# TA-ATS Implementation Plan

## Objective
Build the TA-ATS (Talent Acquisition - Applicant Tracking System) starting with the secure Login and Dashboard modules, as specified in the provided BRD, PRD, HLD, and LLD.

## Architecture & Tech Stack
*   **Backend**: Python 3.12, Django 5, Django REST Framework, PostgreSQL 16, Redis (for rate limiting and async tasks).
*   **Frontend**: Next.js (React 18).
*   **Security**: JWT Authentication (Simple JWT) with rotation, Argon2id password hashing, sliding-window rate limiting, and audit logging.
*   **Note on MCP**: As requested, the architecture will be designed in a modular way (MVC/Service layer pattern) to make it easy for you to expose these services via a Model Context Protocol (MCP) server in the future, while strictly adhering to the REST API design outlined in the LLD.

## Implementation Steps

### Phase 1: Project Initialization & Setup
1.  **Backend Setup**: Initialize a Django project (`ats_backend`), configure PostgreSQL, Redis, and Django REST Framework.
2.  **Frontend Setup**: Initialize a Next.js application (`ats_frontend`) with React 18.
3.  **Environment**: Set up basic `.env` configurations.

### Phase 2: Backend Authentication Module
1.  **User Model**: Implement custom user model (`auth_user`) using Argon2id for password hashing.
2.  **JWT Auth**: Configure `djangorestframework-simplejwt` (15m access, 7d refresh, blacklist on logout).
3.  **Rate Limiting**: Implement Redis-based sliding window rate limiting (5 req/min) for login.
4.  **Login API**: Create `POST /api/v1/auth/login/` and `POST /api/v1/auth/token/refresh/`.
5.  **Account Lockout & Audit**: Implement logic to lock account after 5 failed attempts and log events (SUCCESS, FAIL, LOCKOUT) to `auth_event_log`.

### Phase 3: Backend Dashboard Module
1.  **Models**: Create models for dashboard widgets (`dashboard_widget`).
2.  **Dashboard API**: Implement `GET /api/v1/dashboard/` to return job summary counts and widget data for authenticated users.

### Phase 4: Frontend Implementation (Next.js)
1.  **Auth Service**: Implement API client for login, token refresh, and logout.
2.  **Login UI**: Build the centered login card with email, password, and error handling.
3.  **Dashboard UI**: Build the dashboard page with a top navigation bar and a grid of widget cards displaying job metrics.
4.  **Route Protection**: Secure dashboard routes to ensure only authenticated users can access them.

### Phase 5: Verification & Testing
1.  Verify JWT token issuance and rotation.
2.  Test rate limiting and account lockout mechanisms.
3.  Verify Dashboard data retrieval and UI rendering.
4.  End-to-end testing of the Login -> Dashboard flow.