<!-- Generated by scripts/generate_ai_collab_docs.py. Edit metadata in that script. -->

# Backend Service: user

This file adds local guidance for `src/api/flaskr/service/user`. Read the
repository root and `src/api/AGENTS.md` first, then use this file for
module-specific ownership and risk points.

## Scope

- This service owns user records, auth credentials, verification-code flows,
  token storage, temp-user handling, and auth-provider integration.

- Primary checked-in entry files today: `src/api/flaskr/service/user/user.py`,
  `src/api/flaskr/service/user/repository.py`,
  `src/api/flaskr/service/user/models.py`,
  `src/api/flaskr/service/user/auth/factory.py`,
  `src/api/flaskr/service/user/email_flow.py`

- Keep behavior in this module unless the concern is clearly cross-service and
  shared by multiple backend domains.

- Preferred pytest location: `src/api/tests/service/user/` already exists and
  should remain the first stop.

## Do

- Start from the local entry files and preserve how this service already
  structures helpers, models, routes, and DTO-like helpers.

- Keep credential lookup, token persistence, and provider dispatch in the
  shared repository and auth-factory paths.

- Preserve verification-code consumption rules and temp-user semantics so auth
  retries do not create inconsistent user state.

- Treat auth payloads, token fields, and credential models as shared contracts
  used by frontend login flows and backend guards.

## Avoid

- Do not bypass repository or token-store helpers when touching auth state,
  credential persistence, or verification flows.

- Do not add provider-specific branches to every caller when the auth factory
  should own that dispatch logic.

- Do not change user identifiers, avatar handling, or code-consumption rules
  without coordinated tests for retries and error paths.

- Avoid scattering service-specific rules upward into root docs when the
  behavior only matters inside this module.

## Commands

- `rg -n "user" src/api/flaskr/service src/api/tests` to locate all backend
  call sites and tests before editing.

- `cd src/api && pytest tests/service/user/ -q` for the narrowest focused
  regression pass while iterating on this module.

- `cd src/api && FLASK_APP=app.py flask db migrate -m "message"` and review
  the generated revision if schema or indexed business-key changes are made.

- `cd src/api && pytest -q` when a change touches shared DTOs, auth, streaming
  contracts, or other services in addition to this module.

## Tests

- Add or update focused tests around `src/api/tests/service/user/` for the
  happy path and the highest-risk validation, permission, or failure case.

- Expand coverage when payload shapes, error codes, or shared helper contracts
  used outside this module change.

- Review persistence-related changes manually for indexing, business-key
  semantics, and migration output whenever models move.

- Document any skipped provider, network, or credential-dependent checks in
  the final task summary.

## Related Skills

- src/api/skills/user-auth-flows/SKILL.md

- `src/api/SKILL.md`

- `SKILL.md`

- Create a new backend skill under `src/api/skills/<topic>/SKILL.md` when this
  module grows a repeatable multi-step debugging workflow.
