// engine/spec-templates/templates-auth-crud.ts — Auth JWT + CRUD entity templates.
// Extracted from catalog.ts to keep file sizes within limits.
/** JWT Authentication spec template. */
export const AUTH_JWT_TEMPLATE = {
    id: 'auth-jwt',
    name: 'JWT Authentication',
    category: 'auth',
    description: 'User authentication flow with JWT tokens: login, logout, refresh, and guards.',
    tags: ['auth', 'jwt', 'security', 'session'],
    complexityScore: 'M',
    estimationBase: {
        hoursMin: 16,
        hoursMax: 32,
        notes: 'Includes token rotation, rate limiting, and brute-force protection',
    },
    criteria: [
        { id: 'AC-1', title: 'Login endpoint', required: true },
        { id: 'AC-2', title: 'Protected route guard', required: true },
        { id: 'AC-3', title: 'Token refresh', required: true },
        { id: 'AC-4', title: 'Logout', required: false },
        { id: 'AC-5', title: 'Security requirements', required: true },
    ],
    variables: [
        {
            key: 'EntityName',
            label: 'Entity name',
            description: 'The name of the authenticated entity (User, Admin, Member…)',
            example: 'User',
            required: true,
        },
        {
            key: 'TokenExpiry',
            label: 'Token expiry',
            description: 'JWT access token expiry duration',
            example: '15 minutes',
            required: false,
            defaultValue: '15 minutes',
        },
    ],
    huTemplate: `# HU: JWT Authentication for {{EntityName}}

## User Story
As a {{EntityName}}, I want to securely authenticate with JWT tokens so that my session is stateless and protected.

## Acceptance Criteria

### AC-1: Login endpoint
- [ ] POST /auth/login accepts credentials and returns access + refresh tokens
- [ ] Access token expires after {{TokenExpiry}}
- [ ] Refresh token stored server-side and rotated on each use
- [ ] Failed login returns 401 with no sensitive detail

### AC-2: Protected route guard
- [ ] Every protected endpoint validates the Bearer token
- [ ] Expired or invalid tokens return 401
- [ ] Tampered tokens are rejected and logged

### AC-3: Token refresh
- [ ] POST /auth/refresh issues new access token given a valid refresh token
- [ ] Refresh token is single-use (rotation strategy)

### AC-4: Logout
- [ ] POST /auth/logout invalidates the refresh token server-side
- [ ] Client-side storage is cleared by the caller

### AC-5: Security requirements
- [ ] Passwords stored as salted hash (bcrypt or Argon2 equivalent)
- [ ] HTTPS enforced in production
- [ ] Rate limiting on /auth/login (max 5 requests/minute per IP)
- [ ] Brute-force protection with account lockout after N failures

## Out of Scope
- OAuth2 / SSO providers (create separate spec)
- Multi-factor authentication (create separate spec)
`,
    fichaTecnicaTemplate: `# FICHA TÉCNICA: JWT Authentication for {{EntityName}}

## Affected Files
- auth/login handler
- auth/refresh handler
- auth/logout handler
- auth/middleware (token guard)
- storage/token-store (refresh token persistence)
- config/auth-config (token secrets, expiry settings)

## Types / Entities
- \`{{EntityName}}\`: id, email, passwordHash, createdAt
- \`AuthTokenPair\`: accessToken, refreshToken, expiresIn
- \`RefreshTokenRecord\`: token, entityId, expiresAt, usedAt

## Risks
- Token secret exposure → rotate secrets without downtime (risk: high)
- Refresh token replay attack → single-use rotation required
- Brute force on login → rate limiting + lockout required

## Estimation (rough)
- Dev: 8–16 hours
- Review: 2–4 hours
- Difficulty: 3/5
`,
    progressTemplate: `# PROGRESS: JWT Authentication for {{EntityName}}

## Status: draft

## Criteria
- [ ] AC-1: Login endpoint
- [ ] AC-2: Protected route guard
- [ ] AC-3: Token refresh
- [ ] AC-4: Logout
- [ ] AC-5: Security requirements
`,
};
/** CRUD Entity spec template. */
export const CRUD_ENTITY_TEMPLATE = {
    id: 'crud-entity',
    name: 'CRUD Entity',
    category: 'crud',
    description: 'Full Create/Read/Update/Delete lifecycle for any data entity.',
    tags: ['crud', 'rest', 'api', 'database'],
    complexityScore: 'S',
    estimationBase: {
        hoursMin: 6,
        hoursMax: 12,
        notes: 'Standard CRUD with validation and soft delete',
    },
    criteria: [
        { id: 'AC-1', title: 'Create entity', required: true },
        { id: 'AC-2', title: 'List entities', required: true },
        { id: 'AC-3', title: 'Get single entity', required: true },
        { id: 'AC-4', title: 'Update entity', required: true },
        { id: 'AC-5', title: 'Delete entity', required: true },
        { id: 'AC-6', title: 'Validation', required: true },
    ],
    variables: [
        {
            key: 'EntityName',
            label: 'Entity name',
            description: 'Name of the entity (singular, PascalCase)',
            example: 'Product',
            required: true,
        },
        {
            key: 'EntityPlural',
            label: 'Entity plural',
            description: 'Plural form of the entity name',
            example: 'Products',
            required: true,
        },
    ],
    huTemplate: `# HU: CRUD for {{EntityName}}

## User Story
As a user, I want to create, view, update and delete {{EntityPlural}} so that I can manage them effectively.

## Acceptance Criteria

### AC-1: Create {{EntityName}}
- [ ] POST /{{EntityPlural}} accepts valid payload and persists the entity
- [ ] Duplicate detection where applicable
- [ ] Returns the created entity with generated ID and timestamps

### AC-2: List {{EntityPlural}}
- [ ] GET /{{EntityPlural}} returns paginated list
- [ ] Supports filtering and sorting by key fields
- [ ] Empty list returns 200 with empty array (not 404)

### AC-3: Get single {{EntityName}}
- [ ] GET /{{EntityPlural}}/:id returns the entity or 404
- [ ] Soft-deleted entities return 404

### AC-4: Update {{EntityName}}
- [ ] PATCH /{{EntityPlural}}/:id applies partial update
- [ ] PUT /{{EntityPlural}}/:id replaces the full entity
- [ ] Returns updated entity on success

### AC-5: Delete {{EntityName}}
- [ ] DELETE /{{EntityPlural}}/:id performs soft delete by default
- [ ] Hard delete available as a privileged action
- [ ] Returns 204 No Content on success

### AC-6: Validation
- [ ] All inputs validated at the API boundary
- [ ] Invalid fields return 422 with per-field error messages
`,
    fichaTecnicaTemplate: `# FICHA TÉCNICA: CRUD for {{EntityName}}

## Affected Files
- handlers/{{EntityPlural}}/create
- handlers/{{EntityPlural}}/list
- handlers/{{EntityPlural}}/get
- handlers/{{EntityPlural}}/update
- handlers/{{EntityPlural}}/delete
- storage/{{EntityPlural}}-repository
- types/{{EntityName}}

## Types / Entities
- \`{{EntityName}}\`: id, createdAt, updatedAt, deletedAt (nullable)
- \`Create{{EntityName}}Input\`: entity fields (validated)
- \`Update{{EntityName}}Input\`: partial entity fields
- \`List{{EntityPlural}}Query\`: page, limit, sortBy, order, filters

## Risks
- Missing soft-delete → data loss risk
- Unbounded list without pagination → performance risk
- Missing input validation → injection risk

## Estimation (rough)
- Dev: 6–12 hours
- Review: 1–3 hours
- Difficulty: 2/5
`,
    progressTemplate: `# PROGRESS: CRUD for {{EntityName}}

## Status: draft

## Criteria
- [ ] AC-1: Create {{EntityName}}
- [ ] AC-2: List {{EntityPlural}}
- [ ] AC-3: Get single {{EntityName}}
- [ ] AC-4: Update {{EntityName}}
- [ ] AC-5: Delete {{EntityName}}
- [ ] AC-6: Validation
`,
};
//# sourceMappingURL=templates-auth-crud.js.map