Roadmap
The design in this site is phase 1's output. Later phases implement it. Do not start payment code before the schema in migrations is applied, including gallery approval history, webhook deduplication, and the immutable ledger.
Phase 1. Requirements and design
Approve the user stories, the business rules in this USD edition, the architecture diagrams, and the API boundaries. This documentation is that package.
Phase 2. Database foundation
Add the Prisma models, run prisma migrate and prisma generate against DATABASE_URL, apply the SQL checks and triggers on that same URL, and seed sample services. Placeholder prices stay inactive until real USD prices are entered by the photographer.
Phase 3. Authentication
Account setup, login, access tokens, refresh tokens, password recovery, role checks, and administrator MFA.
Phase 4. Booking and payments
Packages, bookings, orders, Stripe checkout, the Stripe webhook, and the approval workflow. Verified payment moves a booking to pending approval. Rejection starts a USD refund.
Phase 5. Galleries and ratings
Private uploads, publication, access approval, five-minute downloads, and photo ratings.
Phase 6. Referral rewards
Percentage policies, the ledger, discount redemption, refund reversals, and the emails those events send.
Phase 7. Testing and security
Automated coverage for payments, access control, duplicate events, reward concurrency, and recovery. The threat model lists the cases that close this phase.
Phase 8. Documentation and deployment
Keep this Docusaurus site current, configure CI, monitoring, backups, and the production host. Confirm ScalaHosting capabilities before choosing where Next.js, Express, the worker, and PostgreSQL run.
Deliverables
| Deliverable | Where it stands |
|---|---|
| Software requirements | Requirements |
| User stories and acceptance criteria | Stories and criteria |
| C4 and workflow diagrams | Architecture and workflows |
| PostgreSQL and Prisma schema | Migrations |
| Migration and seed plan | Migrations |
| OpenAPI 3.1 | API overview |
| Threat model | Threat model |
| Booking, gallery, and referral workflows | Workflows |
| Automated tests | Specified in testing, written with the implementation |
| Docusaurus site | This site |
| Deployment, monitoring, backup, and recovery | Deployment |
The next implementation step is phase 2: create server/prisma/schema.prisma from the schema on the migrations page and apply it to PostgreSQL before feature work.