gsd-trae 1.0.1 → 1.0.2

package/refs/vbenchmark/tasks/saas-core/auth/mfa-totp/PROMPT.md

@@ -1,79 +0,0 @@
-# TOTP Multi-Factor Authentication
-
-Implement time-based one-time password (TOTP) multi-factor authentication for an existing Next.js + Supabase application.
-
-## Requirements
-
-### Setup Flow
-1. User navigates to security settings
-2. Click "Enable 2FA" button
-3. Generate TOTP secret and display QR code
-4. User scans with authenticator app (Google Authenticator, Authy)
-5. User enters 6-digit code to verify
-6. Store encrypted secret in database
-7. Show recovery codes (one-time use)
-
-### Login Flow
-1. User enters email/password
-2. If MFA enabled, redirect to MFA verification page
-3. User enters 6-digit TOTP code
-4. Validate code against stored secret
-5. Allow login on success
-
-### Recovery
-1. User can use recovery code if device lost
-2. Each recovery code is single-use
-3. Admin can reset MFA for users
-
-## Technical Specifications
-
-### Database Schema
-```sql
--- Add to users table or create separate table
-ALTER TABLE users ADD COLUMN mfa_secret TEXT;
-ALTER TABLE users ADD COLUMN mfa_enabled BOOLEAN DEFAULT false;
-ALTER TABLE users ADD COLUMN mfa_recovery_codes TEXT[];
-```
-
-### API Endpoints
-```typescript
-POST /api/auth/mfa/setup     // Generate secret + QR code
-POST /api/auth/mfa/verify    // Verify code and enable MFA
-POST /api/auth/mfa/validate  // Validate during login
-POST /api/auth/mfa/disable   // Disable MFA
-POST /api/auth/mfa/recovery  // Use recovery code
-```
-
-### Libraries
-- Use `otplib` for TOTP generation/validation
-- Use `qrcode` for QR code generation
-- 30-second time window with 1-step tolerance
-
-## UI Components
-
-1. **MFA Setup Modal**
-   - QR code display
-   - Manual secret entry option
-   - Verification input
-   - Recovery codes display
-
-2. **MFA Verification Page**
-   - 6-digit code input with auto-submit
-   - "Use recovery code" link
-   - "Remember this device" checkbox (optional)
-
-## Security Requirements
-
-- Encrypt MFA secret at rest
-- Rate limit verification attempts (5 per minute)
-- Log all MFA events
-- Invalidate sessions on MFA disable
-
-## Acceptance Criteria
-
-- [ ] QR code generates correctly
-- [ ] TOTP codes validate within time window
-- [ ] Recovery codes work once only
-- [ ] MFA blocks login when enabled
-- [ ] Rate limiting prevents brute force
-- [ ] Mobile responsive UI

package/refs/vbenchmark/tasks/saas-core/auth/mfa-totp/task.yaml

@@ -1,27 +0,0 @@
-name: TOTP Multi-Factor Authentication
-category: saas-core
-subcategory: auth
-description: Implement time-based one-time password (TOTP) MFA with QR code setup
-difficulty: hard
-stack: nextjs-supabase
-timeout: 900
-tokenLimit: 200000
-
-tests:
-  functional: tests/mfa.test.ts
-
-docker:
-  compose: docker-compose.yaml
-
-tags:
-  - authentication
-  - mfa
-  - totp
-  - security
-  - qr-code
-
-evaluation:
-  functional: 0.5
-  quality: 0.25
-  cost: 0.1
-  speed: 0.15

package/refs/vbenchmark/tasks/saas-core/auth/rbac-permissions/PROMPT.md

@@ -1,51 +0,0 @@
-# Task: Role-Based Access Control System
-
-## Objective
-Implement a comprehensive RBAC system with hierarchical roles and fine-grained permissions using Java Spring Boot.
-
-## Requirements
-
-1. **Role Hierarchy**
-   - Support role inheritance (Admin > Manager > User)
-   - Roles can have multiple permissions
-   - Users can have multiple roles
-   - Scope roles to organizations/teams
-
-2. **Permissions**
-   - Resource-based permissions (e.g., `posts:read`, `posts:write`)
-   - Support wildcards (`posts:*` = all post permissions)
-   - Dynamic permission checks at runtime
-
-3. **API Endpoints**
-   - `GET /roles` - List all roles
-   - `POST /roles` - Create role with permissions
-   - `PUT /roles/{id}` - Update role
-   - `POST /users/{id}/roles` - Assign role to user
-   - `GET /users/{id}/permissions` - Get effective permissions
-
-4. **Middleware**
-   - `@RequirePermission("posts:write")` annotation
-   - Check permissions before controller execution
-   - Return 403 if permission denied
-
-## Technical Stack
-- Java 17+
-- Spring Boot 3.x
-- Spring Security
-- PostgreSQL
-- JPA/Hibernate
-
-## Files to Create
-- `src/main/java/com/app/security/RbacConfig.java`
-- `src/main/java/com/app/models/Role.java`
-- `src/main/java/com/app/models/Permission.java`
-- `src/main/java/com/app/services/RbacService.java`
-- `src/main/java/com/app/annotations/RequirePermission.java`
-- `src/main/java/com/app/aspects/PermissionAspect.java`
-
-## Success Criteria
-- [ ] Role hierarchy works correctly
-- [ ] Permission wildcards expand properly
-- [ ] Users inherit permissions from all roles
-- [ ] @RequirePermission blocks unauthorized access
-- [ ] Organization scoping isolates permissions

package/refs/vbenchmark/tasks/saas-core/auth/rbac-permissions/task.yaml

@@ -1,27 +0,0 @@
-name: Role-Based Access Control System
-category: saas-core
-subcategory: auth
-description: Implement RBAC with hierarchical roles and fine-grained permissions in Java Spring
-difficulty: hard
-stack: java
-timeout: 900
-tokenLimit: 200000
-
-tests:
-  functional: tests/RbacTest.java
-
-docker:
-  compose: docker-compose.yaml
-
-tags:
-  - java
-  - spring-boot
-  - rbac
-  - authorization
-  - security
-
-evaluation:
-  functional: 0.5
-  quality: 0.25
-  cost: 0.1
-  speed: 0.15

package/refs/vbenchmark/tasks/saas-core/auth/session-management/PROMPT.md

@@ -1,52 +0,0 @@
-# Task: Secure Session Management
-
-## Objective
-Implement secure server-side session management with Redis backend using Rust and Actix-web.
-
-## Requirements
-
-1. **Session Creation**
-   - Generate cryptographically secure session IDs
-   - Store session data in Redis with TTL
-   - Set HTTP-only, Secure, SameSite cookies
-   - Bind session to user agent and IP
-
-2. **Session Storage**
-   - Store user ID, roles, preferences in session
-   - Encrypt sensitive session data at rest
-   - Automatic session extension on activity
-   - Maximum session lifetime (24 hours absolute)
-
-3. **Session Security**
-   - Regenerate session ID on privilege change
-   - Detect session fixation attempts
-   - Concurrent session limits per user
-   - Session invalidation on password change
-
-4. **Endpoints**
-   - `POST /session` - Create session (login)
-   - `GET /session` - Get current session info
-   - `DELETE /session` - Destroy session (logout)
-   - `GET /sessions` - List active sessions for user
-   - `DELETE /sessions/{id}` - Revoke specific session
-
-## Technical Stack
-- Rust 1.70+
-- Actix-web 4.x
-- Redis
-- PostgreSQL with sqlx
-
-## Files to Create
-- `src/main.rs` - Application entry
-- `src/session/mod.rs` - Session module
-- `src/session/store.rs` - Redis session store
-- `src/session/middleware.rs` - Session middleware
-- `src/handlers/session.rs` - Session endpoints
-- `src/crypto.rs` - Encryption utilities
-
-## Success Criteria
-- [ ] Sessions stored securely in Redis
-- [ ] Cookie attributes set correctly
-- [ ] Session regeneration on login
-- [ ] Concurrent session limit enforced
-- [ ] Sessions invalidated on password change

package/refs/vbenchmark/tasks/saas-core/auth/session-management/task.yaml

@@ -1,27 +0,0 @@
-name: Secure Session Management
-category: saas-core
-subcategory: auth
-description: Implement secure session handling with Redis in Rust
-difficulty: hard
-stack: rust
-timeout: 900
-tokenLimit: 200000
-
-tests:
-  functional: tests/session_test.rs
-
-docker:
-  compose: docker-compose.yaml
-
-tags:
-  - rust
-  - actix-web
-  - sessions
-  - redis
-  - security
-
-evaluation:
-  functional: 0.5
-  quality: 0.25
-  cost: 0.1
-  speed: 0.15

package/refs/vbenchmark/tasks/saas-core/auth/supabase-oauth/PROMPT.md

@@ -1,45 +0,0 @@
-# Task: Implement Google OAuth with Supabase
-
-## Objective
-Add Google OAuth authentication to an existing Next.js application using Supabase Auth.
-
-## Requirements
-
-1. **Sign In Button**
-   - Add a "Sign in with Google" button on the `/login` page
-   - Button should be styled with Google's brand guidelines
-   - Show loading state while authentication is in progress
-
-2. **OAuth Flow**
-   - Configure Supabase Auth for Google OAuth
-   - Handle the OAuth callback at `/auth/callback`
-   - Redirect to `/dashboard` on successful authentication
-   - Show error message on authentication failure
-
-3. **Session Management**
-   - Store session in Supabase
-   - Create middleware to protect `/dashboard` route
-   - Redirect unauthenticated users to `/login`
-
-4. **User Profile**
-   - Display user's email and profile picture on dashboard
-   - Add a "Sign Out" button that clears the session
-
-## Technical Constraints
-- Use `@supabase/ssr` for server-side auth
-- Use Next.js App Router (not Pages Router)
-- Do not hardcode any credentials
-
-## Files to Modify/Create
-- `src/app/login/page.tsx` - Login page with Google button
-- `src/app/auth/callback/route.ts` - OAuth callback handler
-- `src/app/dashboard/page.tsx` - Protected dashboard
-- `src/middleware.ts` - Route protection
-- `src/lib/supabase/server.ts` - Server-side Supabase client
-- `src/lib/supabase/client.ts` - Client-side Supabase client
-
-## Success Criteria
-- [ ] User can click "Sign in with Google" and complete OAuth flow
-- [ ] Session persists across page refreshes
-- [ ] Unauthenticated users are redirected from /dashboard to /login
-- [ ] User can sign out and session is cleared

package/refs/vbenchmark/tasks/saas-core/auth/supabase-oauth/docker-compose.yaml

@@ -1,47 +0,0 @@
-version: '3.8'
-
-services:
-  supabase-db:
-    image: supabase/postgres:15.1.0.117
-    ports:
-      - "5432:5432"
-    environment:
-      POSTGRES_PASSWORD: postgres
-      POSTGRES_DB: postgres
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-
-  supabase-auth:
-    image: supabase/gotrue:v2.132.3
-    ports:
-      - "9999:9999"
-    environment:
-      GOTRUE_API_HOST: 0.0.0.0
-      GOTRUE_API_PORT: 9999
-      API_EXTERNAL_URL: http://localhost:9999
-      GOTRUE_DB_DRIVER: postgres
-      GOTRUE_DB_DATABASE_URL: postgres://postgres:postgres@supabase-db:5432/postgres?sslmode=disable
-      GOTRUE_SITE_URL: http://localhost:3000
-      GOTRUE_JWT_SECRET: super-secret-jwt-token-with-at-least-32-characters
-      GOTRUE_EXTERNAL_GOOGLE_ENABLED: true
-      GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-mock}
-      GOTRUE_EXTERNAL_GOOGLE_SECRET: ${GOOGLE_CLIENT_SECRET:-mock}
-      GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: http://localhost:3000/auth/callback
-    depends_on:
-      supabase-db:
-        condition: service_healthy
-
-  app:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    ports:
-      - "3000:3000"
-    environment:
-      NEXT_PUBLIC_SUPABASE_URL: http://supabase-auth:9999
-      NEXT_PUBLIC_SUPABASE_ANON_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24ifQ.mock
-    depends_on:
-      - supabase-auth

package/refs/vbenchmark/tasks/saas-core/auth/supabase-oauth/task.yaml

@@ -1,32 +0,0 @@
-name: Supabase Google OAuth
-category: saas-core
-subcategory: auth
-description: Implement Google OAuth authentication using Next.js and Supabase
-difficulty: medium
-stack: nextjs-supabase
-timeout: 300
-tokenLimit: 80000
-template: nextjs-supabase
-
-promptFile: PROMPT.md
-
-tests:
-  functional: tests/auth.test.ts
-
-docker:
-  compose: docker-compose.yaml
-
-weight: 1.5
-tags:
-  - typescript
-  - nextjs
-  - supabase
-  - oauth
-  - auth
-
-evaluation:
-  functional: 0.5
-  visual: 0.1
-  quality: 0.2
-  cost: 0.1
-  speed: 0.1

package/refs/vbenchmark/tasks/saas-core/auth/supabase-oauth/tests/auth.test.ts

@@ -1,59 +0,0 @@
-import { test, expect } from '@playwright/test';
-
-test.describe('Google OAuth Authentication', () => {
-  test('should show sign in with Google button on login page', async ({ page }) => {
-    await page.goto('/login');
-    const googleButton = page.getByRole('button', { name: /sign in with google/i });
-    await expect(googleButton).toBeVisible();
-  });
-
-  test('should redirect unauthenticated users from dashboard to login', async ({ page }) => {
-    await page.goto('/dashboard');
-    await expect(page).toHaveURL(/\/login/);
-  });
-
-  test('should complete OAuth flow and redirect to dashboard', async ({ page }) => {
-    // This test uses a mock OAuth provider
-    await page.goto('/login');
-
-    // Click Google sign in button
-    const googleButton = page.getByRole('button', { name: /sign in with google/i });
-    await googleButton.click();
-
-    // Mock OAuth callback
-    await page.goto('/auth/callback?code=mock_code');
-
-    // Should redirect to dashboard
-    await expect(page).toHaveURL(/\/dashboard/);
-  });
-
-  test('should display user info on dashboard after login', async ({ page }) => {
-    // Set up authenticated session
-    await page.goto('/auth/callback?code=mock_code');
-    await page.goto('/dashboard');
-
-    // Should show user email
-    await expect(page.getByText(/@/)).toBeVisible();
-
-    // Should show sign out button
-    const signOutButton = page.getByRole('button', { name: /sign out/i });
-    await expect(signOutButton).toBeVisible();
-  });
-
-  test('should clear session on sign out', async ({ page }) => {
-    // Set up authenticated session
-    await page.goto('/auth/callback?code=mock_code');
-    await page.goto('/dashboard');
-
-    // Click sign out
-    const signOutButton = page.getByRole('button', { name: /sign out/i });
-    await signOutButton.click();
-
-    // Should redirect to login
-    await expect(page).toHaveURL(/\/login/);
-
-    // Session should be cleared - accessing dashboard should redirect to login
-    await page.goto('/dashboard');
-    await expect(page).toHaveURL(/\/login/);
-  });
-});

package/refs/vbenchmark/tasks/saas-core/billing/invoice-generation/PROMPT.md

@@ -1,53 +0,0 @@
-# Task: PDF Invoice Generation
-
-## Objective
-Build an invoice generation system that creates professional PDF invoices with proper tax calculations and localization.
-
-## Requirements
-
-1. **Invoice Data**
-   - Company details (logo, address, tax ID)
-   - Customer billing info
-   - Line items with quantity, unit price, total
-   - Subtotal, tax breakdown, grand total
-   - Payment terms and due date
-
-2. **Tax Handling**
-   - Support multiple tax rates (VAT, GST, Sales Tax)
-   - Tax-inclusive vs tax-exclusive pricing
-   - Tax exemption for certain customers
-   - Per-line-item tax rate support
-
-3. **PDF Generation**
-   - Professional template with branding
-   - Table of line items with proper alignment
-   - QR code for payment (optional)
-   - Invoice numbering (INV-2025-00001)
-
-4. **API Endpoints**
-   - `POST /invoices` - Create invoice
-   - `GET /invoices/{id}` - Get invoice details
-   - `GET /invoices/{id}/pdf` - Download PDF
-   - `POST /invoices/{id}/send` - Email invoice to customer
-
-## Technical Stack
-- Python 3.11+
-- FastAPI
-- WeasyPrint or ReportLab for PDF
-- Jinja2 for templates
-- PostgreSQL
-
-## Files to Create
-- `app/services/invoice.py` - Invoice logic
-- `app/services/pdf_generator.py` - PDF generation
-- `app/services/tax_calculator.py` - Tax calculations
-- `app/routers/invoices.py` - API endpoints
-- `app/templates/invoice.html` - PDF template
-- `app/models/invoice.py` - SQLAlchemy models
-
-## Success Criteria
-- [ ] PDF generated with all invoice details
-- [ ] Tax calculations are accurate
-- [ ] Invoice numbers are sequential and unique
-- [ ] PDF renders correctly with line items table
-- [ ] Email delivery works with attachment

package/refs/vbenchmark/tasks/saas-core/billing/invoice-generation/task.yaml

@@ -1,27 +0,0 @@
-name: PDF Invoice Generation
-category: saas-core
-subcategory: billing
-description: Generate professional PDF invoices with line items and tax calculations
-difficulty: medium
-stack: python
-timeout: 600
-tokenLimit: 150000
-
-tests:
-  functional: tests/test_invoice.py
-
-docker:
-  compose: docker-compose.yaml
-
-tags:
-  - python
-  - pdf
-  - invoicing
-  - billing
-  - reporting
-
-evaluation:
-  functional: 0.5
-  quality: 0.2
-  cost: 0.15
-  speed: 0.15

package/refs/vbenchmark/tasks/saas-core/billing/stripe-subscriptions/PROMPT.md

@@ -1,51 +0,0 @@
-# Task: Stripe Subscription Management
-
-## Objective
-Implement complete subscription lifecycle management with Stripe including upgrades, downgrades, and cancellations.
-
-## Requirements
-
-1. **Subscription Creation**
-   - Create Stripe checkout session for new subscriptions
-   - Support multiple pricing tiers (Basic, Pro, Enterprise)
-   - Handle trial periods
-   - Sync subscription to database on webhook
-
-2. **Subscription Management**
-   - `POST /subscriptions/checkout` - Create checkout session
-   - `GET /subscriptions/current` - Get current subscription
-   - `POST /subscriptions/change-plan` - Upgrade/downgrade
-   - `POST /subscriptions/cancel` - Cancel with feedback
-   - `POST /subscriptions/reactivate` - Reactivate before period ends
-
-3. **Webhook Handling**
-   - `customer.subscription.created`
-   - `customer.subscription.updated`
-   - `customer.subscription.deleted`
-   - `invoice.payment_succeeded`
-   - `invoice.payment_failed`
-
-4. **Proration**
-   - Immediate proration on upgrade
-   - Credit for unused time on downgrade
-   - Show prorated amount before confirming change
-
-## Technical Stack
-- TypeScript/Node.js
-- Express or Hono
-- Stripe SDK
-- PostgreSQL with Prisma
-
-## Files to Create
-- `src/routes/subscriptions.ts` - Subscription endpoints
-- `src/routes/webhooks/stripe.ts` - Webhook handler
-- `src/services/stripe.ts` - Stripe service
-- `src/services/subscription.ts` - Subscription logic
-- `prisma/schema.prisma` - Subscription model
-
-## Success Criteria
-- [ ] Checkout creates subscription correctly
-- [ ] Webhooks sync subscription status
-- [ ] Plan changes prorate correctly
-- [ ] Cancellation preserves access until period end
-- [ ] Failed payments trigger dunning flow

package/refs/vbenchmark/tasks/saas-core/billing/stripe-subscriptions/task.yaml

@@ -1,27 +0,0 @@
-name: Stripe Subscription Management
-category: saas-core
-subcategory: billing
-description: Implement subscription lifecycle management with Stripe
-difficulty: medium
-stack: nodejs
-timeout: 600
-tokenLimit: 150000
-
-tests:
-  functional: tests/subscription.test.ts
-
-docker:
-  compose: docker-compose.yaml
-
-tags:
-  - typescript
-  - stripe
-  - subscriptions
-  - billing
-  - saas
-
-evaluation:
-  functional: 0.5
-  quality: 0.2
-  cost: 0.15
-  speed: 0.15

package/refs/vbenchmark/tasks/saas-core/billing/usage-metering/PROMPT.md

@@ -1,52 +0,0 @@
-# Task: Usage-Based Metering System
-
-## Objective
-Build a high-performance usage metering system for API calls with Go that tracks, aggregates, and reports usage for billing.
-
-## Requirements
-
-1. **Usage Tracking**
-   - Track API calls per customer in real-time
-   - Capture: timestamp, endpoint, response time, tokens used
-   - Handle high throughput (10K+ requests/sec)
-   - Buffer and batch writes to database
-
-2. **Aggregation**
-   - Hourly/daily/monthly rollups
-   - Per-endpoint breakdowns
-   - Dimension by: customer, API key, endpoint
-   - Background workers for aggregation
-
-3. **Quota Management**
-   - Set usage limits per plan
-   - Real-time quota checking
-   - Soft limits (warning) vs hard limits (block)
-   - Quota reset on billing cycle
-
-4. **API Endpoints**
-   - `GET /usage/current` - Current period usage
-   - `GET /usage/history` - Historical usage data
-   - `GET /usage/breakdown` - Per-endpoint breakdown
-   - `POST /usage/record` - Record usage event (internal)
-
-## Technical Stack
-- Go 1.21+
-- Gin or Chi router
-- Redis for real-time counters
-- PostgreSQL for historical data
-- TimescaleDB for time-series
-
-## Files to Create
-- `cmd/metering/main.go` - Entry point
-- `internal/metering/tracker.go` - Usage tracking
-- `internal/metering/aggregator.go` - Aggregation workers
-- `internal/metering/quota.go` - Quota management
-- `internal/handlers/usage.go` - API handlers
-- `internal/middleware/metering.go` - Auto-track middleware
-
-## Success Criteria
-- [ ] Usage tracked with <10ms latency overhead
-- [ ] Aggregations computed correctly
-- [ ] Quota limits enforced in real-time
-- [ ] Historical data queryable efficiently
-- [ ] Handles 10K+ req/sec without dropping