# io8 Business Analyst Agent - Customized for This Project

## Project-Specific Instructions


## Notes App Project Overview - 2025-10-06T07:45:00Z
This project focuses on developing a working notes application. It extends an existing Angular Clarity boilerplate project for the frontend and integrates a new, dedicated backend service (to be determined) and a PostgreSQL database. The primary objective is to provide users with a secure and intuitive platform for managing personal notes, including creation, viewing, editing, and deletion, complemented by robust user authentication.

## Business Analysis - 2025-10-06T07:45:00Z
The core business need addressed by this application is the efficient and secure management of personal notes. Users require a simple yet powerful tool to capture ideas, store information, and retrieve it easily. Key aspects include:
*   **Problem:** Users need a reliable system to organize their thoughts and information without worrying about data loss or unauthorized access. Generic text editors lack organization features, and physical notes can be lost.
*   **Solution:** A digital notes app with user accounts, providing a personalized and secure space for note-taking.
*   **Value Proposition:** Offers users a centralized, accessible, and secure platform for personal knowledge management, enhancing productivity and organization.
*   **Target Audience:** Individuals needing a personal digital notepad, possibly transitioning from physical notes or disparate digital tools.

## User Requirements - 2025-10-06T07:45:00Z
Based on the io8codermaster_breakdown addendum "Detailed Functional Requirements (Notes App)":

1.  **Note Management (CRUD):** Users must be able to perform fundamental operations on their notes.
    *   Create new notes with a distinct title and rich-text content.
    *   View a comprehensive list of all their notes, with sorting capabilities (e.g., by creation or last modification date).
    *   Access and read individual notes in detail.
    *   Modify the title and content of existing notes.
    *   Permanently delete notes they no longer need.
2.  **User Management & Authentication:** The application must securely manage user accounts.
    *   Users need to be able to register for a new account using an email and password.
    *   Existing users must be able to log in to access their notes.
    *   Access to notes must be strictly controlled; users should only interact with notes they own.
    *   A basic mechanism for resetting forgotten passwords should be available.
3.  **Search & Organization (MVP Optional, Phase 3 Focus):** To enhance usability, these features are planned for later phases.
    *   Ability to search notes by keywords present in their title or content.
    *   Basic categorization or tagging functionality for better note organization.

## Functional Requirements (High-Level) - 2025-10-06T07:45:00Z
*   User Authentication and Authorization
*   Note Creation, Retrieval, Update, and Deletion
*   Displaying a List of Notes
*   Displaying a Single Note's Details
*   User Profile Management (Login, Logout, Registration)
*   Optional: Note Search
*   Optional: Note Tagging/Categorization

## Non-Functional Requirements - 2025-10-06T07:45:00Z
*   **Performance:** The application should be responsive, with note lists and individual notes loading within an acceptable timeframe (e.g., <2 seconds).
*   **Security:** User data (credentials, notes) must be securely stored and transmitted. Authentication and authorization mechanisms (e.g., JWT) must be robust. Users must not be able to access other users' notes.
*   **Usability:** The user interface, built on Clarity Design System, should be intuitive, easy to navigate, and consistent across different sections.
*   **Reliability:** The application should maintain data integrity and be available during expected operational hours.
*   **Scalability:** The architecture (Dockerized frontend, backend, and database) should support a growing number of users and notes without significant performance degradation.
*   **Maintainability:** The codebase should be well-structured, documented, and easy for developers to understand and extend.

## User Stories - 2025-10-06T07:45:00Z

### User Account Management
*   **As a new user,** I want to register an account with my email and password, **so that** I can securely store my personal notes.
    *   **Acceptance Criteria:**
        *   Given I am on the registration page, when I enter a valid email and a strong password, and confirm it, then my account is created and I am logged in.
        *   Given I try to register with an already used email, then I receive an error message.
        *   Given I register, then my credentials are encrypted and stored securely.
*   **As a registered user,** I want to log in with my credentials, **so that** I can access my notes.
    *   **Acceptance Criteria:**
        *   Given I am on the login page, when I enter my correct email and password, then I am granted access to my dashboard.
        *   Given I enter incorrect credentials, then I receive an "Invalid credentials" error.
*   **As a registered user,** I want to reset my password, **so that** I can regain access to my account if I forget it.
    *   **Acceptance Criteria:**
        *   Given I request a password reset, when I provide my registered email, then I receive instructions to reset my password. (Basic implementation, e.g., console log for now).

### Note Management
*   **As a logged-in user,** I want to create a new note with a title and rich-text content, **so that** I can capture new information.
    *   **Acceptance Criteria:**
        *   Given I am on the notes dashboard, when I click "Create New Note" and fill in the title and content, then the note is saved and appears in my note list.
        *   Given I leave the title blank, then the note saves with a default title (e.g., "Untitled Note").
*   **As a logged-in user,** I want to view a list of all my notes, **so that** I can quickly find and select a note.
    *   **Acceptance Criteria:**
        *   Given I am logged in, when I navigate to the notes dashboard, then I see a list of my notes, each showing its title and a snippet of content.
        *   Given I have many notes, then the list can be sorted by creation date or last modified date.
*   **As a logged-in user,** I want to view a specific note in detail, **so that** I can read its full content.
    *   **Acceptance Criteria:**
        *   Given I am viewing the note list, when I click on a note's title, then I am directed to a page showing the full title and rich-text content of that note.
*   **As a logged-in user,** I want to edit an existing note's title and content, **so that** I can update my information.
    *   **Acceptance Criteria:**
        *   Given I am viewing a note, when I click "Edit" and modify the title or content, then the changes are saved and reflected when I view the note again.
*   **As a logged-in user,** I want to delete a note, **so that** I can remove outdated or unwanted information.
    *   **Acceptance Criteria:**
        *   Given I am viewing a note, when I click "Delete" and confirm the action, then the note is permanently removed from my list.
        *   Given I attempt to delete a note, then a confirmation dialog appears before permanent deletion.

### Search & Organization (Phase 3)
*   **As a logged-in user,** I want to search my notes by keywords, **so that** I can quickly find specific information.
    *   **Acceptance Criteria:**
        *   Given I enter a search term, when I press enter, then a filtered list of notes containing the term in their title or content is displayed.
*   **As a logged-in user,** I want to categorize or tag my notes, **so that** I can organize them better.
    *   **Acceptance Criteria:**
        *   Given I am editing a note, when I add tags or assign it to a category, then the note is associated with those tags/categories.
        *   Given I filter by a tag/category, then only notes with that tag/category are displayed.

## Business Rules - 2025-10-06T07:45:00Z
*   **Note Ownership:** Each note must be associated with a single user.
*   **Access Control:** Users can only view, create, edit, or delete notes that they own. Unauthorized access attempts must be rejected.
*   **Data Integrity:** Note titles and content, once created, should persist accurately unless explicitly modified or deleted by the owning user.
*   **Authentication:** User authentication must occur via username (email) and password.
*   **Password Security:** User passwords must be stored securely using hashing algorithms.



## Functional Requirements for Notes App - 2025-10-06T07:45:00Z

### FR-001: User Registration
-   **Description:** The system shall allow new users to register an account using a unique email address and a password.
-   **Acceptance Criteria:**
    *   Given a user navigates to the registration page, when they enter a unique email and a password (meeting complexity requirements), and confirm the password, then the system creates a new user account and logs them in.
    *   Given an email address is already registered, the system shall prevent new registration with that email and display an error.
    *   Passwords shall be securely hashed before storage.
-   **Priority:** High

### FR-002: User Login
-   **Description:** The system shall allow registered users to log in using their email and password.
-   **Acceptance Criteria:**
    *   Given a user navigates to the login page, when they enter a registered email and correct password, then the system authenticates the user and grants access to their notes.
    *   Given incorrect credentials, the system shall display an "Invalid credentials" error without revealing if the email or password was incorrect.
    *   The system shall issue a secure token (e.g., JWT) upon successful login for subsequent authenticated requests.
-   **Priority:** High

### FR-003: Password Reset (Basic)
-   **Description:** The system shall provide a basic mechanism for users to initiate a password reset process.
-   **Acceptance Criteria:**
    *   Given a user requests a password reset, when they provide a registered email address, then the system shall simulate sending password reset instructions (e.g., log to console in MVP).
-   **Priority:** Medium

### FR-004: Create New Note
-   **Description:** Authenticated users shall be able to create new notes with a title and rich-text content.
-   **Acceptance Criteria:**
    *   Given an authenticated user is on the notes dashboard, when they access the "Create Note" interface and submit a title and content, then a new note entry is created and associated with their user ID.
    *   The system shall support rich-text formatting for note content (e.g., bold, italics, lists).
    *   If no title is provided, the system shall assign a default title (e.g., "Untitled Note").
-   **Priority:** High

### FR-005: View All Notes
-   **Description:** Authenticated users shall be able to view a paginated or scrollable list of all notes they own.
-   **Acceptance Criteria:**
    *   Given an authenticated user accesses the notes dashboard, then a list displaying the title and creation/last modified date of each of their notes is shown.
    *   The list shall be sortable by creation date (ascending/descending) and last modified date (ascending/descending).
    *   Each item in the list shall be clickable to view the note in detail.
-   **Priority:** High

### FR-006: View Individual Note
-   **Description:** Authenticated users shall be able to view the full details (title and content) of a specific note they own.
-   **Acceptance Criteria:**
    *   Given an authenticated user selects a note from the list, then a dedicated view displaying the full title and rich-text content of that note is presented.
    *   The view shall include options to edit or delete the note.
-   **Priority:** High

### FR-007: Edit Existing Note
-   **Description:** Authenticated users shall be able to modify the title and rich-text content of any note they own.
-   **Acceptance Criteria:**
    *   Given an authenticated user is viewing a specific note, when they activate the edit function and modify the title or content, then the system updates the note's details and records the `last_modified` timestamp.
    *   The system shall validate the updated content for integrity and rich-text formatting.
-   **Priority:** High

### FR-008: Delete Note
-   **Description:** Authenticated users shall be able to permanently delete any note they own.
-   **Acceptance Criteria:**
    *   Given an authenticated user attempts to delete a note, then a confirmation dialog shall appear asking for explicit confirmation.
    *   When the user confirms deletion, then the note and its associated data are permanently removed from the database.
    *   The user shall be redirected to the main notes list after successful deletion.
-   **Priority:** High

### FR-009: Secure Note Access
-   **Description:** The system shall enforce strict authorization, ensuring users can only access (view, create, edit, delete) their own notes.
-   **Acceptance Criteria:**
    *   Given an authenticated user attempts to access a note not associated with their user ID, then the system shall return an unauthorized error (e.g., HTTP 403 Forbidden).
    *   All API endpoints for note management shall verify user ownership before processing the request.
-   **Priority:** High

### FR-010: Search Notes (Phase 3)
-   **Description:** Authenticated users shall be able to search their notes by keywords in the title or content.
-   **Acceptance Criteria:**
    *   Given an authenticated user enters a search query in a search bar, when the query is submitted, then the system shall return a filtered list of the user's notes that match the keywords.
    *   Search shall be case-insensitive.
-   **Priority:** Medium (for Phase 3)

### FR-011: Note Categorization/Tagging (Phase 3)
-   **Description:** Authenticated users shall be able to assign categories or tags to their notes for better organization.
-   **Acceptance Criteria:**
    *   Given an authenticated user is creating or editing a note, then they can input or select multiple tags/categories for that note.
    *   Users shall be able to filter their note list by one or more assigned tags/categories.
-   **Priority:** Low (for Phase 3)

## Non-Functional Requirements for Notes App - 2025-10-06T07:45:00Z

### NFR-001: Performance
-   **Description:** The application shall provide a responsive user experience with efficient data retrieval and processing.
-   **Acceptance Criteria:**
    *   Note lists (up to 100 notes per user) shall load within 2 seconds.
    *   Individual notes shall load within 1 second.
    *   API response times for CRUD operations shall be less than 500ms under normal load (up to 50 concurrent users).
-   **Priority:** High

### NFR-002: Security
-   **Description:** The application shall protect user data and ensure secure interactions.
-   **Acceptance Criteria:**
    *   All user passwords shall be stored as salted hashes (e.g., using bcrypt).
    *   Data transmission between frontend and backend shall be encrypted (HTTPS).
    *   Authentication tokens (e.g., JWT) shall be short-lived and refreshed securely.
    *   Input validation shall be performed on all user-submitted data to prevent injection attacks (e.g., XSS, SQL injection).
    *   Rate limiting shall be implemented on login attempts to mitigate brute-force attacks.
-   **Priority:** High

### NFR-003: Usability
-   **Description:** The user interface shall be intuitive, easy to navigate, and consistent with the Clarity Design System.
-   **Acceptance Criteria:**
    *   The application shall adhere to Clarity Design System guidelines for components, typography, and spacing.
    *   Navigation menus shall be clear and logically organized.
    *   Form fields shall have clear labels, placeholders, and validation feedback.
    *   The application shall be fully responsive and usable across common desktop and mobile browser sizes.
-   **Priority:** High

### NFR-004: Scalability
-   **Description:** The application's architecture shall be designed to accommodate future growth in users and data.
-   **Acceptance Criteria:**
    *   The backend shall be stateless to allow for easy horizontal scaling.
    *   The database schema shall be optimized for efficient querying of notes and user data.
    *   Containerization (Docker) shall be used for easy deployment and scaling of frontend and backend services.
-   **Priority:** Medium

### NFR-005: Maintainability
-   **Description:** The codebase shall be well-structured, modular, and easy to understand for future development and debugging.
-   **Acceptance Criteria:**
    *   Code shall follow established coding standards for Angular (frontend) and the chosen backend framework.
    *   Key components, services, and API endpoints shall be documented with clear comments and explanations.
    *   Module separation for concerns (e.g., authentication, notes) shall be evident in the project structure.
-   **Priority:** Medium

## Data Requirements for Notes App - 2025-10-06T07:45:00Z

### Entities and Relationships

#### 1. User
-   **Description:** Represents a registered user of the notes application.
-   **Attributes:**
    *   `id`: UUID (Primary Key, unique identifier)
    *   `email`: String (Unique, required, used for login)
    *   `password_hash`: String (Required, securely hashed password)
    *   `created_at`: Timestamp (Automatically set on creation)
    *   `updated_at`: Timestamp (Automatically updated on modification)

#### 2. Note
-   **Description:** Represents a user's individual note.
-   **Attributes:**
    *   `id`: UUID (Primary Key, unique identifier)
    *   `user_id`: UUID (Foreign Key, links to `User.id`, required)
    *   `title`: String (Required, max length 255)
    *   `content`: Text (Optional, rich-text format supported)
    *   `created_at`: Timestamp (Automatically set on creation)
    *   `updated_at`: Timestamp (Automatically updated on modification)

#### Relationships:
*   `User` 1 -- M `Note`: One user can have many notes. Each note belongs to exactly one user.

## Interface Requirements for Notes App - 2025-10-06T07:45:00Z

### UI/UX Requirements
*   **Design System:** Frontend UI shall strictly adhere to the Clarity Design System for all components (buttons, forms, data grids, navigation).
*   **Layout:**
    *   A primary responsive layout consistent with the base Angular Clarity boilerplate, featuring a header, sidebar (for navigation), and a main content area.
    *   Login/Registration pages shall have a dedicated, minimalist layout.
*   **Navigation:**
    *   Clear vertical navigation in the sidebar for accessing "My Notes", "Create New Note", and (optionally) "Categories/Tags".
    *   Header area for application branding and user-related actions (e.g., Logout).
*   **Note Editor:** A rich-text editor component for creating and editing note content.
*   **Forms:** All forms (login, registration, create/edit note) shall include clear validation feedback.

### API Requirements (RESTful)
*   **Base URL:** `/api/v1` (versioned for future compatibility).
*   **Authentication:** All authenticated endpoints shall require a valid JWT in the `Authorization` header (`Bearer <token>`).
*   **Error Handling:** API shall return meaningful HTTP status codes and JSON error messages for failures (e.g., 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error).
*   **Endpoints:**

    *   **User Authentication:**
        *   `POST /auth/register`: Register a new user.
            *   Request Body: `{ "email": "string", "password": "string" }`
            *   Response: `{ "token": "string", "user": { "id": "uuid", "email": "string" } }`
        *   `POST /auth/login`: Authenticate an existing user.
            *   Request Body: `{ "email": "string", "password": "string" }`
            *   Response: `{ "token": "string", "user": { "id": "uuid", "email": "string" } }`
        *   `POST /auth/password-reset`: Initiate password reset.
            *   Request Body: `{ "email": "string" }`
            *   Response: `{ "message": "Password reset instructions sent." }`

    *   **Note Management:**
        *   `GET /notes`: Retrieve a list of the authenticated user's notes.
            *   Query Params: `sort_by` (e.g., "created_at", "updated_at"), `order` ("asc", "desc"), `page`, `limit`, `search` (Phase 3), `tag` (Phase 3).
            *   Response: `[{ "id": "uuid", "title": "string", "content_snippet": "string", "created_at": "timestamp", "updated_at": "timestamp" }]` (paginated).
        *   `GET /notes/{id}`: Retrieve a single note by ID (owned by the authenticated user).
            *   Response: `{ "id": "uuid", "title": "string", "content": "text", "created_at": "timestamp", "updated_at": "timestamp" }`
        *   `POST /notes`: Create a new note for the authenticated user.
            *   Request Body: `{ "title": "string", "content": "text" }`
            *   Response: `{ "id": "uuid", "title": "string", "content": "text", "created_at": "timestamp", "updated_at": "timestamp" }` (created note details).
        *   `PUT /notes/{id}`: Update an existing note by ID (owned by the authenticated user).
            *   Request Body: `{ "title": "string", "content": "text" }` (partial updates allowed).
            *   Response: `{ "id": "uuid", "title": "string", "content": "text", "created_at": "timestamp", "updated_at": "timestamp" }` (updated note details).
        *   `DELETE /notes/{id}`: Delete a note by ID (owned by the authenticated user).
            *   Response: `{ "message": "Note deleted successfully." }`


## Base Agent Prompt Reference

This agent is based on the standard io8analyst agent with project-specific customizations above.
Refer to the base io8analyst agent prompt for general principles and workflow instructions.
