# Auth Backend

The backend Auth module exposes token-based admin authentication routes.

Source root:

```txt
apps/backend/app/base_modules/Auth/
```

## Routes

| Method | Route          | Controller Method | Auth Required | Purpose                                     |
| ------ | -------------- | ----------------- | ------------- | ------------------------------------------- |
| `POST` | `/auth/login`  | `login`           | No            | Verify credentials and create bearer token. |
| `POST` | `/auth/logout` | `logout`          | Yes           | Invalidate current bearer token.            |
| `GET`  | `/auth/user`   | `user`            | Yes           | Return current admin and permission slugs.  |

Route file:

```txt
apps/backend/app/base_modules/Auth/routes.ts
```

## Request Flow

### Login

```txt
POST /auth/login
  -> auth_login_validator
  -> Admin.findBy('email')
  -> hash.verify(password)
  -> Admin.accessTokens.create(admin)
  -> return { type, token, user }
```

### Current User

```txt
GET /auth/user
  -> auth middleware
  -> auth.use('api').user
  -> load roles
  -> query role_permissions
  -> return { user, permissions }
```

## Validation

Login validator:

```txt
apps/backend/app/base_modules/Auth/validators/auth_login_validator.ts
```

Current rules:

- `email`: trimmed email string.
- `password`: trimmed string with minimum length 8.

## Token Guard

Auth config:

```txt
apps/backend/config/auth.ts
```

The admin model is configured as the token user provider:

```txt
apps/backend/app/base_modules/Admin/model/admin.ts
```

## Response Contracts

Login response consumed by frontend:

```ts
type LoginResponse = {
  type: "bearer";
  token: string;
  user: unknown;
};
```

Current-user response consumed by frontend:

```ts
type GetUserResponse = {
  user: {
    id: number;
    email: string;
    firstName: string;
    lastName: string;
    status: string;
    createdAt: string;
    roles: Array<{ id: number; name: string }>;
  };
  permissions: string[];
};
```

## Ownership Rules

- Auth backend owns token creation, token invalidation, and current-user response shape.
- Admin backend owns admin persistence and profile updates.
- Permission data in `/auth/user` is derived from role-permission rows.