`) on the public card to
display an `
`.
- Document the **NFC writing operations process** in `docs/nfc-ops.md`:
use Android with NFC Tools to write `https://yourapp.com/u/{slug}` to
NTAG215 cards; iOS Shortcuts as alternative. This is a fulfillment
procedure, not code.
**Done when:** scanning the QR on a published profile downloads the right
vCard; a physical NFC card with the URL written, tapped to any modern
phone, opens the profile.
---
### Phase 7 — MVP polish
- Reserved-slug validator.
- Throttle public routes (`throttle:60,1`).
- Storage link in deploy notes (`php artisan storage:link`).
- "Profile not published" view (themed to match the card aesthetic).
- 404 view for unknown slugs.
- Owner-initiated profile deletion (data export = vCard + JSON dump).
- README with setup, env vars, seed instructions.
- Smoke-test checklist for every role-route combination.
**Done when:** the checklist passes on a fresh `migrate:fresh --seed` install.
---
## 7. Cross-cutting concerns
- **Validation:** every write route uses a FormRequest. No raw `$request->validate()`
in controllers — keeps rules versionable per endpoint.
- **Authorization:** every model with role-based access has a Policy. No
`if ($user->role === 'admin')` checks in controllers — use `Gate` / `authorize`.
- **Storage paths in DB** are relative (`photos/abc.jpg`), never absolute URLs.
Render via `Storage::url(...)` so swapping disks is a config change.
- **Enums** are the single source of truth — no hardcoded `'dark'`, `'centered'`,
`'Teal'` strings outside the enum class.
- **Audit:** log company create/deactivate, profile activate/deactivate,
user suspend, password reset via Spatie activitylog. Skip noisy events
(profile edits by owner).
- **Tests:** at minimum, one feature test per role × phase end-state. No
unit-test religion; feature tests catch the right regressions for a Blade
app.
- **Rate limiting:** `throttle` middleware on `/u/{slug}*` (public read),
`/card/login`, `/card/register`. Defaults are fine for MVP.
---
## 8. Risks (and the cheapest mitigation)
| Risk | Mitigation |
|---|---|
| Image upload abuse (large files, bad MIME) | Cap at 2 MB pre-base64; validate MIME via `getimagesize`; store as JPEG re-encoded server-side (the cropper already does this client-side) |
| Slug squatting (someone grabs `ceo`, `apple`) | Reserved-slug list + admin can rename any profile |
| Visitor-side profile takedown abuse | Admin `is_active=false` flag flips public view to a "this profile is unavailable" page |
| Employee leaves company | Company user can deactivate employee (suspends the user, public profile shows "unavailable"). Reassigning ownership is post-MVP |
| Cropper data URLs blowing the request size | `post_max_size = 8M`; client-side 2 MB cap; cropper already JPEG-compresses |
| iOS Safari vCard quirks | Use vCard 3.0; smoke-test on real iPhone before shipping |
| Tyro Dashboard hard-codes assumptions we can't override | Tyro UI is **scoped to admin/company only**; the card-owner flow never depends on it |
---
## 9. What's *not* in this plan (and shouldn't be added without discussion)
- Anything visual in the four locked card views (`card/{index,edit,login,preview}.blade.php`).
Pure read/write wiring only.
- A landing/marketing page at `/`. For now, `/` can redirect to the demo
card or a `/card/login` link.
- Email templates beyond the bare credential-delivery message.
- i18n / Bangla support. The current UI strings stay English; add later
if a customer needs it.
---
## 10. Open questions — resolved
All MVP-blocking ambiguities are now locked into §2. For the record:
1. **Signup policy** → **Open**. `/card/register` exists in Phase 1; reserved-slug
list + admin `is_active=false` is our abuse mitigation.
2. **Per-company Tyro branding** → **Deferred**. Phase 5 ships a single look.
3. **Photo crop output** → kept as-is. Client cropper produces JPEG; server
trusts the MIME after `getimagesize()` validation.
4. **Hosting target** → **Decide in Phase 7**, not now. Code stays portable
(no S3-specific calls, no Forge-specific config) until then.
If any of these need revisiting, edit §2 (the decisions table) and update
the affected phase — don't reopen this section.
---
## 11. NFC operations process (non-code)
Not buildable in software — documenting so it's not forgotten:
1. Admin orders **NTAG215** blank stickers/cards (capacity > URL length).
2. Using **NFC Tools** (Android) or **Apple Shortcuts** (iOS 14+), write the
profile's canonical URL: `https://taply.app/u/{slug}`.
3. Lock the tag (NFC Tools → "Lock tag") to prevent overwrite.
4. Ship to the user.
5. **Re-writes** require physical access — there's no "remotely re-program
the card" capability on consumer NFC tags. Plan for this with customer
support.
---
## Quick sequencing visual
```
Phase 1 ██████░░░░░░░░░░░░░░ schema + auth (no visible change)
Phase 2 ░░░░░░██░░░░░░░░░░░░ public profile is dynamic
Phase 3 ░░░░░░░░████████░░░░ edit form persists (biggest phase)
Phase 4 ░░░░░░░░░░░░░░░██░░░ admin panel
Phase 5 ░░░░░░░░░░░░░░░░██░░ company portal
Phase 6 ░░░░░░░░░░░░░░░░░██░ QR + vCard + NFC ops
Phase 7 ░░░░░░░░░░░░░░░░░░██ polish
```