zero-fucks-given/docs/core/auth/backend.md

Auth Backend

The backend Auth module exposes token-based admin authentication routes.

Source: apps/backend/app/base_modules/Auth/

Routes

Method	Route	Controller Method	Auth Required	Purpose
POST	/auth/login	login	No	Verify credentials and create bearer token.
POST	/auth/logout	logout	Yes	Invalidate current bearer token.
GET	/auth/user	user	Yes	Return current admin and permission slugs.

Route file:

apps/backend/app/base_modules/Auth/routes.ts

Request Flow

Login

POST /auth/login
  -> auth_login_validator
  -> Admin.findBy('email')
  -> hash.verify(password)
  -> Admin.accessTokens.create(admin)
  -> return { type, token, user }

Current User

GET /auth/user
  -> auth middleware
  -> auth.use('api').user
  -> load roles
  -> query role_permissions
  -> return { user, permissions }

Validation

Login validator:

apps/backend/app/base_modules/Auth/validators/auth_login_validator.ts

Current rules:

• email: trimmed email string.
• password: trimmed string with minimum length 8.

Token Guard

Auth config:

apps/backend/config/auth.ts

The admin model is configured as the token user provider:

apps/backend/app/base_modules/Admin/model/admin.ts

Response Contracts

Login response consumed by frontend:

type LoginResponse = {
  type: "bearer";
  token: string;
  user: unknown;
};

Current-user response consumed by frontend:

type GetUserResponse = {
  user: {
    id: number;
    email: string;
    firstName: string;
    lastName: string;
    status: string;
    createdAt: string;
    roles: Array<{ id: number; name: string }>;
  };
  permissions: string[];
};

Ownership Rules

• Auth backend owns token creation, token invalidation, and current-user response shape.
• Admin backend owns admin persistence and profile updates.
• Permission data in /auth/user is derived from role-permission rows.