# Specification: 003-unified-jwt-auth

## Status

| Field | Value |
|-------|-------|
| **Created** | 2025-12-31 |
| **Current Phase** | Ready for Implementation |
| **Last Updated** | 2025-12-31 |

## Documents

| Document | Status | Notes |
|----------|--------|-------|
| product-requirements.md | completed | All checklist items verified |
| solution-design.md | completed | All ADRs confirmed |
| implementation-plan.md | completed | 8 phases, 86 tasks defined |

**Status values**: `pending` | `in_progress` | `completed` | `skipped`

## Decisions Log

| Date | Decision | Rationale |
|------|----------|-----------|
| 2025-12-31 | Single unified login | User chose single login for all app features (main + scheduling) |
| 2025-12-31 | New backend JWT endpoint | Backend will add `/mobile/auth/login` endpoint returning JWTs |
| 2025-12-31 | Enable biometrics | User wants Face ID/Touch ID support from launch |
| 2025-12-31 | Start with PRD | Full specification workflow: PRD → SDD → PLAN |
| 2025-12-31 | Keep form-encoded for legacy | Legacy endpoints stay form-encoded, JWT in Bearer header |
| 2025-12-31 | Scheduling under store routes | Move from /scheduling/* to /store/:typeNum/scheduling/* |

## Context

**User Request:** Convert our API based auth for main app and Login with JWT for scheduling into one unified auth for whole app. Login with JWT. Remove API key auth. Existing users forced to relogin.

**Key Goals:**
- Migrate from API key authentication to JWT-based authentication
- Unify the scheduling module's JWT auth with the main app
- Force existing users to re-authenticate with the new system
- Remove all API key authentication code

---
*This file is managed by the specification-management skill.*