SEO_iamge_renamer_starting_point/plan-for-devs.md

Below is a road-map of concrete tasks that will take your three-developer team from today’s scaffold to a production-ready “AI Bulk Image Renamer” SaaS. The work is organised in phases so that each developer always has an autonomous slice to own, while touch-points (API contracts, queues, WebSockets) stay thin and testable. Citations are woven in wherever external best-practice or spec language underpins a task.

---

Phase 0 – 1 recap (done last week)

Skeleton repo, Docker Compose, OAuth stub, queue stub, drag-and-drop, WebSocket progress, and dummy review table were delivered. Specification refs §18, 26-32, 73-77

---

Phase 2 – Minimum Viable Rename (Weeks 2-4)

Dev A – Backend / API

• Harden Google OAuth flow: add state + PKCE, token verification, refresh‐token rotation (Google for Developers, DEV Community)
• Finish REST endpoints /api/batch, /status, /zip, /keywords/enhance, wiring them to DB via Prisma.
• Implement atomic quota decrement when each image job is en-queued §56-57
• Create cron job using node-crond to reset quotas at UTC 00:00 monthly §58
• Write integration tests (Vitest) for the above.

Dev B – Worker & Vision

• Swap dummy worker for real BullMQ worker; configure 5-attempt exponential back-off §65
• Integrate ClamAV scan for each file before Vision call (Transloadit, DEV Community) (fulfils §62).
• Call Azure AI Vision v4 tagging API and persist tags ≥0.40 confidence §38-41
• Implement filename generation algorithm satisfying §43-48, including stop-word removal and collision suffixes .
• Stream progress via WebSocket (images/{id}/status) when each step finishes §77 .

Dev C – Front-end / UX

• Keyword chip-list & “Enhance” button with optimistic UI §33-37 .
• Review Table with inline-edit, regenerate-name, and shimmer placeholders §49-53, 70 .
• Download ZIP trigger once all rows DONE (§54-55) and show quota bar (§67).
• Accessibility pass (keyboard navigation, aria labels) towards Lighthouse ≥90 §59, 85 .

---

Phase 3 – Paid Plans & Quota Enforcement (Weeks 5-8)

Dev A

• Stripe Billing integration: Checkout, customer portal, webhooks updating plan & quota_remaining (Stripe, Stripe).
• Usage-meter rows in payments table; expose /api/usage for dashboard.
• Automated downgrade to Basic on cancellation (§25).

Dev B

• Batch ZIP assembly in worker using archiver; preserve EXIF (§54-55).
• S3-compatible storage move to MinIO production cluster with signed URLs (spec §30 + MinIO docs) (min.io).
• Queue metrics to Prometheus histogram (§84).

Dev C

• Billing page & upgrade modal (§22-24, 71).
• Plan badge & quota reset animation after webhook arrives via SSE.
• Error states UI (e.g., virus detected, vision failure).

---

Phase 4 – Production Hardening (Weeks 9-12)

All Devs participate; primary owner noted

Owner	Task
A	OpenTelemetry tracing + Sentry error capture (§82-83).
B	Load testing and queue autoscale rules; follow BullMQ robustness guidance (Medium).
C	Lighthouse & a11y polish to hit 90/90 (§59, 85).
A	Prisma migrate deploy pipeline and expand-and-contract strategy (GitHub, wasp.sh).
B	Security review: ClamAV update job, Redis auth, secrets manager (§61-63).
All	CI/CD: ESLint, unit + e2e, Docker multi-stage build < 300 MB (§87) (Docker Documentation, blacksmith.sh, GitHub).

---

Phase 5 – Growth & Ecosystem (Quarter 2)

• CLI uploader & public API token auth (Dev A).
• LLM-powered keyword enhancement quality tuning (Dev B).
• Multi-language UI groundwork (Dev C, extracting i18n JSON; spec §86).
• Admin analytics dashboard (collab).
• Optional: marketplace listing & SEO content marketing (team).

---

Cross-cutting, continuous duties

• Code-review rotation: each PR must be reviewed by one dev outside its domain.
• Weekly demo to keep UI/APIcontracts honest.
• Error budget & on-call: 24 h chat response for prod issues once paying users arrive.
• Documentation: keep /docs/ARCHITECTURE.md and API schema up-to-date.

---

Why this works

Each developer owns a vertical slice so they can deliver value independently and learn the adjacent stack surface. Shared DevOps, security, and reviews prevent silos. The plan aligns strictly with the numbered requirements in your spec §10-90 while following industry best-practices for OAuth (Google for Developers, DEV Community), queues (docs.bullmq.io, Medium), database migrations (GitHub, wasp.sh), malware scanning (Transloadit, DEV Community), computer-vision tagging (Microsoft Learn, Microsoft Learn), billing (Stripe, Stripe), object storage (min.io), and container builds (Docker Documentation, GitHub). Follow this sequence and the team will ship a monetisable, secure, and maintainable SaaS on schedule.