Feature: User Management API

Feature: User Management API【免费下载链接】claude-skills67 Specialized Skills for Full-Stack Developers. Transform Claude Code into your expert pair programmer.项目地址: https://gitcode.com/GitHub_Trending/claud/claude-skillsOverviewComplete CRUD API for user management with authentication and authorization.EndpointsCreate UserPOST /api/v1/usersRequest: { email: userexample.com, name: John Doe, password: SecurePass123! }Response (201): { id: usr_abc123, email: userexample.com, name: John Doe, createdAt: 2025-01-15T10:00:00Z }AuthenticationAll endpoints except POST /users require Bearer token: Authorization: Bearer jwt_tokenError Responses422 Validation Error: { error: { code: VALIDATION_ERROR, message: Invalid input, details: { email: [Must be valid email] } } }注意文档中的 POST /api/v1/users 采用了 [api-design-standards.md](https://link.gitcode.com/i/1ef7c537efef4f2acadee66ebd0f0df5) 推荐的**URL 路径版本化**/api/v1/...。技术文档应当用 POST/GET/PUT/PATCH/DELETE 与 200/201/204/400/401/403/404/409/422/429 等状态码把每个端点的语义写清并统一错误格式方便前端直接对齐实现。 ### 组件文档JSDoc 风格 对复用价值高的组件用 JSDoc 记录用途、参数与示例 typescript /** * UserProfileForm - Editable user profile form with validation * * example * UserProfileForm * initialData{currentUser} * onSubmit{handleUpdate} * onCancel{() router.back()} * / * * param initialData - User data to pre-populate form * param onSubmit - Callback when form is submitted with valid data * param onCancel - Optional callback when user cancels editing */ export function UserProfileForm({ initialData, onSubmit, onCancel }: UserProfileFormProps) { // Component implementation }一份好的组件文档应让使用者不看实现代码就能正确调用组件——示例代码、参数语义、可选/必选约束都在注释中讲清楚。README 更新安装说明Installation instructions环境变量配置Environment variable configuration开发环境搭建步骤Development setup steps构建与部署命令Build and deployment commands测试说明Testing instructions故障排查指南Troubleshooting guideREADME 是项目的第一入口清单要求把环境变量、开发启动、构建部署、测试运行与排障全部写清楚让新人或未来的你拿到仓库即可跑通。Storybook 文档前端对组件库型项目Storybook 是组件活文档// UserCard.stories.tsx export default { title: Components/UserCard, component: UserCard, } as Meta; export const Default: Story { args: { user: { name: John Doe, email: johnexample.com, avatar: https://example.com/avatar.jpg, }, }, }; export const Loading: Story { args: { isLoading: true }, }; export const WithLongName: Story { args: { user: { name: Johnathan Alexander Wellington III, email: johnathanexample.com, }, }, };注意WithLongName这个 Story它专门覆盖超长用户名不破坏布局的边缘场景。好的 Storybook 不只展示默认态更要展示 loading、空数据、超长文本、错误态等边界状态让设计师与开发者直观审查各种条件下的表现。五、性能交付物Performance Deliverables性能不是上线后才发现的问题而是交付前必须度量的交付物。性能指标报告## Performance Metrics ### Backend API - Average response time: 45ms - P95 response time: 120ms - P99 response time: 250ms - Throughput: 1000 req/s - Error rate: 0.02% ### Frontend Bundle - Initial bundle size: 245 KB (gzipped) - Largest chunk: 180 KB - Time to Interactive: 1.2s - Lighthouse score: 95/100 ### Database Queries - Average query time: 15ms - Slowest query: 85ms (user search) - Index usage: 98% - Connection pool utilization: 60%重要说明以上数字是清单给出的示例指标形态与记录格式并非针对本仓库的实测数据。每个项目应基于自身压测工具k6、JMeter、Locust 等与真实环境重新测量。报告的价值在于它的结构后端关注延迟分位数P95/P99 而非仅平均值、吞吐与错误率前端关注打包体积与 TTITime to Interactive数据库关注慢查询与索引使用率。速查表给出的参考目标为 API P95 200ms、前端 TTI 2s可作基线。打包分析Webpack/Vite 打包分析报告Lighthouse 性能审计Core Web Vitals 测量打包体积对比改动前/后打包体积对比是关键动作每次功能合入前后各测一次才能量化这个功能让包涨了多少 KB防止包体无声膨胀。六、安全交付物Security Deliverables安全是fullstack-guardian的立身之本交付物清单给出了安全验收的完整闭环。安全检查清单所有端点做输入校验Input validation on all endpoints输出净化防 XSSOutput sanitization参数化查询防 SQL 注入SQL injection prevention开启 CSRF 防护CSRF protection enabled配置限流Rate limiting configured需要处强制鉴权Authentication required where needed实现授权检查Authorization checks implemented响应排除敏感数据Sensitive data excluded from responses密钥放环境变量Secrets in environment variables生产强制 HTTPSHTTPS enforced in production配置安全响应头CSP、HSTS 等这 11 项直接对应 security-checklist.md 的六大检查维度Auth端点是否要求认证、Authz用户是否有权操作、Input输入是否校验净化、Output响应是否过滤敏感字段、Rate Limit是否限流、Logging安全事件是否记录。其中限流的典型实现// Express rate-limit登录端点从严 const authLimiter rateLimit({ windowMs: 15 * 60 * 1000, // 15 分钟窗口 max: 5, // 最多 5 次尝试 message: Too many login attempts, }); app.post(/login, authLimiter, loginHandler);结合 api-design-standards.md更完整的分层限流方案是全站通用限流如 100 req/15min/IP 认证类端点更严的独立限流如 5 req/15min必要时改用 Redis 支撑rate-limiter-flexible在分布式/多实例部署下保持限流计数一致。安全审计报告安全审计报告把防护措施落到具体技术参数## Security Review ### Authentication - JWT with RS256 algorithm - 15-minute access tokens - 7-day refresh tokens - Secure cookie storage ### Authorization - Role-based access control (RBAC) - Resource ownership validation - Permission checks on all mutations ### Data Protection - Passwords hashed with bcrypt (12 rounds) - Sensitive data encrypted at rest - PII excluded from logs - Rate limiting: 100 req/15min per IP这份报告的价值在于可审计性算法RS256、令牌有效期15 分钟 access / 7 天 refresh、哈希轮数bcrypt 12 rounds、限流额度100 req/15min都以具体数字呈现安全评审者无需翻代码即可评估风险。报告内容与 SKILL.md 的三视角示例相互印证鉴权必须由后端强制服务端 dependency/guard响应 Schema 显式排除敏感字段越权时在访问数据库之前就返回 403避免时序侧信道。七、部署交付物Deployment Deliverables配置文件多阶段构建的Dockerfilemulti-stage build本地开发用docker-compose.ymlCI/CD 流水线配置环境差异化配置数据库迁移脚本健康检查端点Kubernetes 清单如适用多阶段 Dockerfile 的价值在于构建环境与运行环境分离构建阶段安装全部依赖、产出产物运行阶段仅保留最小运行时镜像显著缩小镜像体积并减少攻击面。健康检查端点与 CI/CD、容器编排k8s liveness/readiness probe直接联动是零停机部署的前提。部署指南## Deployment Steps ### Prerequisites - Node.js 18 - PostgreSQL 15 - Redis 7 ### Environment Variables DATABASE_URLpostgresql://user:passhost:5432/dbname REDIS_URLredis://localhost:6379 JWT_SECRETgenerate-secure-secret API_PORT3000 ### Build Deploy npm run build npm run migrate npm run start:prod ### Health Check GET /api/health Expected: { status: ok, database: connected }【免费下载链接】claude-skills67 Specialized Skills for Full-Stack Developers. Transform Claude Code into your expert pair programmer.项目地址: https://gitcode.com/GitHub_Trending/claud/claude-skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考