Loading...
Loading...
Create non-technical documentation for project features in the docs/ folder. Use when documenting completed features, writing feature documentation, explaining how features work, or when the user asks to document the project or create docs for non-developers.
npx skill4agent add trewknowledge/agent-skills project-documentationdocs/docs/README.md# Project Documentation
## Core Features
### [User Authentication](user-authentication.md)
**Related**: User Profile, Session Management
**Summary**: Account creation, login, password reset
### [Payment Processing](payment-processing.md)
**Related**: Order Management, Email Notifications
**Summary**: Stripe integration for payments, refunds, and disputes
### [Dashboard Analytics](dashboard-analytics.md)
**Related**: User Authentication (requires login)
**Summary**: Real-time metrics and reporting
## Secondary Features
### [Email Notifications](email-notifications.md)
**Related**: Most core features
**Summary**: SendGrid integration with queued processing
## Integrations
### [Stripe API](stripe-integration.md)
**Related**: Payment Processing
**Summary**: Payment gateway for transactions and webhooksdocs/docs/
├── user-authentication.md
├── payment-processing.md
├── email-notifications.md
└── dashboard-analytics.md# [Feature Name]
## What It Does
[1-2 paragraph overview of what this feature accomplishes from the user's perspective]
## Why We Built It
[Explain the problem this solves or the need it fulfills]
## How It Works
[Step-by-step explanation of the feature's behavior and logic, without code details]
### Key Components
- **[Component 1]**: What it does
- **[Component 2]**: What it does
- **[Component 3]**: What it does
### Data Flow
[What information enters the feature, how it's transformed, and what comes out]
## User Experience
[Describe what users see and how they interact with this feature]
## Expected Behavior
### Success Scenarios
- **Scenario 1**: [Input] → [Expected Result]
- **Scenario 2**: [Input] → [Expected Result]
### Error Scenarios
- **When [condition]**: [Expected behavior/message]
- **When [condition]**: [Expected behavior/message]
## Business Rules
[Critical validation rules, constraints, and logic that must always be enforced]
**Examples:**
- Passwords must be 8+ characters with 1 number and 1 special character
- Users cannot delete items that are currently in use
- Refunds are only allowed within 30 days of purchase
## Dependencies
### Required Features/Systems
- [Feature/System]: Why it's needed
### Affected Features
- [Feature]: How this feature impacts it
### External Services
- [Service]: What it's used for
## Common Issues & Edge Cases
[Document known edge cases, gotchas, or areas that commonly cause confusion]
**Examples:**
- When the external API times out, the system should queue and retry
- If a user has multiple sessions, changes in one should reflect in all
- Empty state: what happens when there's no data to display
## Future Considerations
[Optional: Known limitations or planned enhancements]# User Authentication
## What It Does
Allows users to create accounts and securely log in to access their personalized dashboard. Users can also reset their password if they forget it.
## Why We Built It
We needed a secure way to identify users and protect their personal data. Each user has unique settings and history that should only be accessible to them.
## How It Works
### Registration
When someone signs up, they provide an email address and create a password. The system checks that the email isn't already in use and that the password meets security requirements (at least 8 characters, one number, one special character). We send a verification email to confirm they own the email address.
### Login Process
Users enter their email and password. The system verifies these credentials match what's stored. If correct, they get access to their account. After 3 failed attempts, the account is temporarily locked for 15 minutes to prevent unauthorized access attempts.
### Password Reset
If a user forgets their password, they can request a reset link via email. The link is valid for 1 hour. Clicking it allows them to set a new password.
### Data Flow
Email + Password → Validation → Password Security Check → Store Account → Send Verification Email → User Clicks Link → Account Activated
## User Experience
- Registration form with email and password fields
- Validation messages appear in real-time (e.g., "Password too short")
- Verification email arrives within 1-2 minutes
- Login page with "Forgot Password?" link
- Error messages are helpful but don't reveal whether an email exists in the system
## Expected Behavior
### Success Scenarios
- **Valid registration**: User receives verification email within 2 minutes, can click link and access account
- **Valid login**: User enters correct credentials, immediately redirected to dashboard
- **Password reset request**: User receives reset link within 2 minutes, link works for 1 hour
### Error Scenarios
- **Duplicate email**: Show "An account with this email already exists" message
- **Weak password**: Show specific requirements not met (e.g., "Password must include a number")
- **Failed login (1-2 attempts)**: Show "Invalid email or password" message
- **Failed login (3 attempts)**: Show "Account locked for 15 minutes due to too many failed attempts"
- **Expired reset link**: Show "This reset link has expired. Please request a new one."
- **Unverified account login**: Show "Please verify your email before logging in" with option to resend
## Business Rules
- Email addresses must be unique across all accounts (case-insensitive: test@example.com = Test@Example.com)
- Passwords must be at least 8 characters with 1 number and 1 special character (!@#$%^&*)
- Passwords expire after 90 days and users must create a new one
- New password cannot match previous 3 passwords
- Verification emails expire after 24 hours
- Users can't register with disposable email services (list maintained separately)
- Account lockout after 3 failed attempts lasts exactly 15 minutes
- Password reset links expire after 1 hour
- Only one active reset link per account - requesting new one invalidates previous
## Dependencies
### Required Features/Systems
- **Email delivery service**: For verification and password reset emails. If service is down, registration/reset will fail gracefully with "Unable to send email, please try again later"
- **Session management**: Required to maintain logged-in state
### Affected Features
- **User profile**: Cannot be accessed without authentication
- **Dashboard**: Requires active session
- **Settings**: Changes require password re-confirmation
### External Services
- **Email service**: SendGrid for transactional emails
- **Disposable email checker**: API to validate email domains
## Common Issues & Edge Cases
**Multiple tabs/sessions**: If user logs out in one tab, all other tabs should immediately reflect logged-out state. Currently handled via session token validation on each request.
**Email service downtime**: System will retry sending 3 times over 10 minutes. If all fail, user sees error message but account is created - they can request verification resend from login page.
**Case sensitivity**: Email addresses are stored lowercase and compared case-insensitively. "Test@Example.com" and "test@example.com" are treated as same user.
**Timing attacks**: Login error messages deliberately don't distinguish between "email not found" and "wrong password" to prevent account enumeration.
**Clock skew**: Reset links use server time, not user device time, to prevent timezone issues.
## Future Considerations
- Add two-factor authentication option
- Support social login (Google, GitHub)
- Add "Remember me" option for extended sessions# Authentication
Uses JWT tokens with bcrypt hashing. The AuthController handles login() and register() methods. Password validation uses regex pattern /^(?=.*[0-9])(?=.*[!@#$%^&*])/.
Database schema includes users table with email, password_hash, and created_at columns.docs/docs/README.mddocs/README.mddocs/