# Technology Stack

## Backend
- **Language**: TypeScript 5.0+
- **Framework**: Express.js 4.18+
- **Database**: PostgreSQL 15+
- **ORM**: Prisma 5.0+
- **Validation**: Zod
- **Authentication**: JWT (jsonwebtoken)

## Code Standards

### TypeScript
- Strict mode enabled
- No `any` type
- Prefer interfaces over types for objects

### Error Handling
```typescript
// ✅ Good
try {
  const result = await service.create(data);
  return res.status(201).json(result);
} catch (error) {
  if (error instanceof ValidationError) {
    return res.status(400).json({ error: error.message });
  }
  throw error;
}

// ❌ Bad
try {
  const result = await service.create(data);
  return res.status(201).json(result);
} catch (error) {
  console.log(error);
  return res.status(500).json({ error: 'Error' });
}

# Product: Todo List API

## Overview
REST API for managing todo items with user authentication.

## Core Features
1. User registration and login
2. Create, read, update, delete todos
3. Mark todos as complete/incomplete
4. Filter todos by status
5. User can only access their own todos

## Business Rules
- User must be authenticated to access todos
- Todo title is required (1-200 characters)
- Todo description is optional (max 1000 characters)
- Todos belong to users (one-to-many)
- Completed todos cannot be deleted (must archive)

## API Endpoints
- POST /api/auth/register - Register new user
- POST /api/auth/login - Login user
- GET /api/todos - List user's todos
- POST /api/todos - Create todo
- GET /api/todos/:id - Get todo detail
- PUT /api/todos/:id - Update todo
- DELETE /api/todos/:id - Delete todo
- PATCH /api/todos/:id/complete - Mark as complete

# Testing Guidelines

## Test Structure
- Use AAA pattern (Arrange, Act, Assert)
- One test file per source file
- Clear test descriptions

## Test Coverage
- Unit tests: Services and utilities
- Integration tests: API endpoints
- Minimum 80% coverage

## Test Data
- Use factories for test data
- Clean database before each test
- Never use production data

## Example
```typescript
describe('TodoService', () => {
  describe('createTodo', () => {
    it('should create todo with valid data', async () => {
      // Arrange
      const userId = 'user-123';
      const todoData = { title: 'Test todo' };
      
      // Act
      const todo = await todoService.createTodo(userId, todoData);
      
      // Assert
      expect(todo.title).toBe(todoData.title);
      expect(todo.userId).toBe(userId);
      expect(todo.completed).toBe(false);
    });
  });
});

# Requirements: Todo List API

## User Stories

### US-1: User Registration
**Là** người dùng mới
**Tôi muốn** đăng ký tài khoản
**Để** sử dụng ứng dụng

**Acceptance Criteria:**
- WHEN user submits valid email and password, the system SHALL create new account
- IF email already exists, THEN return 400 error
- WHERE password < 8 characters, the system SHALL reject
- WHEN registration successful, the system SHALL return JWT token

### US-2: User Login
**Là** người dùng đã đăng ký
**Tôi muốn** đăng nhập
**Để** truy cập todos của tôi

**Acceptance Criteria:**
- WHEN credentials are correct, the system SHALL return JWT token
- IF email not found, THEN return 401 error
- IF password incorrect, THEN return 401 error
- WHEN login successful, the system SHALL include user info in response

### US-3: Create Todo
**Là** người dùng đã đăng nhập
**Tôi muốn** tạo todo mới
**Để** quản lý công việc

**Acceptance Criteria:**
- WHEN user provides valid title, the system SHALL create todo
- WHERE title is empty, the system SHALL reject
- WHERE title > 200 characters, the system SHALL reject
- WHEN created, the system SHALL set completed = false
- WHEN created, the system SHALL associate with current user

[... more user stories ...]

## Non-Functional Requirements
- Performance: API response < 200ms
- Security: Passwords hashed with bcrypt (cost 12)
- Security: JWT tokens expire in 24 hours
- Validation: All inputs validated with Zod
- Testing: Minimum 80% code coverage

# Design: Todo List API

## Architecture
Clean Architecture với 4 layers:
- API Layer (Controllers, Routes, Middlewares)
- Service Layer (Business Logic)
- Repository Layer (Data Access)
- Database Layer (Prisma)

## Data Models

```typescript
// User Model
interface User {
  id: string;
  email: string;
  passwordHash: string;
  createdAt: Date;
  updatedAt: Date;
  todos: Todo[];
}

// Todo Model
interface Todo {
  id: string;
  title: string;
  description?: string;
  completed: boolean;
  userId: string;
  user: User;
  createdAt: Date;
  updatedAt: Date;
}

# Implementation Plan

- [ ] 1. Project Setup
  - [ ] 1.1 Initialize Node.js project
  - [ ] 1.2 Install dependencies
  - [ ] 1.3 Setup TypeScript
  - [ ] 1.4 Configure Prisma
  - _Requirements: 3.1_

- [ ] 2. Database Setup
  - [ ] 2.1 Create Prisma schema
  - [ ] 2.2 Create migrations
  - [ ] 2.3 Generate Prisma client
  - _Requirements: Data Models_

- [ ] 3. Implement Authentication
  - [ ] 3.1 Create User model
  - [ ] 3.2 Implement AuthService
  - [ ] 3.3 Create auth routes
  - [ ] 3.4 Add JWT middleware
  - _Requirements: US-1, US-2_

- [ ] 4. Implement Todo CRUD
  - [ ] 4.1 Create Todo model
  - [ ] 4.2 Implement TodoService
  - [ ] 4.3 Create todo routes
  - [ ] 4.4 Add validation
  - _Requirements: US-3, US-4, US-5_

- [ ] 5. Add Tests
  - [ ] 5.1 Setup Jest
  - [ ] 5.2 Write unit tests
  - [ ] 5.3 Write API tests
  - [ ] 5.4 Check coverage
  - _Requirements: Testing_

- [ ] 6. Documentation
  - [ ] 6.1 Generate OpenAPI spec
  - [ ] 6.2 Setup Swagger UI
  - [ ] 6.3 Write README
  - _Requirements: Documentation_