprint)**:
|
|
1. JWT authentication fully working
|
|
2. Application layer test coverage ≥80%
|
|
3. SignalR real-time updates working
|
|
4. Integration tests for all controllers
|
|
5. M1 completion ≥95%
|
|
|
|
**Stretch Goals (Exceptional Sprint)**:
|
|
1. All of the above PLUS:
|
|
2. Frontend component tests ≥60% coverage
|
|
3. Performance optimization complete
|
|
4. M1 completion 100%
|
|
|
|
---
|
|
|
|
## Budget and Resource Allocation
|
|
|
|
### Time Allocation (10 days, 80 hours total)
|
|
|
|
| Priority | Category | Hours | Percentage |
|
|
|----------|----------|-------|------------|
|
|
| P1 | Authentication | 56h (7 days) | 70% |
|
|
| P1 | Application Testing | 24h (3 days) | 30% |
|
|
| P2 | SignalR | 24h (3 days) | 30% |
|
|
| P2 | Documentation | 8h (1 day) | 10% |
|
|
| P3 | Component Tests | 16h (2 days) | 20% |
|
|
| P3 | Polish | 16h (2 days) | 20% |
|
|
| P3 | Performance | 16h (2 days) | 20% |
|
|
|
|
**Note**: P2 and P3 tasks are flexible and can be adjusted based on P1 progress
|
|
|
|
### Resource Requirements
|
|
|
|
**Development Tools** (already available):
|
|
- .NET 9 SDK
|
|
- Node.js 20+
|
|
- PostgreSQL 16 (Docker)
|
|
- Redis 7 (Docker - to be added)
|
|
- Visual Studio Code / Visual Studio
|
|
|
|
**Infrastructure** (already available):
|
|
- GitHub repository
|
|
- Docker Desktop
|
|
- Development machines
|
|
|
|
**No additional budget required for this sprint**
|
|
|
|
---
|
|
|
|
## Appendix
|
|
|
|
### A. Authentication Flow Diagram
|
|
|
|
```
|
|
Registration Flow:
|
|
User → Frontend (Registration Form) → API (RegisterUserCommand)
|
|
→ Domain (User.Create) → Database → Response (User Created)
|
|
|
|
Login Flow:
|
|
User → Frontend (Login Form) → API (LoginCommand)
|
|
→ Verify Password → Generate JWT Token → Response (Token)
|
|
→ Frontend (Store Token) → API (Subsequent Requests with Bearer Token)
|
|
|
|
Protected API Request:
|
|
User → Frontend (With Token) → API (JWT Middleware validates token)
|
|
→ Authorized → Controller → Response
|
|
```
|
|
|
|
### B. Test Coverage Target Breakdown
|
|
|
|
| Layer | Current Coverage | Target Coverage | Gap | Priority |
|
|
|-------|-----------------|-----------------|-----|----------|
|
|
| Domain | 96.98% | 80% | +16.98% | ✅ Complete |
|
|
| Application | 40% | 80% | -40% | 🔴 Critical |
|
|
| Infrastructure | 0% | 60% | -60% | 🟡 Medium |
|
|
| API | 0% | 70% | -70% | 🟡 Medium |
|
|
| Frontend | 0% | 60% | -60% | 🟢 Low |
|
|
|
|
**Focus for this sprint**: Application layer (P1), API layer (P2)
|
|
|
|
### C. API Endpoints to Secure
|
|
|
|
**Projects** (5 endpoints):
|
|
- POST /api/v1/projects - [Authorize(Roles = "Admin,ProjectManager")]
|
|
- GET /api/v1/projects - [Authorize]
|
|
- GET /api/v1/projects/{id} - [Authorize]
|
|
- PUT /api/v1/projects/{id} - [Authorize(Roles = "Admin,ProjectManager")]
|
|
- DELETE /api/v1/projects/{id} - [Authorize(Roles = "Admin")]
|
|
|
|
**Epics** (4 endpoints):
|
|
- All require [Authorize(Roles = "Admin,ProjectManager,Developer")]
|
|
|
|
**Stories** (7 endpoints):
|
|
- All require [Authorize]
|
|
|
|
**Tasks** (8 endpoints):
|
|
- All require [Authorize]
|
|
|
|
### D. Key Decisions Pending
|
|
|
|
**Decision 1**: ASP.NET Core Identity vs Custom User Management
|
|
- **Options**:
|
|
1. Use ASP.NET Core Identity (full-featured, battle-tested)
|
|
2. Custom implementation (lightweight, full control)
|
|
- **Recommendation**: ASP.NET Core Identity (faster, more secure)
|
|
- **Decision Maker**: Backend Agent + Architect Agent
|
|
- **Timeline**: Day 1 of sprint
|
|
|
|
**Decision 2**: Token Refresh Strategy
|
|
- **Options**:
|
|
1. Sliding expiration (token refreshes automatically)
|
|
2. Refresh token (separate refresh token with longer expiration)
|
|
3. No refresh (user must re-login)
|
|
- **Recommendation**: Refresh token approach (more secure)
|
|
- **Decision Maker**: Backend Agent + Architect Agent
|
|
- **Timeline**: Day 1 of sprint
|
|
|
|
**Decision 3**: Password Policy
|
|
- **Options**:
|
|
1. Strict (12+ chars, special chars, numbers)
|
|
2. Moderate (8+ chars, letters + numbers)
|
|
3. Minimal (6+ chars)
|
|
- **Recommendation**: Moderate (balance security and UX)
|
|
- **Decision Maker**: Product Manager + Backend Agent
|
|
- **Timeline**: Day 1 of sprint
|
|
|
|
---
|
|
|
|
## Next Steps After This Sprint
|
|
|
|
### Immediate (Week 3)
|
|
|
|
1. **Deployment Preparation**:
|
|
- Set up staging environment
|
|
- Configure CI/CD pipeline
|
|
- Prepare deployment documentation
|
|
- Security audit
|
|
|
|
2. **M1 Completion and Handoff**:
|
|
- Final testing and bug fixes
|
|
- User acceptance testing
|
|
- Documentation completion
|
|
- M1 retrospective
|
|
|
|
### M2 Planning (Week 4)
|
|
|
|
1. **MCP Server Research**:
|
|
- Research MCP protocol specification
|
|
- Analyze MCP Server implementation patterns
|
|
- Design ColaFlow MCP Server architecture
|
|
- Prototype diff preview mechanism
|
|
|
|
2. **M2 Sprint 1 Planning**:
|
|
- Break down M2 into epics and stories
|
|
- Estimate effort for MCP implementation
|
|
- Plan first M2 sprint (2-3 weeks)
|
|
- Allocate resources
|
|
|
|
---
|
|
|
|
**End of Action Plan**
|
|
|
|
**Created By**: Product Manager
|
|
**Last Updated**: 2025-11-03
|
|
**Next Review**: 2025-11-10 (Mid-Sprint Review)
|