# Implementation Plan - [x] 1. Set up authentication infrastructure - Install and configure NextAuth.js v5, bcryptjs, and zod - Create auth configuration file with credentials provider - Set up environment variables for auth secrets - _Requirements: 1.1, 2.1_ - [x] 2. Update database schema for multi-user support - Add User model with email, passwordHash, and name fields - Add Collaborator model for list sharing - Add Invitation model for sharing invitations - Add ownerId field to List model - Add necessary indexes for performance - _Requirements: 1.1, 4.1, 5.1_ - [ ]* 2.1 Write property test for user registration - **Property 1: Registration creates unique user** - **Validates: Requirements 1.1** - [ ]* 2.2 Write property test for duplicate email rejection - **Property 2: Duplicate email rejection** - **Validates: Requirements 1.2** - [ ]* 2.3 Write property test for password hashing - **Property 3: Password hashing on registration** - **Validates: Requirements 1.3** - [x] 3. Implement user registration functionality - Create registration server action with email/password validation - Implement password hashing with bcrypt - Add email uniqueness check - Create session after successful registration - _Requirements: 1.1, 1.2, 1.3, 1.4, 1.5_ - [ ]* 3.1 Write property test for registration session creation - **Property 4: Registration creates session** - **Validates: Requirements 1.4** - [ ]* 3.2 Write property test for password length validation - **Property 5: Password length validation** - **Validates: Requirements 1.5** - [x] 4. Implement authentication functionality - Create login server action with credential validation - Implement password verification with bcrypt - Create session on successful login - Handle invalid credentials with appropriate errors - _Requirements: 2.1, 2.2_ - [ ]* 4.1 Write property test for valid credentials - **Property 6: Valid credentials create session** - **Validates: Requirements 2.1** - [ ]* 4.2 Write property test for invalid credentials - **Property 7: Invalid credentials rejection** - **Validates: Requirements 2.2** - [x] 5. Implement session management - Configure JWT session strategy in NextAuth - Implement session validation middleware - Create logout functionality - Handle session expiration - _Requirements: 2.4, 2.5, 3.1, 3.2, 3.4_ - [ ]* 5.1 Write property test for session expiration - **Property 8: Session expiration enforcement** - **Validates: Requirements 2.4** - [ ]* 5.2 Write property test for logout - **Property 9: Logout terminates session** - **Validates: Requirements 2.5** - [ ]* 5.3 Write property test for secure token generation - **Property 10: Secure token generation** - **Validates: Requirements 3.1** - [ ]* 5.4 Write property test for session persistence - **Property 11: Session persistence** - **Validates: Requirements 3.2** - [ ]* 5.5 Write property test for session duration - **Property 12: Session duration persistence** - **Validates: Requirements 3.4** - [x] 6. Create authentication UI components - Build LoginForm component with email/password inputs - Build RegisterForm component with validation - Create authentication error display page - Add loading states and error handling - _Requirements: 1.1, 2.1_ - [x] 7. Implement route protection middleware - Create Next.js middleware for authentication checks - Protect main routes (/, /list/*, /profile/*) - Redirect unauthenticated users to login - _Requirements: 3.3, 3.5_ - [x] 8. Update list operations for ownership - Modify createList to assign ownerId - Update getLists to filter by user access - Add ownership checks to updateList and deleteList - Implement cascade deletion for user account deletion - _Requirements: 4.1, 4.2, 4.3, 4.5_ - [ ]* 8.1 Write property test for list ownership assignment - **Property 13: List ownership assignment** - **Validates: Requirements 4.1** - [ ]* 8.2 Write property test for list access filtering - **Property 14: List access filtering** - **Validates: Requirements 4.2, 4.4** - [ ]* 8.3 Write property test for unauthorized access denial - **Property 15: Unauthorized list access denial** - **Validates: Requirements 4.3** - [ ]* 8.4 Write property test for account deletion cascade - **Property 16: Account deletion cascades to lists** - **Validates: Requirements 4.5** - [x] 9. Implement permission utilities - Create canAccessList function - Create canEditList function - Create canDeleteList function - Create getPermission function - _Requirements: 4.3, 6.2, 6.3_ - [x] 10. Update item operations for access control - Add access checks to createItem - Add access checks to updateItem, deleteItem, toggleItem - Enforce editor vs viewer permissions - Filter items by list access in queries - _Requirements: 6.2, 6.3, 9.2_ - [ ]* 10.1 Write property test for item access through list permission - **Property 34: Item access through list permission** - **Validates: Requirements 9.2** - [x] 11. Implement invitation system - Create inviteUserToList server action - Create getInvitations server action - Create acceptInvitation server action - Create declineInvitation server action - Add invitation expiration logic - _Requirements: 5.1, 5.2, 5.3, 8.1, 8.5_ - [ ]* 11.1 Write property test for invitation creation - **Property 17: Invitation creation with unique ID** - **Validates: Requirements 5.1, 6.1** - [ ]* 11.2 Write property test for invitation acceptance - **Property 18: Invitation acceptance grants access** - **Validates: Requirements 5.2** - [ ]* 11.3 Write property test for invitation decline - **Property 19: Invitation decline removes record** - **Validates: Requirements 5.3** - [ ]* 11.4 Write property test for invitation visibility - **Property 30: Invitation visibility** - **Validates: Requirements 8.1** - [ ]* 11.5 Write property test for invitation details - **Property 31: Invitation details completeness** - **Validates: Requirements 8.2** - [ ]* 11.6 Write property test for invitation removal - **Property 32: Invitation removal after action** - **Validates: Requirements 8.4** - [ ]* 11.7 Write property test for invitation timestamp - **Property 33: Invitation timestamp recording** - **Validates: Requirements 8.5** - [x] 12. Implement collaborator management - Create getCollaborators server action - Create updateCollaboratorPermission server action - Create removeCollaborator server action - Add permission level enforcement - _Requirements: 5.4, 5.5, 6.1, 6.5_ - [ ]* 12.1 Write property test for collaborator list - **Property 20: Collaborator list completeness** - **Validates: Requirements 5.4** - [ ]* 12.2 Write property test for access revocation - **Property 21: Access revocation enforcement** - **Validates: Requirements 5.5** - [ ]* 12.3 Write property test for editor permissions - **Property 22: Editor permission allows modifications** - **Validates: Requirements 6.2** - [ ]* 12.4 Write property test for viewer permissions - **Property 23: Viewer permission prevents modifications** - **Validates: Requirements 6.3, 6.4** - [ ]* 12.5 Write property test for permission updates - **Property 24: Permission update enforcement** - **Validates: Requirements 6.5** - [x] 13. Create sharing UI components - Build InvitationCard component - Build CollaboratorList component - Build ShareListModal component - Build PermissionBadge component - Add invitations page - _Requirements: 5.1, 5.4, 8.1, 8.2_ - [x] 14. Implement profile management - Create profile page and ProfileForm component - Implement updateProfile server action - Create PasswordChangeForm component - Implement updatePassword server action with current password verification - Add email update with uniqueness check - _Requirements: 7.1, 7.2, 7.3, 7.4, 7.5_ - [ ]* 14.1 Write property test for profile updates - **Property 25: Profile update persistence** - **Validates: Requirements 7.1** - [ ]* 14.2 Write property test for password change validation - **Property 26: Password change requires current password** - **Validates: Requirements 7.2** - [ ]* 14.3 Write property test for password hashing on change - **Property 27: Password hashing on change** - **Validates: Requirements 7.3** - [ ]* 14.4 Write property test for email uniqueness - **Property 28: Email uniqueness validation** - **Validates: Requirements 7.4** - [ ]* 14.5 Write property test for profile data exposure - **Property 29: Profile data exposure protection** - **Validates: Requirements 7.5** - [x] 15. Update existing components for multi-user - Modify ListCard to show sharing indicator - Update ListDetailView with share button and permission display - Modify ItemForm to disable editing for viewers - Update navigation to include profile and invitations links - _Requirements: 6.3_ - [x] 16. Implement data migration for existing lists - Create migration script for existing anonymous lists - Add UI for users to claim existing lists on first registration - Ensure all lists have an owner after migration - Preserve all existing list and item data - _Requirements: 10.2, 10.3, 10.4, 10.5_ - [ ]* 16.1 Write property test for migration data preservation - **Property 35: Migration data preservation** - **Validates: Requirements 10.3** - [x] 17. Add security enhancements - Implement rate limiting on login attempts - Add CSRF protection - Implement secure session cookie configuration - Add input sanitization for all user inputs - _Requirements: 9.3, 9.4, 9.5_ - [ ] 18. Checkpoint - Ensure all tests pass - Ensure all tests pass, ask the user if questions arise. - [x] 19. Update PWA service worker for authentication - Handle authentication errors in offline mode - Cache authentication-related pages appropriately - Update manifest if needed - Test offline behavior with authentication - _Requirements: 4.4_ - [ ] 20. Final integration and testing - Test complete authentication flow end-to-end - Test list sharing workflow end-to-end - Verify permission enforcement across all operations - Test migration process with sample data - Verify PWA functionality still works - _Requirements: All_ - [ ] 21. Final Checkpoint - Ensure all tests pass - Ensure all tests pass, ask the user if questions arise.