role: user

content: I need to implement a new feature for the application


role: assistant

content: I can help you implement a new feature. What feature would you like to add?


content: I want to add user authentication


content:
User authentication is a good feature. I have a few questions:
1. What authentication method do you prefer? (JWT, OAuth, Session-based)
2. Do you need social login? (Google, GitHub, etc.)
3. What user data do you need to store?
4. Do you need role-based access control?
5. What's your database? (PostgreSQL, MySQL, SQLite)


content: I prefer JWT, no social login, just email and password, no roles, PostgreSQL


content:
Great choices. Here's the implementation plan:
1. Create user model with email and password hash
2. Create JWT token generation and validation
3. Create login endpoint: POST /api/auth/login
4. Create register endpoint: POST /api/auth/register
5. Create middleware for protected routes
6. Add password hashing with bcrypt
7. Add rate limiting for login attempts
8. Add password reset functionality
9. Add email verification
10. Test all endpoints


content: What about password reset?


content:
For password reset:
1. Create reset token table
2. Create forgot password endpoint: POST /api/auth/forgot-password
3. Send reset email with token
4. Create reset password endpoint: POST /api/auth/reset-password
5. Validate reset token and expiration
6. Update password and delete token
7. Send confirmation email


content: What about email verification?


content:
For email verification:
1. Add email_verified field to user model
2. Create verification token table
3. Send verification email on registration
4. Create verify email endpoint: GET /api/auth/verify-email?token=...
5. Validate token and update email_verified
6. Add middleware to check email_verified for certain routes
7. Add resend verification email endpoint


content: What about rate limiting?


content:
For rate limiting:
1. Use Redis for rate limit storage
2. Create rate limit middleware
3. Set limits: 5 login attempts per minute, 3 password resets per hour
4. Return 429 Too Many Requests when limit exceeded
5. Add X-RateLimit headers to responses
6. Log rate limit violations
7. Add whitelist for trusted IPs