# Tasks

Statuses: Not started · In progress · Blocked · Completed

## Phase 1 — Foundation

### T1. Project scaffold & environment — **Completed**
Next.js 16 + TS + Tailwind scaffold; zod-validated env (`src/lib/env.ts`);
`.env.example`; Dockerfile + docker-compose. *Accepted:* app boots with
invalid-env errors naming the offending variable.

### T2. Database schema & migrations — **Completed**
Full Prisma schema (50+ models incl. tenancy, crawling, content, change
management, billing scaffolding); initial migration applied; seed script.
*Accepted:* `prisma validate` clean; migration applies to fresh DB; seed runs.

### T3. Authentication — **Completed** (2FA UI outstanding → T12)
Register/login/logout/verify-email/request-reset/reset with argon2id,
hashed single-use tokens, lockout, rate limits, audit records; dev mailer
logs links. *Accepted:* verified in browser against real DB; unit tests for
password/tokens; reset destroys all sessions.

### T4. Organisations & RBAC — **Completed**
Org created at registration (creator = OWNER); org list/read/update APIs;
role permission matrix + tests; `requireOrgAccess` guard (404 for
non-members). *Accepted:* rbac tests pass; PATCH audited.

### T5. Website management & verification structure — **Completed**
Website CRUD (+archive) with SSRF-validated origin canonicalisation;
HTML_FILE/META_TAG/DNS_TXT verification tokens + live check endpoint;
dashboard UI. *Accepted:* verified in browser; duplicate URL → 409.

### T6. Secure fetch layer (SSRF) — **Completed**
`assertSafeUrl` + `safeFetch`: protocol allowlist, hostname blocklist, DNS
pre-validation (all records), IPv4/IPv6 private+metadata blocking, manual
redirect re-validation, byte/time caps. *Accepted:* 40+ SSRF unit tests pass.

### T7. Crawl jobs via queue with progress & cancellation — **Completed**
BullMQ queue (idempotent jobId=crawlId, fail-fast enqueue), worker process,
BFS engine honouring robots.txt + crawl-delay + page limits, per-page
progress counters, cancellation checks, issue-detection pass (titles,
descriptions, H1s, thin/duplicate content, broken links, redirect chains,
alt text, noindex), crawl UI with live polling. *Accepted:* queue-down path
verified in browser (fast visible failure); engine logic unit-tested at the
parse/robots/url layers. **Full end-to-end crawl against Redis still to be
exercised (T10) — not claimed as verified.**

### T8. Logging, audit, health — **Completed**
pino with secret redaction; AuditLog writes across auth/org/website/crawl
actions; `/api/health` with DB+Redis checks.

### T9. Docs — **Completed**
README, PRODUCT_SPEC, ARCHITECTURE, DATABASE, API, SECURITY, DEPLOYMENT,
TESTING, DECISIONS, ENVIRONMENT, CHANGELOG, CONTRIBUTING, TASKS.

## Phase 2 — Crawler & audit (remaining)

### T10. End-to-end crawl verification with Redis — **Completed**
Memurai Developer (Redis 7-compatible) installed as a Windows service on
:6379. Worker (`npm run worker`, now loads .env via tsx --env-file) processed
real crawls: 16 pages of a live site crawled with 0 failures; 42 issues
detected across 8 types (duplicate content/titles/descriptions, missing
descriptions, alt text, title lengths, noindex) and stored. *Remaining
follow-ups:* automated worker integration test; cancellation exercised
mid-crawl on a large site.

### T10b. Concurrent crawl-start race — **Not started**
Two rapid Start-crawl clicks can both pass the findFirst active-crawl check
before either row commits, letting two crawls run concurrently for one
website (observed live). Fix with a partial unique index (websiteId WHERE
status IN (QUEUED,RUNNING)) or transactional check. *Tests:* parallel POST
integration test.

### T11. Tenant-isolation API tests — **Not started**
Integration tests: org A member hitting org B's website/crawl endpoints gets
404; READ_ONLY cannot start crawls (403). *Blocking for Phase 2 sign-off.*

### T12. 2FA (TOTP) enrolment & verification — **Not started**
Settings page, QR provisioning, encrypted secret storage, login challenge,
recovery codes. *Depends:* T13 settings page shell.

### T13. Sitemap discovery & ingestion — **Not started**
Parse robots sitemaps + /sitemap.xml, sitemap indexes; seed crawl frontier;
flag sitemap URLs that 404/redirect/noindex; `Sitemap` rows.

### T14. SEO health score — **Not started**
Weighted category scores from crawl issues; explanation payload; history
(`SeoScore`); dashboard display. Diagnostic only — no ranking promises.

### T15. Crawl comparison — **Not started**
Diff two crawl snapshots: new/resolved issues, added/removed pages.

### T16. Organisation member management — **Not started**
Invite (email token), accept, change role, remove; role-rank rules
(`roleOutranks`); UI under /dashboard/settings/team.

### T17. Onboarding wizard — **Not started**
Account → website → verification → (integrations placeholder) → first crawl,
as a guided /onboarding flow reusing existing APIs.

## Later phases

Phase 3 (GSC/GA4/keywords/rank interface), Phase 4 (AI provider abstraction,
brand profiles UI, briefs/drafts/quality), Phase 5 (connector interface +
WordPress, approvals, publishing, rollback), Phase 6 (internal links,
structured data, robots/redirect managers, local SEO, competitors,
programmatic safeguards), Phase 7 (Stripe, limits, reports, notifications,
agency tools, platform admin). Each will be broken into tasks here when its
phase opens.