---
title: "Tasks: JWT Authentication System"
description: "> Design: [./design.md](./design.md) > Implementation: [./implementation.md](./implementation.md) > Status: in-progress > Created: 2026-03-11"
type: skill
canonical_url: https://claudary.paisolsolutions.com/skills/example-tasks
source: "Claudary"
difficulty: intermediate
author: "Claude Code Knowledge Pack"
date: 2026-07-10T11:24:21.316Z
license: CC-BY-4.0
attribution: "Tasks: JWT Authentication System — Claudary (https://claudary.paisolsolutions.com/skills/example-tasks)"
---

# Tasks: JWT Authentication System
> Design: [./design.md](./design.md) > Implementation: [./implementation.md](./implementation.md) > Status: in-progress > Created: 2026-03-11

## Overview

# Tasks: JWT Authentication System

> Design: [./design.md](./design.md)
> Implementation: [./implementation.md](./implementation.md)
> Status: in-progress
> Created: 2026-03-11

## Task 1: Token generation and validation library
- **Status:** done
- **Depends on:** —
- **Docs:** [implementation.md#token-library](./implementation.md#token-library)

### Subtasks
- [x] 1.1 Create `internal/auth/token.go` with `GenerateToken(userID, role)` and `ValidateToken(tokenString)` functions
- [x] 1.2 Add token expiry configuration via `internal/config/auth.go` — read from env vars with sensible defaults
- [x] 1.3 Write table-driven tests covering: valid token, expired token, malformed token, wrong signing key

## Task 2: Auth middleware
- **Status:** in-progress
- **Depends on:** Task 1
- **Docs:** [implementation.md#middleware](./implementation.md#middleware)

### Subtasks
- [x] 2.1 Create `internal/middleware/auth.go` — extract token from `Authorization: Bearer <token>` header, validate via token library, inject user claims into request context
- [ ] 2.2 Add middleware to router in `cmd/server/routes.go` for all `/api/v1/*` routes except `/api/v1/auth/login`
- [ ] 2.3 Integration tests: request without token → 401, expired token → 401, valid token → passes through with claims in context

## Task 3: Login and refresh endpoints
- **Status:** pending
- **Depends on:** Task 1, Task 2
- **Docs:** [implementation.md#endpoints](./implementation.md#endpoints)

### Subtasks
- [ ] 3.1 `POST /api/v1/auth/login` — accept email/password, verify against user store, return access + refresh tokens
- [ ] 3.2 `POST /api/v1/auth/refresh` — accept refresh token, validate, return new access token
- [ ] 3.3 Tests: valid credentials → tokens returned, invalid credentials → 401, expired refresh token → 401

## Task 4: Password hashing migration
- **Status:** blocked
- **Depends on:** —
- **Docs:** [design.md#password-storage](./design.md#password-storage)
- **Blocked:** Waiting on DB migration tooling decision (see design.md#open-questions)

### Subtasks
- [ ] 4.1 Add bcrypt hashing to `internal/auth/password.go` with cost factor from config
- [ ] 4.2 Create migration to add `password_hash` column to users table
- [ ] 4.3 Update user registration flow to hash passwords on create

## Task 5: Final verification
- **Status:** pending
- **Depends on:** Task 1, Task 2, Task 3, Task 4

### Subtasks
- [ ] 5.1 Run `test` skill to verify all tasks — full test suite, integration tests, edge cases
- [ ] 5.2 Run `document` skill to update any relevant docs
- [ ] 5.3 Run `review-code` skill with the project language input to review the implementation
- [ ] 5.4 Run `review-spec` skill to verify implementation matches design and implementation docs

---

Source: [Claudary](https://claudary.paisolsolutions.com/skills/example-tasks) · https://claudary.paisolsolutions.com