Skip to content
Appifire
Docs
30 — Milestone 2 Delivery Plan (Blueprint §9.2)

30 — Milestone 2 Delivery Plan (Blueprint §9.2)

Cursor-ready execution plan for Milestone 2: public token page, media upload/storage, and moderation inbox/detail.

30 — Milestone 2 Delivery Plan (Blueprint §9.2)

Section titled “30 — Milestone 2 Delivery Plan (Blueprint §9.2)”

Source: 02-Implementation-Blueprint.md — §9 Release Plan → Milestone 2 (2 weeks).

Milestone 2 blueprint scope:

  • Public token page
  • Media upload + storage
  • Moderation inbox and detail page

This document is a build spec only. No code changes are implied until a task references this file.

Related: 06 (public submission), 09 (inbox), 10 (detail), 12 (moderation settings), 08 (security/compliance), 29 (Milestone 1 dependencies).

0) Goal (one sentence)

Section titled “0) Goal (one sentence)”

Enable customers to submit token-bound video/photo testimonials and merchants to review/moderate them in admin with reliable media handling and secure validation.

1) Scope lock (what is included)

Section titled “1) Scope lock (what is included)”

In scope

Section titled “In scope”

  1. Public submission flow:

    • /t/:token page
    • token validation + consent requirement
    • final submit API

  2. Media handling:

    • signed upload URL endpoint
    • storage key/asset persistence
    • processing status tracking (uploaded/processing/ready/failed)

  3. Moderation UI:

    • submissions inbox (tabs/filters + bulk moderation basics)
    • submission detail (preview, metadata, approve/reject/flag/publish controls)

Out of scope

Section titled “Out of scope”
  • Theme storefront widget rendering (Milestone 3)
  • Analytics and billing pages (Milestone 3)
  • Full UTM/source attribution

2) Dependencies from Milestone 1

Section titled “2) Dependencies from Milestone 1”

Must already exist before Milestone 2 starts:

  • campaign/request schema and webhook request creation (29)
  • valid submissionToken and submissionUrl generation (07)
  • baseline route map and auth conventions (21, 24)

3) Deliverables

Section titled “3) Deliverables”

D1 — Public token experience

Section titled “D1 — Public token experience”
  • Token route (/t/:token) with:
    • valid / invalid / expired states
    • product context locked from token
    • consent checkbox required

D2 — Media upload and linkage

Section titled “D2 — Media upload and linkage”
  • Upload URL endpoint that returns short-lived signed URLs
  • Media record (TestimonialMediaAsset) linked to submission
  • Submission API stores media reference and request linkage atomically

D3 — Moderation operator UI

Section titled “D3 — Moderation operator UI”
  • Inbox (/app/testimonials) with pending/approved/rejected/archived
  • Detail page (/app/testimonials/:id) with media preview + moderation actions
  • Moderation action logs

4) Technical acceptance criteria

Section titled “4) Technical acceptance criteria”

  1. Public submit

    • Valid token allows submission.
    • Invalid/expired token blocked with safe message.
    • Duplicate submit for same token returns idempotent conflict response.

  2. Media flow

    • Upload URL issued only for valid token/request context.
    • Submission and media rows are linked correctly.
    • Processing states visible in detail page.

  3. Moderation

    • New submissions appear in pending tab.
    • Approve/reject actions persist and are auditable.
    • Cross-shop access is blocked.

5) Test matrix (minimum)

Section titled “5) Test matrix (minimum)”

Public flow

Section titled “Public flow”
  1. valid token + video upload + submit
  2. valid token + photo upload + submit
  3. invalid token
  4. expired token
  5. duplicate submit (same token)

Moderation flow

Section titled “Moderation flow”
  1. pending item appears in inbox immediately
  2. approve transitions to approved
  3. reject requires reason
  4. publish toggle available only when allowed by status rules

Security checks

Section titled “Security checks”
  1. rate limit on public submit endpoints
  2. no sensitive token leakage in logs/errors

6) Risks and mitigations

Section titled “6) Risks and mitigations”

  1. Upload succeeds but submit fails

    • Mitigation: keep orphan cleanup job by age/status.

  2. Media processing delay causes moderation confusion

    • Mitigation: explicit processing status badges and fallback previews.

  3. Token abuse

    • Mitigation: expiry + rate limits + short-lived upload URLs.

7) Suggested implementation order (Cursor)

Section titled “7) Suggested implementation order (Cursor)”
  1. Implement token route loader + form shell.
  2. Implement upload-url endpoint + storage adapter.
  3. Implement submit endpoint transaction (submission + media + request status).
  4. Implement inbox list with filters and tabs.
  5. Implement detail page moderation actions and logs.
  6. Add security hardening and edge-case handling.

8) Done definition (Milestone 2)

Section titled “8) Done definition (Milestone 2)”

Milestone 2 is complete when:

  • customers can submit real media from token links,
  • submissions are persisted and track media states,
  • merchants can moderate from inbox/detail without manual DB operations,
  • security checks for token/public endpoints are in place.

9) References

Section titled “9) References”
  • 02-Implementation-Blueprint.md — §9 Milestone 2
  • 06-public-submission-page-screen-13.md
  • 09-submissions-inbox-screen-5.md
  • 10-submission-detail-screen-6.md
  • 12-moderation-settings-screen-9.md
  • 08-security-compliance-and-privacy.md

10) Note on numbering

Section titled “10) Note on numbering”

This folder already includes 05 through 29 plans. This file is 30-....

Home

01 Overview

AppiFire AI Chat — Product Plan & Architecture Options (A, B, C) Technology Overview & High-Level Tasks

01 Platform Foundation

Prerequisites (Detailed Plan) Shopify Setup — Partner Account, CLI, App, and Extension Shopify App Skeleton & Database (Detailed Plan)

02 Knowledge and RAG

Database Schema for RAG Product Sync & Ingestion RAG & Chat API RAG Data Sync (Products, Collections, Inventory, Blog Posts) + Order Lookup How the Codebase Uses Vector Information to Answer Users in Chat Website Knowledge from Web (GPT-4o Mini Search)

03 Billing and Usage

Billing & Usage Billing & Usage — Remaining Tasks Credits wallet: one-time purchases & subscription included credits Free Plan: Reply Cap and Monthly Reset Promo code functionality Shopify App Billing and Payments Tasks

04 Admin and Storefront

Admin Settings & Chat Widget Admin UI Design Plan — Bigger Font, Different Font, More Spacing, Styled Buttons AI Chats / Logs Screen Billing Screen Restructure Plan (Sales + Marketing Focus) Dashboard Plan — AppiFire AI Chat Design Guidelines and Styling System (Polaris + Tailwind Plan) Theme & Design System Timezone & Time Display Plan (Admin + Widget)

05 Chat Experience and Safety

Chat Guardrails Inspection Full Conversation History in OpenRouter Chat Order Lookup Reliability Guide Order Status Conversational Chat Flow Pre-Chat User Identity Form

06 Merchant Lifecycle

Register / Identify App Users (Paying Merchants) Uninstall: Record & Goodbye Email

07 Ops and Release

Deploy: Cloudflare Tunnel + Your Domain & App to appifire-ai-chat.appifire.com Launch & Publishing Guide Links Scheduled jobs, privacy & shop analytics Testing Up to Phase 2 (Product Sync & Ingestion)

08 Research and Ideas

App Names 20 Paid Feature Gaps — AppiFire AI Chat Roadmap Templates Shortlisted Top 30 Shopify App Ideas — High Demand, Buildable, Revenue Potential

09 Archive

100 AI Questions User Can Ask App Embed Settings Plan Chat Thread Identity and History Plan Plan: Free reply monthly reset & paid included credits delivery Future Todo List Promo Code Module Plan Reorganize Documents Support Feature Plan Talk to Human Flow Plan Welcome Email Plan (Brevo API)

10 Marketing and SEO

Article Writing Prompt Appifire SEO Topical Map Topical Map Prompt Appifire VS Pages VS Pages Prompt

11 Video Testimonial Collector

Post-Purchase Video Testimonial Collector — Detailed Product Plan Video Testimonial Collector - Implementation Blueprint Video Testimonial Collector - Pricing & Billing Options Delete All Existing Code and DB Tables (Boilerplate Cleanup) 05 — Storefront Widgets + Public Read API (Screen 8 & 8.1) 06 — Public Submission Page (Screen 13, `/t/:token`) 07 — Email/SMS Request Delivery Pipeline (Blueprint §4) 08 — Security, Compliance & Privacy (Blueprint §8) 09 — Submissions Inbox (Screen 5, `/app/testimonials`) 10 — Submission Detail & Moderation (Screen 6, `/app/testimonials/:id`) 11 — Published Content Manager (Screen 7, `/app/testimonials/published`) 12 — Moderation Settings (Screen 9, `/app/testimonials/moderation`) 13 — Requests Log (Blueprint Screen 10, `/app/testimonials/requests`) 14 — Analytics (Blueprint Screen 11, `/app/testimonials/analytics`) 15 — Billing & Usage (Blueprint Screen 12, `/app/testimonials/billing`) 16 — Templates (Screen 4, `/app/testimonial-templates`) 17 — Campaigns List (Screen 2, `/app/testimonial-campaigns`) 18 — Campaign Create/Edit (Screen 3, `/app/testimonial-campaigns/:id`) 19 — Dashboard (Screen 1, `/app`) 20 — Database Design & Migrations (Blueprint §5) 21 — Route & File Map Execution Plan (Blueprint §6) 22 — Integration & Processing Orchestration (Blueprint §7) 23 — Release Plan & Milestones (Blueprint §9) 24 — Build Notes Execution Standards (Blueprint §10) 25 — Core Modules Breakdown (Blueprint §2.2) 26 — Project Conventions Execution Guide (Blueprint §2.1) 27 — Product Scope Recommendation Execution (Blueprint §1) 28 — Admin Screens Information Architecture (Blueprint §3) 29 — Milestone 1 Delivery Plan (Blueprint §9.1) 30 — Milestone 2 Delivery Plan (Blueprint §9.2) 31 — Milestone 3 Delivery Plan (Blueprint §9.3) 32 — Email/SMS Operational Detail (Blueprint §4) 33 — TestimonialModerationLog Model & Audit Workflow (Blueprint §5.10) 34 — TestimonialDailyAnalytics Model & Rollup Jobs (Blueprint §5.11) 35 — TestimonialProductLink Model & Multi-Product Merchandising (Blueprint §5.9) 36 — TestimonialMediaAsset Model & Processing Pipeline (Blueprint §5.8) 37 — TestimonialSubmission Model & Lifecycle (Blueprint §5.7) 38 — TestimonialRequestEvent Model & Delivery Event Stream (Blueprint §5.6) 39 — TestimonialRequest Model & Scheduling Lifecycle (Blueprint §5.5) 40 — TestimonialTemplate Model & Resolution Rules (Blueprint §5.4) 41 — TestimonialCampaignProduct Model & Targeting Rules (Blueprint §5.3) 42 — TestimonialCampaign Model & Automation Rules (Blueprint §5.2) 43 — Shop Model Extension for Testimonials (Blueprint §5.1) 44 — Per-Product Collection Rule (Required) Implementation Plan 45 — Two Storefront Widgets (v1 Requirement, Screen 8.1)