gemini_cli_skill

```python
# File: user_auth_service.py
# Generated by gemini_cli_skill for project 'SecureApp'
# Reviewed for security and performance issues on 2024-05-15

import bcrypt
import jwt
from datetime import datetime, timedelta
from typing import Optional

class UserAuthService:
    def __init__(self, secret_key: str):
        self.secret_key = secret_key
        # Security Note: secret_key should be loaded from environment variables in production
        
    def hash_password(self, password: str) -> str:
        """Securely hash a password using bcrypt with cost factor 12"""
        salt = bcrypt.gensalt(rounds=12)
        return bcrypt.hashpw(password.encode('utf-8'), salt).decode('utf-8')
        
    def verify_password(self, password: str, hashed: str) -> bool:
        """Verify a password against its hashed version"""
        return bcrypt.checkpw(password.encode('utf-8'), hashed.encode('utf-8'))
        
    def generate_token(self, user_id: str, expires_in: int = 3600) -> str:
        """Generate a JWT token with expiration"""
        payload = {
            'sub': user_id,
            'iat': datetime.utcnow(),
            'exp': datetime.utcnow() + timedelta(seconds=expires_in)
        }
        return jwt.encode(payload, self.secret_key, algorithm='HS256')
        
    def validate_token(self, token: str) -> Optional[str]:
        """Validate a JWT token and return user_id if valid"""
        try:
            payload = jwt.decode(token, self.secret_key, algorithms=['HS256'])
            return payload['sub']
        except jwt.ExpiredSignatureError:
            raise ValueError("Token has expired")
        except jwt.InvalidTokenError:
            raise ValueError("Invalid token")

# Performance Note: Consider using async bcrypt for high-load scenarios
# Security Note: Implement token blacklisting for logout functionality
```

**Review Summary:**
1. **Security:** ✅ Uses bcrypt with appropriate cost factor (12) for password hashing. JWT implementation is secure with HS256 algorithm. 
2. **Performance:** ⚠️ Synchronous bcrypt operations may cause blocking under high load. Consider async alternatives.
3. **Bugs:** ❌ No input validation for password strength (should enforce min length/complexity)
4. **Improvements:** Add token blacklisting mechanism for logout functionality. Consider rate limiting for auth endpoints.

**Recommendations:**
- Add password complexity requirements in hash_password()
- Implement async bcrypt for production use
- Add token revocation list for logout functionality
- Consider adding refresh token mechanism