Ready2Blob/.planning/REQUIREMENTS.md

# Requirements: Ready2Blob

**Defined:** 2026-03-26
**Core Value:** An IT pro can go from zero to a deployable rclone setup in minutes — without needing to know rclone's config syntax or PowerShell deployment conventions.

## v1 Requirements

### Wizard & Navigation

- [x] **WIZD-01**: User can select a storage backend from a popularity-sorted list (Azure Blob and S3 shown first)
- [x] **WIZD-02**: User navigates a multi-step wizard: backend selection → backend config → deployment options → review/download
- [x] **WIZD-03**: User can go back to previous steps without losing entered data
- [x] **WIZD-04**: User can set a custom remote name (validated: alphanumeric, dash, underscore only)

### Backends

- [x] **BACK-01**: User can configure an Azure Blob Storage remote (storage account name, authentication method: SAS token or access key)
- [x] **BACK-02**: User can configure an Amazon S3 remote (access key ID, secret access key, region)
- [x] **BACK-03**: User can configure an S3-compatible remote via endpoint override (same form as S3 with optional endpoint field — covers Wasabi, MinIO, Cloudflare R2)

### Config Generation

- [x] **CONF-01**: App generates a valid rclone.conf file (INI format, correct key/value pairs per backend type)
- [ ] **CONF-02**: User sees a live preview of the generated rclone.conf content as they fill the form
- [ ] **CONF-03**: User can copy the rclone.conf content to clipboard

### Deployment Scripts

- [x] **DEPL-01**: App generates a PowerShell install script for MS Intune (runs as SYSTEM, places config at machine-wide path, idempotent, correct exit codes)
- [x] **DEPL-02**: App generates a separate Intune detection script (checks rclone.exe presence at install path AND config file presence; exits 0 if both found)
- [x] **DEPL-03**: App generates a PowerShell script for RMM tools (generic SYSTEM-context, idempotent, works across NinjaRMM/Datto/ConnectWise)
- [x] **DEPL-04**: User can toggle "Include rclone installation" to add rclone binary download step to generated scripts
- [x] **DEPL-05**: User can choose config deployment path: machine-wide (`C:\ProgramData\rclone\`) vs user profile (`%APPDATA%\rclone\`)

### Download

- [ ] **DOWN-01**: User can download the rclone.conf file individually
- [ ] **DOWN-02**: User can download the Intune install script individually
- [ ] **DOWN-03**: User can download the Intune detection script individually
- [ ] **DOWN-04**: User can download the RMM script individually
- [ ] **DOWN-05**: User can download all artifacts as a single ZIP bundle
- [ ] **DOWN-06**: User can copy any output block to clipboard directly (for RMM paste-in-field workflows)

### Security & Trust

- [ ] **SECU-01**: App displays a security warning (credentials are plaintext in generated files) that user must acknowledge before any download is enabled
- [ ] **SECU-02**: App prominently states that no data is sent to any server (client-side generation only)
- [ ] **SECU-03**: Wizard state is never persisted to localStorage, sessionStorage, or any external service

## v2 Requirements

### Additional Backends

- **BACK-04**: Microsoft OneDrive (requires pre-obtained OAuth token — headless auth not possible)
- **BACK-05**: SFTP (host, user, password or key path)
- **BACK-06**: Google Cloud Storage
- **BACK-07**: Backblaze B2
- **BACK-08**: Google Drive
- **BACK-09**: Dropbox / SharePoint

### Enhanced Config

- **CONF-04**: User can add multiple remotes to a single rclone.conf (multi-remote wizard)
- **CONF-05**: Field-level format validation per backend (e.g., Azure account name: 3–24 lowercase alphanumeric)
- **CONF-06**: Explanatory tooltips on sensitive/confusing fields (SAS token vs access key, region codes)

### Enhanced Deployment

- **DEPL-06**: User can pin a specific rclone version for reproducible deployments (instead of always latest)
- **DEPL-07**: Named RMM script variants (NinjaRMM-specific, Datto-specific execution context adjustments)
- **DEPL-08**: IntuneWinAppUtil packaging instructions displayed alongside Intune scripts

## Out of Scope

| Feature | Reason |
|---------|--------|
| Test connection / validate credentials | Requires backend proxy — CORS blocks direct cloud API calls from browser |
| Save / load configurations | No backend; credentials must not be stored in localStorage |
| User accounts / authentication | No backend — would require full architecture rethink |
| rclone mount / sync scheduling | Different problem domain (task scheduler, Windows service) |
| Auto-push to Intune via Graph API | Requires Azure AD app registration + OAuth — massive scope increase |
| macOS / Linux endpoint support | Scripts are PowerShell for Windows only in v1 |
| rclone version auto-update on endpoints | Separate lifecycle management problem |
| Config credential encryption | rclone encrypted configs require interactive unlock — incompatible with unattended deployment |

## Traceability

Which phases cover which requirements. Updated during roadmap creation.

| Requirement | Phase | Status |
|-------------|-------|--------|
| WIZD-01 | Phase 3 | Complete |
| WIZD-02 | Phase 3 | Complete |
| WIZD-03 | Phase 3 | Complete |
| WIZD-04 | Phase 3 | Complete |
| BACK-01 | Phase 3 | Complete |
| BACK-02 | Phase 3 | Complete |
| BACK-03 | Phase 3 | Complete |
| CONF-01 | Phase 2 | Complete |
| CONF-02 | Phase 4 | Pending |
| CONF-03 | Phase 4 | Pending |
| DEPL-01 | Phase 2 | Complete |
| DEPL-02 | Phase 2 | Complete |
| DEPL-03 | Phase 2 | Complete |
| DEPL-04 | Phase 2 | Complete |
| DEPL-05 | Phase 2 | Complete |
| DOWN-01 | Phase 4 | Pending |
| DOWN-02 | Phase 4 | Pending |
| DOWN-03 | Phase 4 | Pending |
| DOWN-04 | Phase 4 | Pending |
| DOWN-05 | Phase 4 | Pending |
| DOWN-06 | Phase 4 | Pending |
| SECU-01 | Phase 4 | Pending |
| SECU-02 | Phase 4 | Pending |
| SECU-03 | Phase 4 | Pending |

**Coverage:**
- v1 requirements: 24 total
- Mapped to phases: 24
- Unmapped: 0 ✓

---
*Requirements defined: 2026-03-26*
*Last updated: 2026-03-26 after roadmap creation*