You are a FastAPI Specialist implementing backend endpoints.

WORKFLOW:

1. PRE-FLIGHT CHECKS (REQUIRED):
   - Read kb/fastapi-patterns.md for existing conventions
   - Read kb/designs/backend-architect/[design-id].md for specifications
   - Read kb/api-contracts.md for existing endpoints

2. IMPLEMENTATION:
   - Create Pydantic models for request/response validation
   - Implement async endpoint following design spec
   - Use proper HTTP status codes and error handling
   - Add OpenAPI documentation via docstrings

3. KNOWLEDGE BASE UPDATES (REQUIRED):
   - Update kb/api-contracts.md with new endpoint
   - Update kb/fastapi-patterns.md if new pattern used
   - Add implementation notes to design doc

CONSTRAINTS:
- ALWAYS read design doc before implementing
- ALWAYS use Pydantic for validation
- ALWAYS use async/await for I/O operations
- ALWAYS update KB after implementation

Current task: {task_description}
Design document: {design_doc_path}

# Design: User Authentication Endpoint

## Endpoint Specification

POST /api/auth/login

Request:
- email: string (email format)
- password: string (min 8 chars)

Response (200):
- access_token: string
- user: { id, email, role }

Response (401):
- detail: "Invalid credentials"

## Business Logic

1. Validate email/password format
2. Check credentials against database
3. Generate JWT token
4. Return token + user info

# models/auth.py
from pydantic import BaseModel, EmailStr, Field

class LoginRequest(BaseModel):
    """User login credentials"""
    email: EmailStr = Field(..., description="User email address")
    password: str = Field(..., min_length=8, description="User password")

class UserResponse(BaseModel):
    """User information"""
    id: str
    email: EmailStr
    role: str

class LoginResponse(BaseModel):
    """Successful login response"""
    access_token: str = Field(..., description="JWT access token")
    user: UserResponse

# routers/auth.py
from fastapi import APIRouter, HTTPException, Depends
from sqlalchemy.ext.asyncio import AsyncSession
from models.auth import LoginRequest, LoginResponse
from services.auth_service import verify_credentials, create_access_token
from database import get_db

router = APIRouter(prefix="/api/auth", tags=["authentication"])

@router.post("/login", response_model=LoginResponse)
async def login(
    request: LoginRequest,
    db: AsyncSession = Depends(get_db)
) -> LoginResponse:
    """
    Authenticate user and return access token.

    - **email**: User email address
    - **password**: User password (min 8 characters)

    Returns JWT access token and user information.
    """
    # Verify credentials
    user = await verify_credentials(db, request.email, request.password)
    if not user:
        raise HTTPException(
            status_code=401,
            detail="Invalid credentials"
        )

    # Generate token
    access_token = create_access_token(user.id)

    return LoginResponse(
        access_token=access_token,
        user=UserResponse(
            id=user.id,
            email=user.email,
            role=user.role
        )
    )

## POST /api/auth/login

Authenticate user and return JWT token.

**Request:**
```json
{
  "email": "user@example.com",
  "password": "securepass123"
}

{
  "access_token": "eyJhbGc...",
  "user": {
    "id": "user_123",
    "email": "user@example.com",
    "role": "admin"
  }
}

{
  "detail": "Invalid credentials"
}