434 lines
12 KiB
Markdown
434 lines
12 KiB
Markdown
# Key Information Extracted from BPM Proposal Document
|
||
**Relevant to Streamlined Approvals Project**
|
||
|
||
---
|
||
|
||
## ✅ What We Learned from the Proposal
|
||
|
||
### 1️⃣ **Technology Stack Mentioned**
|
||
|
||
```
|
||
Frontend: Next.js
|
||
Backend: Node.js (with MongoDB compatibility mentioned)
|
||
Database: MongoDB / PostgreSQL (both mentioned)
|
||
Auth: Active Directory (AD) via SSO
|
||
Email: SMTP integration for automated emails
|
||
API Gateway: Node.js
|
||
Web Server: Apache (mentioned in proposal)
|
||
```
|
||
|
||
**⚠️ Conflicts with SRS:**
|
||
- SRS says: React.js + PostgreSQL
|
||
- Proposal says: Next.js + MongoDB
|
||
|
||
**✅ Decision needed before starting development!**
|
||
|
||
---
|
||
|
||
### 2️⃣ **SSO & Authentication Approach**
|
||
|
||
From the proposal (line 268):
|
||
> "Design a secure login page, which allow user to redirect to AD, System user login through AD"
|
||
|
||
**What this tells us:**
|
||
- ✅ SSO integration with Active Directory is confirmed
|
||
- ✅ Users will be redirected to AD for authentication
|
||
- ✅ No separate user/password management needed
|
||
- ⚠️ We need AD integration documentation and test credentials
|
||
|
||
**Implementation Pattern:**
|
||
```
|
||
User → Workflow Portal → Redirect to AD SSO → Authenticate →
|
||
Return JWT Token → Access Portal with Token
|
||
```
|
||
|
||
---
|
||
|
||
### 3️⃣ **Email Notification System**
|
||
|
||
The proposal mentions **extensive email automation**:
|
||
|
||
| Email Type | Trigger | Mentioned In |
|
||
|-----------|---------|--------------|
|
||
| Acknowledgement Email | After form submission | Line 83-87 |
|
||
| Opportunity Email | When vacancy available | Line 98-107 |
|
||
| Reminder Emails | At D+2, D+5 for pending tasks | Line 115-116 |
|
||
| Approval Notification | When request needs action | Line 257-259 |
|
||
| Status Update Emails | On approval/rejection | Throughout |
|
||
|
||
**Email Infrastructure Needed:**
|
||
- SMTP server configuration
|
||
- Email templates (HTML)
|
||
- Automated cron jobs for reminders
|
||
- Sender email address (e.g., `workflow-noreply@royalenfield.com`)
|
||
|
||
**⚠️ For Streamlined Approvals:**
|
||
- SRS says "optional email integration"
|
||
- Proposal assumes email is REQUIRED
|
||
- **Decision needed:** Is email mandatory or optional?
|
||
|
||
---
|
||
|
||
### 4️⃣ **Active Directory Integration**
|
||
|
||
**For User Search & @Tagging:**
|
||
|
||
The proposal mentions:
|
||
- User registration with role assignment (lines 270-282)
|
||
- Multiple user roles managed in the system
|
||
- Integration with AD for authentication
|
||
|
||
**What we need:**
|
||
- AD LDAP endpoint or Microsoft Graph API access
|
||
- Service account credentials for querying AD
|
||
- User attributes available: Name, Email, Employee ID, Department, Designation, Manager
|
||
- Sample AD user object structure
|
||
|
||
**Use Cases:**
|
||
1. **@Tagging approvers** during workflow creation
|
||
2. **@Mentioning users** in Work Notes
|
||
3. **Adding spectators** to requests
|
||
4. **User search** across organization
|
||
|
||
---
|
||
|
||
### 5️⃣ **Role-Based Access Control (RBAC)**
|
||
|
||
**Roles mentioned in proposal (for Dealer Onboarding):**
|
||
- Admin ID
|
||
- DD Lead (Dealer Development Lead)
|
||
- IT Team
|
||
- ZM DD (Zonal Manager - Dealer Development)
|
||
- RBM (Regional Business Manager)
|
||
- ZBH (Zonal Business Head)
|
||
- NBH (National Business Head)
|
||
|
||
**For Streamlined Approvals (Non-Templatized):**
|
||
- Initiator
|
||
- Approver (multi-level, up to 10)
|
||
- Final Approver
|
||
- Spectator
|
||
- Admin (implied but not explicitly defined in SRS)
|
||
|
||
**Questions:**
|
||
- ❓ Is there a Super Admin role?
|
||
- ❓ Can Admin view/modify any request?
|
||
- ❓ How are roles assigned - from AD or application?
|
||
|
||
---
|
||
|
||
### 6️⃣ **File Upload & Document Management**
|
||
|
||
**From Proposal:**
|
||
- File upload functionality required
|
||
- Support for multiple file types
|
||
- Document storage and retrieval
|
||
- Document version management mentioned
|
||
|
||
**From SRS (Streamlined Approvals):**
|
||
- Max file size: 10MB per file
|
||
- Supported formats: PDF, Word, Excel, PPT, Images
|
||
- Preview for PDF and images
|
||
- Download for other formats
|
||
- Google Docs/Sheets links allowed
|
||
|
||
**Storage Recommendation:**
|
||
- Use **Google Cloud Storage (GCS)** for file storage
|
||
- Store file metadata in PostgreSQL
|
||
- Generate signed URLs for secure access
|
||
- Implement file retention policy
|
||
|
||
---
|
||
|
||
### 7️⃣ **Approval Workflow Pattern**
|
||
|
||
**From Proposal (Dealer Resignation/Termination):**
|
||
|
||
Lines 203-209:
|
||
```
|
||
Approval workflow:
|
||
- Level 1: Zonal Business Head (ZBH)
|
||
- Level 2: Dealer Development Lead (DD Lead)
|
||
- Level 3: National Business Head (NBH)
|
||
|
||
If rejected at any level → Request goes back to previous level
|
||
Email notification sent to responsible person
|
||
```
|
||
|
||
**This matches Streamlined Approvals approach:**
|
||
- ✅ Multi-level approval hierarchy
|
||
- ✅ Sequential approval (level by level)
|
||
- ✅ Rejection sends back to previous level
|
||
- ✅ Email notifications at each stage
|
||
- ✅ TAT tracking per level
|
||
|
||
---
|
||
|
||
### 8️⃣ **Automated Reminders & TAT Management**
|
||
|
||
**From Proposal:**
|
||
|
||
Lines 257-259:
|
||
```
|
||
Automated Email Reminders:
|
||
- Configure reminders for pending tasks
|
||
- Mail templates configured
|
||
- Cron jobs configured
|
||
```
|
||
|
||
Lines 115-116:
|
||
```
|
||
Automate Notifications for Incomplete Responses:
|
||
- Email reminders at D+2 and D+5 days
|
||
```
|
||
|
||
**This aligns with SRS TAT tracking:**
|
||
- ✅ Automated reminders at TAT thresholds (50%, 80%, 100%)
|
||
- ✅ Color-coded TAT status (Green/Yellow/Red)
|
||
- ✅ System-generated alerts
|
||
- ✅ Cron jobs for scheduled reminders
|
||
|
||
---
|
||
|
||
### 9️⃣ **Security Measures**
|
||
|
||
**From Proposal (lines 465-474):**
|
||
|
||
| Security Feature | Description |
|
||
|-----------------|-------------|
|
||
| SSL Certificate | All APIs secured with wildcard SSL |
|
||
| JWT Tokens | JWT and JWE for API security |
|
||
| Rate Limiting | Minimize automated attack harm |
|
||
| SQL Injection Protection | App secured from DB injection |
|
||
| XSS Protection | Clickjacking, XSS, MIME-Sniffing protection |
|
||
| Security Headers | All security headers enabled |
|
||
| Session Management | Secure, built-in session manager |
|
||
| Token Invalidation | JWT tokens invalidated after logout |
|
||
|
||
**All of these should be implemented in Streamlined Approvals!**
|
||
|
||
---
|
||
|
||
### 🔟 **Testing Approach**
|
||
|
||
**From Proposal (lines 475-485):**
|
||
|
||
```
|
||
Testing Types:
|
||
✅ Functionality Testing
|
||
✅ Usability Testing
|
||
✅ Compatibility Testing
|
||
✅ Interface Testing
|
||
✅ Performance Testing (Basic)
|
||
✅ Security Testing (Basic)
|
||
✅ UAT Support
|
||
✅ 2 weeks post-launch monitoring
|
||
```
|
||
|
||
**This should be our testing roadmap too!**
|
||
|
||
---
|
||
|
||
### 1️⃣1️⃣ **Communication & Governance**
|
||
|
||
**From Proposal (lines 603-618):**
|
||
|
||
| Meeting | Frequency | Duration | Attendees |
|
||
|---------|-----------|----------|-----------|
|
||
| Daily Scrum | Daily | 10 mins | Dev Team, PM |
|
||
| Weekly Review | Weekly | 30 mins | Team Heads, PM, Client |
|
||
| Monthly Governance | Monthly | 60 mins | PM, Client, PO, SPOC |
|
||
|
||
**✅ This cadence should be followed for Streamlined Approvals project**
|
||
|
||
---
|
||
|
||
### 1️⃣2️⃣ **Infrastructure Specifications**
|
||
|
||
**From SRS:**
|
||
```
|
||
Environment: QA / Testing
|
||
VMs: 1
|
||
CPU: 4-Core
|
||
Memory: 16 GB
|
||
Disk: 500 GB
|
||
OS: Ubuntu 24.04 LTS
|
||
Storage: Cloud (GCS)
|
||
```
|
||
|
||
**Backup:**
|
||
- Daily incremental backups
|
||
- Weekly full backups
|
||
- Restore time: < 2 hours
|
||
|
||
---
|
||
|
||
### 1️⃣3️⃣ **Project Methodology**
|
||
|
||
**From Proposal: Waterfall Approach**
|
||
|
||
Phases:
|
||
1. Scope and plan project
|
||
2. Gather and document requirements
|
||
3. Design application
|
||
4. Develop application and perform unit tests
|
||
5. Conduct system testing
|
||
6. Perform UAT
|
||
7. Fix application as appropriate
|
||
8. Deploy application
|
||
|
||
**⚠️ Note:** Waterfall is mentioned, but Agile/Scrum might be better for:
|
||
- Non-templatized workflows (requirements may evolve)
|
||
- Faster feedback cycles
|
||
- Incremental delivery
|
||
|
||
**Recommendation:** Hybrid approach
|
||
- Waterfall for overall phases
|
||
- Agile sprints within development phase
|
||
|
||
---
|
||
|
||
### 1️⃣4️⃣ **Client Responsibilities**
|
||
|
||
**From Proposal (lines 554-569) - What RE Must Provide:**
|
||
|
||
✅ Designate a project coordinator
|
||
✅ Provide business logic and rules
|
||
✅ Timely responses (within 3 days for queries, demos, UAT)
|
||
✅ Change control approval (within 7 days)
|
||
✅ Provide hosting server
|
||
✅ Provide software licenses (if any)
|
||
✅ Make server available with required environment
|
||
✅ Support coordination with third parties (e.g., SSO, AD, payment gateways)
|
||
|
||
**These are CRITICAL dependencies!**
|
||
|
||
---
|
||
|
||
### 1️⃣5️⃣ **Assumptions from Proposal**
|
||
|
||
**Important assumptions (lines 533-543):**
|
||
|
||
1. ✅ RE will provide SAP APIs (if needed)
|
||
2. ✅ RE will provide accurate information
|
||
3. ✅ RE will approve and review on time
|
||
4. ✅ RE will complete UAT before handover
|
||
5. ✅ Development team will have full access to RE personnel and documentation
|
||
6. ✅ RE will provide needed documentation
|
||
7. ✅ Technical/organizational changes communicated 1 week in advance
|
||
8. ⚠️ HA (High Availability) architecture assumed for business-critical apps
|
||
|
||
---
|
||
|
||
### 1️⃣6️⃣ **Out of Scope (From Proposal)**
|
||
|
||
What is **NOT included** (lines 544-553):
|
||
|
||
❌ Any module not mentioned in scope
|
||
❌ Third-party integrations not listed
|
||
❌ On-premises system configuration
|
||
❌ Data cleansing and validation
|
||
❌ Purchase of 3rd party licenses
|
||
❌ Data creation
|
||
❌ Data migration to new application
|
||
❌ Any requirement not in scope document
|
||
|
||
**For Streamlined Approvals:**
|
||
This means:
|
||
- ❌ SAP integration (not needed)
|
||
- ❌ DMS integration (not needed)
|
||
- ❌ Data migration from old systems (if any)
|
||
- ❌ Integration with other RE systems (unless specified)
|
||
|
||
---
|
||
|
||
## 🎯 Critical Takeaways for Streamlined Approvals
|
||
|
||
### ✅ What's Confirmed:
|
||
1. **SSO/AD authentication** is required and proven approach exists
|
||
2. **Email notifications** are expected (not optional)
|
||
3. **Multi-level approval workflow** pattern is validated
|
||
4. **Security measures** are well-defined
|
||
5. **Testing approach** is comprehensive
|
||
6. **Infrastructure specs** are clear (1 VM, Ubuntu 24.04, 4-Core, 16GB)
|
||
7. **Communication cadence** is defined
|
||
|
||
### ⚠️ What Needs Clarification:
|
||
1. **Frontend:** React.js (SRS) vs Next.js (Proposal) ← **MUST DECIDE**
|
||
2. **Database:** PostgreSQL (SRS) vs MongoDB (Proposal) ← **MUST DECIDE**
|
||
3. **BPM Platform:** Use Camunda/Newgen or build custom? ← **MUST DECIDE**
|
||
4. **Email service:** Is it mandatory or optional? ← **MUST CLARIFY**
|
||
5. **AI service:** Which provider for conclusion remarks? ← **MUST DECIDE**
|
||
6. **Admin role:** What are admin privileges? ← **MUST DEFINE**
|
||
|
||
### 🚨 Blockers if Not Resolved:
|
||
1. ❌ **No SSO documentation** → Cannot implement login
|
||
2. ❌ **No AD access method** → Cannot implement @tagging
|
||
3. ❌ **No test users** → Cannot test workflows
|
||
4. ❌ **No database credentials** → Cannot persist data
|
||
5. ❌ **No email SMTP config** → Cannot send notifications
|
||
6. ❌ **Tech stack not finalized** → Cannot start development
|
||
|
||
---
|
||
|
||
## 📋 Action Items Summary
|
||
|
||
### **Week 1 (CRITICAL):**
|
||
- [ ] Schedule kickoff meeting with RE stakeholders
|
||
- [ ] Get decision on: React vs Next.js
|
||
- [ ] Get decision on: PostgreSQL vs MongoDB
|
||
- [ ] Get decision on: BPM platform vs Custom
|
||
- [ ] Obtain SSO integration documentation
|
||
- [ ] Obtain AD integration method
|
||
- [ ] Get 10-15 test user accounts
|
||
- [ ] Receive database connection credentials
|
||
- [ ] Set up Git repository
|
||
|
||
### **Week 2 (HIGH PRIORITY):**
|
||
- [ ] Confirm email service requirement (mandatory or optional?)
|
||
- [ ] Obtain SMTP credentials if email is required
|
||
- [ ] Select AI service provider (OpenAI/Azure/Gemini)
|
||
- [ ] Get GCP project access and VM details
|
||
- [ ] Obtain domain name and SSL certificate
|
||
- [ ] Finalize role definitions (especially Admin role)
|
||
- [ ] Set up development environment
|
||
- [ ] Begin database schema design
|
||
|
||
### **Week 3 (MEDIUM PRIORITY):**
|
||
- [ ] Create architecture document
|
||
- [ ] Design API endpoints
|
||
- [ ] Create email template designs
|
||
- [ ] Set up CI/CD pipeline
|
||
- [ ] Prepare test data and scenarios
|
||
- [ ] Identify UAT participants
|
||
- [ ] Begin sprint planning
|
||
|
||
---
|
||
|
||
## 📞 Who to Contact for What
|
||
|
||
| Dependency | Contact Role | Purpose |
|
||
|-----------|--------------|---------|
|
||
| SSO Integration | IT Infrastructure Team | Documentation + test environment |
|
||
| AD Integration | Directory Services Team | LDAP access + service account |
|
||
| Database | Database Admin | Credentials + provisioning |
|
||
| Email SMTP | IT Operations | SMTP config + approval |
|
||
| GCP Infrastructure | Cloud Admin | VM access + GCS bucket |
|
||
| AI Service | Product Owner + Legal | Selection + data privacy |
|
||
| Test Users | HR/IT | User accounts with roles |
|
||
| Figma Designs | UX/UI Designer | Developer handoff access |
|
||
| Domain/SSL | Network Admin | DNS + certificate |
|
||
| Security Review | InfoSec Team | Security requirements |
|
||
|
||
---
|
||
|
||
**Document Created:** October 17, 2025
|
||
**Source Documents:**
|
||
- `streamlined_approvals.md` (SRS)
|
||
- `Royal Enfield Proposal 1.06.txt` (BPM Proposal)
|
||
|
||
**Status:** ✅ Ready for Review
|
||
**Next Step:** Present in kickoff meeting and get decisions on all conflicts
|
||
|
||
|