Technical Spec in 5 Minutes

-- Users table
CREATE TABLE users (
    id            BIGSERIAL PRIMARY KEY,
    email         VARCHAR(255) NOT NULL UNIQUE,
    password_hash VARCHAR(255) NOT NULL,
    first_name    VARCHAR(100),
    last_name     VARCHAR(100),
    phone         VARCHAR(20),
    role          VARCHAR(20) DEFAULT 'client'
                  CHECK (role IN ('client','trainer','admin')),
    is_active     BOOLEAN DEFAULT TRUE,
    created_at    TIMESTAMPTZ DEFAULT NOW(),
    updated_at    TIMESTAMPTZ DEFAULT NOW()
);

-- Subscriptions table
CREATE TABLE subscriptions (
    id            BIGSERIAL PRIMARY KEY,
    user_id       BIGINT NOT NULL REFERENCES users(id),
    plan_id       BIGINT NOT NULL REFERENCES plans(id),
    starts_at     DATE NOT NULL,
    expires_at    DATE NOT NULL,
    status        VARCHAR(20) DEFAULT 'active'
                  CHECK (status IN ('active','frozen','expired','cancelled')),
    paid_amount   DECIMAL(10,2) NOT NULL,
    payment_id    VARCHAR(100),
    created_at    TIMESTAMPTZ DEFAULT NOW()
);

CREATE INDEX idx_subscriptions_user ON subscriptions(user_id);
CREATE INDEX idx_subscriptions_status ON subscriptions(status);

-- Workouts table
CREATE TABLE workouts (
    id            BIGSERIAL PRIMARY KEY,
    trainer_id    BIGINT NOT NULL REFERENCES users(id),
    title         VARCHAR(200) NOT NULL,
    type          VARCHAR(50) NOT NULL,
    max_clients   INT DEFAULT 10,
    duration_min  INT DEFAULT 60,
    starts_at     TIMESTAMPTZ NOT NULL,
    room          VARCHAR(50)
);

CREATE INDEX idx_workouts_date ON workouts(starts_at);

openapi: 3.0.3
info:
  title: FitCRM API
  version: 1.0.0

paths:
  /api/v1/auth/register:
    post:
      summary: Register new client
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required: [email, password, first_name]
              properties:
                email: {type: string, format: email}
                password: {type: string, minLength: 8}
                first_name: {type: string}
                phone: {type: string}
      responses:
        '201':
          description: User created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserResponse'
        '409':
          description: Email already registered

  /api/v1/workouts:
    get:
      summary: Workout schedule
      parameters:
        - name: date_from
          in: query
          schema: {type: string, format: date}
        - name: trainer_id
          in: query
          schema: {type: integer}
      responses:
        '200':
          description: List of workouts
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Workout'

  /api/v1/workouts/{id}/book:
    post:
      summary: Book a workout
      security: [{bearerAuth: []}]
      responses:
        '200': {description: Successfully booked}
        '409': {description: No available spots}

fitcrm/
├── backend/
│   ├── app/
│   │   ├── __init__.py
│   │   ├── main.py              # FastAPI entrypoint
│   │   ├── config.py            # Settings (pydantic)
│   │   ├── models/
│   │   │   ├── user.py
│   │   │   ├── subscription.py
│   │   │   ├── workout.py
│   │   │   └── booking.py
│   │   ├── api/
│   │   │   ├── v1/
│   │   │   │   ├── auth.py
│   │   │   │   ├── users.py
│   │   │   │   ├── workouts.py
│   │   │   │   ├── subscriptions.py
│   │   │   │   └── bookings.py
│   │   │   └── deps.py          # Dependencies (auth, db)
│   │   ├── services/
│   │   │   ├── auth_service.py
│   │   │   ├── payment_service.py
│   │   │   └── notification.py
│   │   └── db/
│   │       ├── session.py
│   │       └── migrations/
│   ├── tests/
│   ├── Dockerfile
│   └── requirements.txt
├── frontend/
│   ├── src/
│   │   ├── pages/
│   │   ├── components/
│   │   ├── hooks/
│   │   └── api/
│   └── package.json
├── docker-compose.yml
├── nginx.conf
└── README.md

## Security Model

### Authentication
- JWT Access Token (TTL: 15 minutes)
- JWT Refresh Token (TTL: 7 days, httpOnly cookie)
- Bcrypt for password hashing (cost factor: 12)

### Authorization (RBAC)
| Role    | Permissions                                |
|---------|---------------------------------------------|
| client  | View schedule, book workouts               |
| trainer | Manage own workouts, view client list       |
| admin   | Full access, user management               |

### OWASP Top-10 Mitigations
- SQL Injection → ORM (SQLAlchemy), parameterized queries
- XSS → Content-Security-Policy, output escaping
- CSRF → SameSite cookies, CSRF tokens
- Broken Auth → Rate limiting (5 attempts/min), account lockout
- IDOR → owner_id validation at service layer

### Rate Limiting
| Endpoint          | Limit            |
|-------------------|------------------|
| /auth/login       | 5 req/min/IP     |
| /auth/register    | 3 req/min/IP     |
| /api/*            | 100 req/min/user |

### Encryption
- TLS 1.3 (HTTPS only)
- AES-256-GCM for PII in database
- Personal data: masked in logs