Roadmap — D2U.NET (actividades)

D2U.NET · Flows · Implementacao · Testes · Arquitetura · Seguranca · Migracao-Legado

Lista de actividades sem prazos — ordem sugerida por ondas.
Marcar [x] à medida que concluir.
Spec: C:\Projetos\D2U.NET\D2U.NET\d2u.net\Docs_New\

⚡ ESTADO 2026-06-11 — código 100% concluído

As ondas 2–9 abaixo foram todas concluídas (paridade total com o legado, 388 testes verdes). Fonte de verdade actualizada: Docs_New/implementation/rollout-waves.md + onda9-paridade-completa.md + Migracao-Legado. Os checklists detalhados abaixo são histórico do planeamento — itens não marcados foram entregues nas ondas 3–9 ou declarados fora de escopo. Pendente apenas (operacional): ETL staging + cutover (ver Migracao-Legado). Pós-Onda 9 (2026-06-12): Role Inbox + FSM enforcement — ✅ · review Docs_New/reviews/2026-06-12-workflow-inbox-dashboard-review.md Documentos novos: Docs/proposta.md, Docs/apresentacao-cliente.md, Docs/features.md, Docs/workflow.md (+ Docs_EN/).

Convenção Obsidian

Actualizar vault sempre quando mudar no repo:

• Docs_New/ ou Docs/ (spec / legado) → Flows, Roadmap
• src/ — código → Implementacao + Arquitetura + Flows
• tests/ — testes → Testes + Flows
• Ondas / roadmap → Roadmap

Notas: D2U.NET · README · Implementacao · Flows · Testes · Sincronizacao-Obsidian

Solution root: C:\Projetos\D2U.NET\D2U.NET\d2u.net\

Decisões de negócio (bloqueantes)

• Escolher estratégia BD — PostgreSQL 16 + schema 4NF — Base-de-Dados · Docs_New/database/postgresql-schema-design.md
• Confirmar se Google Checkout (postresult.do) ainda recebe tráfego → sunset ou port
• Confirmar se RealEx e PayPal mantêm-se em produção
• Confirmar clientes activos: Winscribe, MediaHawk, DialDictate, BigHand (egress FTP 19)
• Confirmar Regus (IntegrationPointAction) ainda activo
• Confirmar SpeechLiveZipUploadServiceAction — dead code ou ambiente específico
• Validar política Outside report (outside-report.do) por company

Onda 0 — Documentação ✅

• Docs_New/ — architecture, domain, database, web, api, modules
• Flows 01–10 críticos reescritos para .NET
• Flows 11–18 suplementares + FSM
• Code review fluxos externos dict2us-app
• Flows 19–22 (gaps externos)
• Vault Obsidian hub + Code-Review-Fluxos-Externos + Flows
• Matriz cobertura workflow-coverage-matrix.md
• Acceptance checklist actualizado
• Padrão segurança Docs_New/security/ + Seguranca

Onda 1 — Fundação código ✅

Docs_New/implementation/onda1-scaffold-completo.md · Implementacao

Solution e infra dev

• Solution d2u.net.slnx — 6 projetos + 5 test projects + D2U.Docs
• Configurar referências entre projetos
• Packages: EF Core 9 + Pomelo, FluentValidation, Cookies auth, MailKit, Stripe.net
• Program.cs — Razor Pages, middleware pipeline
• appsettings.Development.json + User Secrets template
• Docker compose MySQL dev — docker-compose.yml
• CI: dotnet build + testes — .github/workflows/ci.yml

Domain

• Enums: JobStatus, UserType, JobUploadType, JobPaymentStatus, AuthErrorCode
• Entidades core: Company, User, Client, Job, JobFile (+ integrações stub)
• JobWorkflowAction enum + JobWorkflowEngine (base FSM — testes unitários)
• FSM persistida IJobWorkflowService → Onda 2
• ActionTypes enum → Onda 2+

Persistence

• AppDbContext + configs EF (MySQL legado — company, users, jobs)
• Migration inicial InitialCreate
• Query filter multi-tenant CompanyId
• Seed: company + admin dev

Web skeleton

• CompanyResolutionMiddleware (subdomínio / header)
• Auth cookie + login/logout pages
• Dashboard skeleton /MedTrans/Dashboard
• Layout Razor + pastas temas wwwroot/themes/{companyFolder}/
• Health check /health
• Error pages dedicadas → Onda 2

Segurança base (Seguranca · §1–6, §25)

• SecurityHeadersMiddleware — HSTS, nosniff, X-Frame-Options, CSP base
• Cookie policy — Secure, HttpOnly, SameSite (d2u.auth, d2u.csrf)
• Antiforgery global Razor Pages
• Authorization policies skeleton (§27)
• User Secrets template — zero secrets em produção
• .gitignore — Production secrets, .env, keys (§12)

Onda 1b — API externa ✅ (jun/2026)

Docs_New/implementation/api-externa-completa.md · Flows · Implementacao

• DWR — /api/dwr/* (~47 endpoints) + ReferenceDataStore
• Mobile — /api/mobile/login, upload, chunk-assembler, metadata, verify-file
• Auth — /api/auth/authenticate
• Integrações — xmlrpc, audio-receiver, http-post, speechlive/*
• Webhooks — stripe, realex, paypal
• Documentos — /api/jobs/{id}/document/save
• Outside API — POST /Outside/Report/Search, GET /Outside/Download/{token}
• Filtros: CompanyScope, ApiKey, MobileAuth, OutsideToken
• Testes T-API — flows 16, 17, 22 (contract + integration)

Pendente (negócio real): DWR/integrations com EF persistido, merge áudio FFmpeg, workers.

Onda 1c — Navegação UI stub ✅ (jun/2026)

Docs_New/implementation/navegacao-stub-completa.md · Flows

• ~82 páginas Razor — layout legado dictate2us-app
• Layouts: _MedTransLayout, _LoginLayout, _SuperUserLayout, _OutsideLayout
• Navigator completo — DASHBOARD · JOBS · USERS · MANAGE · REPORTS · SEARCH
• CSS/imagens copiados → wwwroot/
• Login indexv2.jsp (tabelas legado)
• Gerador scripts/generate-stub-pages.ps1
• SuperUser + Outside páginas stub

Pendente: substituir _StubContent por HTML real dos JSPs (alljobs, singlejob, etc.)

Testes — Plano master

Spec: Docs_New/testing/master-test-plan.md · Testes

T0 — Infraestrutura ✅

• D2U.Testing — WebApplicationFactory, MySQL fixture
• D2U.UnitTests, D2U.IntegrationTests, D2U.ContractTests, D2U.WorkersTests
• Packages: Moq, FluentAssertions, Testcontainers, WireMock
• CI MySQL service + coverage

T1 — Fundação ✅

• JobWorkflowEngine + testes FSM (64 unit)
• LoginRequestValidator, PermissionMatrix, JobStatusGroups, UploadFileNameValidator
• Integration: /health, security headers, login (4 cenários)

T-API ✅ (jun/2026)

• Contract: DWR, mobile, xmlrpc, stripe (18 pass)
• Integration flows 16, 17, 22 (15 pass)
• Workers registration (2 pass)
• Total: 388 pass · 0 skip · 0 fail — Testes · Casos-de-Teste
• Role Inbox — JobDashboardService + RoleInboxScenarioTests (7)

T2–T6 — Planned

• Activar testes Flow 01–04 completos (remover Skip)
• Users, payments, reports (Onda 3–5)
• Integrations, workers (Onda 6)
• acceptance-checklist 100% (Onda 8)

Onda 2 — Autenticação e core jobs (flows 01–04)

UI stub → concluído Onda 9 · API + negócio ✅

Flow 01 — Login e sessão

• Login page layout legado + cookie auth básico
• IAuthService — códigos erro legado (2, 3, 4)
• MFA verify/resend
• Forgot password + email
• Auto-assign jobs pós-login (se policy)
• Variantes mobile iPhone-login

Flow 02 — Criar job upload

• JobCreationService (API/mobile)
• IJobService.CreateAsync — upload web UI
• Validação créditos / pagamento required
• Drag-drop endpoints
• Flash uploader — skip (obsoleto)

Flow 03 — Chunks mobile

• POST /api/mobile/chunk-assembler (merge bytes stub)
• Merge áudio real (FFmpeg/sox)
• Idempotência chunks persistida

Flow 04 — Workflow job

• JobWorkflowEngine unit tests
• FSM persistida — finish, QA, reject, split
• Job search / advance filter (UI real)
• Bulk delete / recompute
• Download áudio / documentos / attachments
• Job logs

DWR compat (prioridade onda 2)

• DWR endpoints stub (~47) — Onda 1b
• DWR com EF persistido (organizations, patients, job files)

Onda 3 — Utilizadores e gestão (flows 07, 11, 14, 18)

UI stub → CRUD real Users/Manage/Settings (Ondas 3 + 9)

Flow 07 — Gestão clientes/staff

• Páginas stub Users/, Manage/
• CRUD Client, Admin, Staff, MRA, Contractor
• Organizations + WorkTypes
• Patients + upload CSV + multiple patient
• Company settings
• Send activation email

Flow 11 — Registo e activação

• Páginas stub Register, Activate
• Register público + variantes layout
• Activate account token
• Regus IntegrationPointAction → API
• Top-up / auto-login pagamento registo

Flow 14 — Regras atribuição

• DWR RulesAction stub (~16 métodos) — Onda 1b
• Página stub Manage/Rules
• CRUD rules + contractor rules persistido

Flow 18 — Mensagens, settings, logs

• Páginas stub Settings, Messages, Dashboard/Logs
• Messages CRUD
• Settings save / password
• View logs dashboard

Onda 4 — Pagamentos (flows 05, 20)

Flow 05 — Checkout conta

• Página stub Account/Checkout
• Stripe webhook POST /webhooks/stripe (stub + idempotent test)
• Stripe Checkout session real
• Account page + histórico transacções
• Créditos insuficientes (43/44)
• PayPal express (se mantido)
• RealEx branch (se mantido)

Flow 20 — Callbacks externos

• Webhooks stripe/realex/paypal (stub)
• RealEx webhook/callback handler real
• Stripe return URL handler
• Google Checkout — decisão sunset ou feature flag off
• Idempotência payment events persistida

Onda 5 — Relatórios (flows 06, 12, 22)

Flow 06 + 12 — Relatórios

• Páginas stub Reports/* (12 tipos)
• Comprehensive report (QuestPDF/ClosedXML)
• Audio file summary, Client report, Comprehensive cost
• Payment report, SpeechLive credit, Lexacom report
• Deleted jobs, Contractor jobs, Final document, Production summary
• Policy gate por relatório

Flow 22 — Outside report

• Portal UI Outside/Report (layout legado)
• POST /Outside/Report/Search + download token API
• Testes integration (5)
• Interceptor policy usingOutsideViewingOfReport por company
• Download token documento — persistido

Onda 6 — Integrações externas (flows 09, 10, 16, 17, 19, 21, 21b)

Flow 09 — Email e FTP entrada

• MailReaderWorker
• FtpScannerWorker
• Manual trigger admin (legado MailReaderAction)
• Idempotência ScanLog / email processed

Flow 21b — BigHand ingress

• BigHandIngressWorker (FTPFileDownloader + TaspScanner)
• requiresPaymentForBigHand gate
• Credenciais FTP em config (não hardcoded)

Flow 10 + 21 — SpeechLive e Lexacom

• /api/integrations/speechlive/* (stub) — Onda 1b
• DWR SpeechLiveJobAction stub
• sps-updatecreditrequest cron/worker
• SpeechLiveRetryWorker
• Lexacom checker + downloader workers

Flow 16 — API HTTP / mobile

• HttpPostAction → /api/integrations/http-post — Onda 1b
• APICreateJobAction → /api/integrations/audio-receiver
• Mobile servlets: Login, FileUpload, VerifyFile, metadata
• authenticateUser / codec
• Testes integration (5)
• Não portar Dictate2UsHttpPostListener

Flow 17 — Outside + XML-RPC

• POST /api/integrations/xmlrpc — JobHandler stub
• Outside job search UI + download token
• Testes integration (5)
• API keys rotables (substituir hardcoded)
• Rate limiting + HTTPS only
• JobAudioFileDownloaderWorker BlogTalk

Flow 19 — Vendor FTP egress

• IVendorFtpEgressService + event on JobApproved
• Winscribe, MediaHawk, DialDictate, BigHand egress
• Flags bigHandNotTransferred / retry
• Credenciais FTP por vendor em config

Flow 15 — Documento e transcrição

• document.save → API stub — Onda 1b
• Páginas stub Jobs/Transcript
• DWR XMLTranscriptAction stub
• Edit document online
• XML transcribe actions reais

Flow 13 — Templates

• Página stub Templates
• Templates CRUD + upload

Onda 7 — Superuser (flow 08)

• Área /SuperUser — layout + páginas stub — Onda 1c
• Login superuser isolado
• CRUD companies
• Company policy editor
• User type policy editor
• Company admin management

Onda 8 — DWR restante e polish UI

• DWR bulk endpoints stub — Onda 1b (~47)
• DWR com persistência EF (ClientAction, AudioFile, Staff, etc.)
• UI migration variantes JSP (bb-, android-, i-) — mesmo PageModel
• Substituir ActiveX download por HTTP
• HTML real por JSP (substituir _StubContent)

Onda 9 — Segurança e hardening (Seguranca · §20–23)

• Conformidade checklist §20 em todos PRs mergeados
• Secrets: Key Vault / env — zero hardcoded (legado JobHandler, FTP)
• XML-RPC auth por integração + rate limit
• API 401 em vez de redirect login (/api/*)
• Stripe webhook signature validation produção (§13)
• Audit log tabela + operações sensíveis (§15)
• CSP nonces Razor — audit views sem inline
• Corrigir equivalência path VerifyFileExistence (legado typo)
• CI: dotnet list package --vulnerable gate
• Secret scanning (Gitleaks ou GitHub)
• Testes §22 D2U — cross-tenant, antiforgery, webhook dup

Onda 10 — Testes e go-live

• Unit tests services críticos (Job, Auth, Payment)
• Integration tests Testcontainers MySQL
• Mailhog / Stripe mock webhook tests
• Executar acceptance-checklist.md 100%
• Teste paridade fluxos 01–22 vs legado staging
• Migração dados staging
• Plano cutover produção + rollback
• Workers deploy separado (D2U.Workers)
• Monitorização + alertas

Fora de scope (confirmado)

• Flash uploader legado
• ActiveX FileDownload CPP
• Dictate2UsHttpPostListener (dead code)
• Actions dev: testpaypal, testftp, regusTestButton
• Scriberite namespace — só se company activa solicitar

Referências repo