Paul Bailey
0e609af924
- Add authentication pages to static cache (/auth/login, /auth/register, /auth/error) - Implement special handling for authentication API requests (network-only with offline error) - Add authentication page caching strategy (cache-first with network fallback) - Prevent caching of authentication errors (401, 403) - Enhance offline page with online detection and auto-redirect - Add authentication notice to offline page - Update cache version to v2 for proper invalidation - Create PWA_AUTH_GUIDE.md documentation Task: 19. Update PWA service worker for authentication Requirements: 4.4
284 lines
10 KiB
Markdown
284 lines
10 KiB
Markdown
# Implementation Plan
|
|
|
|
- [x] 1. Set up authentication infrastructure
|
|
- Install and configure NextAuth.js v5, bcryptjs, and zod
|
|
- Create auth configuration file with credentials provider
|
|
- Set up environment variables for auth secrets
|
|
- _Requirements: 1.1, 2.1_
|
|
|
|
- [x] 2. Update database schema for multi-user support
|
|
- Add User model with email, passwordHash, and name fields
|
|
- Add Collaborator model for list sharing
|
|
- Add Invitation model for sharing invitations
|
|
- Add ownerId field to List model
|
|
- Add necessary indexes for performance
|
|
- _Requirements: 1.1, 4.1, 5.1_
|
|
|
|
- [ ]* 2.1 Write property test for user registration
|
|
- **Property 1: Registration creates unique user**
|
|
- **Validates: Requirements 1.1**
|
|
|
|
- [ ]* 2.2 Write property test for duplicate email rejection
|
|
- **Property 2: Duplicate email rejection**
|
|
- **Validates: Requirements 1.2**
|
|
|
|
- [ ]* 2.3 Write property test for password hashing
|
|
- **Property 3: Password hashing on registration**
|
|
- **Validates: Requirements 1.3**
|
|
|
|
- [x] 3. Implement user registration functionality
|
|
- Create registration server action with email/password validation
|
|
- Implement password hashing with bcrypt
|
|
- Add email uniqueness check
|
|
- Create session after successful registration
|
|
- _Requirements: 1.1, 1.2, 1.3, 1.4, 1.5_
|
|
|
|
- [ ]* 3.1 Write property test for registration session creation
|
|
- **Property 4: Registration creates session**
|
|
- **Validates: Requirements 1.4**
|
|
|
|
- [ ]* 3.2 Write property test for password length validation
|
|
- **Property 5: Password length validation**
|
|
- **Validates: Requirements 1.5**
|
|
|
|
- [x] 4. Implement authentication functionality
|
|
- Create login server action with credential validation
|
|
- Implement password verification with bcrypt
|
|
- Create session on successful login
|
|
- Handle invalid credentials with appropriate errors
|
|
- _Requirements: 2.1, 2.2_
|
|
|
|
- [ ]* 4.1 Write property test for valid credentials
|
|
- **Property 6: Valid credentials create session**
|
|
- **Validates: Requirements 2.1**
|
|
|
|
- [ ]* 4.2 Write property test for invalid credentials
|
|
- **Property 7: Invalid credentials rejection**
|
|
- **Validates: Requirements 2.2**
|
|
|
|
- [x] 5. Implement session management
|
|
- Configure JWT session strategy in NextAuth
|
|
- Implement session validation middleware
|
|
- Create logout functionality
|
|
- Handle session expiration
|
|
- _Requirements: 2.4, 2.5, 3.1, 3.2, 3.4_
|
|
|
|
- [ ]* 5.1 Write property test for session expiration
|
|
- **Property 8: Session expiration enforcement**
|
|
- **Validates: Requirements 2.4**
|
|
|
|
- [ ]* 5.2 Write property test for logout
|
|
- **Property 9: Logout terminates session**
|
|
- **Validates: Requirements 2.5**
|
|
|
|
- [ ]* 5.3 Write property test for secure token generation
|
|
- **Property 10: Secure token generation**
|
|
- **Validates: Requirements 3.1**
|
|
|
|
- [ ]* 5.4 Write property test for session persistence
|
|
- **Property 11: Session persistence**
|
|
- **Validates: Requirements 3.2**
|
|
|
|
- [ ]* 5.5 Write property test for session duration
|
|
- **Property 12: Session duration persistence**
|
|
- **Validates: Requirements 3.4**
|
|
|
|
- [x] 6. Create authentication UI components
|
|
- Build LoginForm component with email/password inputs
|
|
- Build RegisterForm component with validation
|
|
- Create authentication error display page
|
|
- Add loading states and error handling
|
|
- _Requirements: 1.1, 2.1_
|
|
|
|
- [x] 7. Implement route protection middleware
|
|
- Create Next.js middleware for authentication checks
|
|
- Protect main routes (/, /list/*, /profile/*)
|
|
- Redirect unauthenticated users to login
|
|
- _Requirements: 3.3, 3.5_
|
|
|
|
- [x] 8. Update list operations for ownership
|
|
- Modify createList to assign ownerId
|
|
- Update getLists to filter by user access
|
|
- Add ownership checks to updateList and deleteList
|
|
- Implement cascade deletion for user account deletion
|
|
- _Requirements: 4.1, 4.2, 4.3, 4.5_
|
|
|
|
- [ ]* 8.1 Write property test for list ownership assignment
|
|
- **Property 13: List ownership assignment**
|
|
- **Validates: Requirements 4.1**
|
|
|
|
- [ ]* 8.2 Write property test for list access filtering
|
|
- **Property 14: List access filtering**
|
|
- **Validates: Requirements 4.2, 4.4**
|
|
|
|
- [ ]* 8.3 Write property test for unauthorized access denial
|
|
- **Property 15: Unauthorized list access denial**
|
|
- **Validates: Requirements 4.3**
|
|
|
|
- [ ]* 8.4 Write property test for account deletion cascade
|
|
- **Property 16: Account deletion cascades to lists**
|
|
- **Validates: Requirements 4.5**
|
|
|
|
- [x] 9. Implement permission utilities
|
|
- Create canAccessList function
|
|
- Create canEditList function
|
|
- Create canDeleteList function
|
|
- Create getPermission function
|
|
- _Requirements: 4.3, 6.2, 6.3_
|
|
|
|
- [x] 10. Update item operations for access control
|
|
- Add access checks to createItem
|
|
- Add access checks to updateItem, deleteItem, toggleItem
|
|
- Enforce editor vs viewer permissions
|
|
- Filter items by list access in queries
|
|
- _Requirements: 6.2, 6.3, 9.2_
|
|
|
|
- [ ]* 10.1 Write property test for item access through list permission
|
|
- **Property 34: Item access through list permission**
|
|
- **Validates: Requirements 9.2**
|
|
|
|
- [x] 11. Implement invitation system
|
|
- Create inviteUserToList server action
|
|
- Create getInvitations server action
|
|
- Create acceptInvitation server action
|
|
- Create declineInvitation server action
|
|
- Add invitation expiration logic
|
|
- _Requirements: 5.1, 5.2, 5.3, 8.1, 8.5_
|
|
|
|
- [ ]* 11.1 Write property test for invitation creation
|
|
- **Property 17: Invitation creation with unique ID**
|
|
- **Validates: Requirements 5.1, 6.1**
|
|
|
|
- [ ]* 11.2 Write property test for invitation acceptance
|
|
- **Property 18: Invitation acceptance grants access**
|
|
- **Validates: Requirements 5.2**
|
|
|
|
- [ ]* 11.3 Write property test for invitation decline
|
|
- **Property 19: Invitation decline removes record**
|
|
- **Validates: Requirements 5.3**
|
|
|
|
- [ ]* 11.4 Write property test for invitation visibility
|
|
- **Property 30: Invitation visibility**
|
|
- **Validates: Requirements 8.1**
|
|
|
|
- [ ]* 11.5 Write property test for invitation details
|
|
- **Property 31: Invitation details completeness**
|
|
- **Validates: Requirements 8.2**
|
|
|
|
- [ ]* 11.6 Write property test for invitation removal
|
|
- **Property 32: Invitation removal after action**
|
|
- **Validates: Requirements 8.4**
|
|
|
|
- [ ]* 11.7 Write property test for invitation timestamp
|
|
- **Property 33: Invitation timestamp recording**
|
|
- **Validates: Requirements 8.5**
|
|
|
|
- [x] 12. Implement collaborator management
|
|
- Create getCollaborators server action
|
|
- Create updateCollaboratorPermission server action
|
|
- Create removeCollaborator server action
|
|
- Add permission level enforcement
|
|
- _Requirements: 5.4, 5.5, 6.1, 6.5_
|
|
|
|
- [ ]* 12.1 Write property test for collaborator list
|
|
- **Property 20: Collaborator list completeness**
|
|
- **Validates: Requirements 5.4**
|
|
|
|
- [ ]* 12.2 Write property test for access revocation
|
|
- **Property 21: Access revocation enforcement**
|
|
- **Validates: Requirements 5.5**
|
|
|
|
- [ ]* 12.3 Write property test for editor permissions
|
|
- **Property 22: Editor permission allows modifications**
|
|
- **Validates: Requirements 6.2**
|
|
|
|
- [ ]* 12.4 Write property test for viewer permissions
|
|
- **Property 23: Viewer permission prevents modifications**
|
|
- **Validates: Requirements 6.3, 6.4**
|
|
|
|
- [ ]* 12.5 Write property test for permission updates
|
|
- **Property 24: Permission update enforcement**
|
|
- **Validates: Requirements 6.5**
|
|
|
|
- [x] 13. Create sharing UI components
|
|
- Build InvitationCard component
|
|
- Build CollaboratorList component
|
|
- Build ShareListModal component
|
|
- Build PermissionBadge component
|
|
- Add invitations page
|
|
- _Requirements: 5.1, 5.4, 8.1, 8.2_
|
|
|
|
- [x] 14. Implement profile management
|
|
- Create profile page and ProfileForm component
|
|
- Implement updateProfile server action
|
|
- Create PasswordChangeForm component
|
|
- Implement updatePassword server action with current password verification
|
|
- Add email update with uniqueness check
|
|
- _Requirements: 7.1, 7.2, 7.3, 7.4, 7.5_
|
|
|
|
- [ ]* 14.1 Write property test for profile updates
|
|
- **Property 25: Profile update persistence**
|
|
- **Validates: Requirements 7.1**
|
|
|
|
- [ ]* 14.2 Write property test for password change validation
|
|
- **Property 26: Password change requires current password**
|
|
- **Validates: Requirements 7.2**
|
|
|
|
- [ ]* 14.3 Write property test for password hashing on change
|
|
- **Property 27: Password hashing on change**
|
|
- **Validates: Requirements 7.3**
|
|
|
|
- [ ]* 14.4 Write property test for email uniqueness
|
|
- **Property 28: Email uniqueness validation**
|
|
- **Validates: Requirements 7.4**
|
|
|
|
- [ ]* 14.5 Write property test for profile data exposure
|
|
- **Property 29: Profile data exposure protection**
|
|
- **Validates: Requirements 7.5**
|
|
|
|
- [x] 15. Update existing components for multi-user
|
|
- Modify ListCard to show sharing indicator
|
|
- Update ListDetailView with share button and permission display
|
|
- Modify ItemForm to disable editing for viewers
|
|
- Update navigation to include profile and invitations links
|
|
- _Requirements: 6.3_
|
|
|
|
- [x] 16. Implement data migration for existing lists
|
|
- Create migration script for existing anonymous lists
|
|
- Add UI for users to claim existing lists on first registration
|
|
- Ensure all lists have an owner after migration
|
|
- Preserve all existing list and item data
|
|
- _Requirements: 10.2, 10.3, 10.4, 10.5_
|
|
|
|
- [ ]* 16.1 Write property test for migration data preservation
|
|
- **Property 35: Migration data preservation**
|
|
- **Validates: Requirements 10.3**
|
|
|
|
- [x] 17. Add security enhancements
|
|
- Implement rate limiting on login attempts
|
|
- Add CSRF protection
|
|
- Implement secure session cookie configuration
|
|
- Add input sanitization for all user inputs
|
|
- _Requirements: 9.3, 9.4, 9.5_
|
|
|
|
- [ ] 18. Checkpoint - Ensure all tests pass
|
|
- Ensure all tests pass, ask the user if questions arise.
|
|
|
|
- [x] 19. Update PWA service worker for authentication
|
|
- Handle authentication errors in offline mode
|
|
- Cache authentication-related pages appropriately
|
|
- Update manifest if needed
|
|
- Test offline behavior with authentication
|
|
- _Requirements: 4.4_
|
|
|
|
- [ ] 20. Final integration and testing
|
|
- Test complete authentication flow end-to-end
|
|
- Test list sharing workflow end-to-end
|
|
- Verify permission enforcement across all operations
|
|
- Test migration process with sample data
|
|
- Verify PWA functionality still works
|
|
- _Requirements: All_
|
|
|
|
- [ ] 21. Final Checkpoint - Ensure all tests pass
|
|
- Ensure all tests pass, ask the user if questions arise.
|