Auth System

This module handles user authentication using JWT access tokens and refresh tokens.

---

APIs

POST /register

• Registers a new user with:
  • username
  • email
  • password
• Password must be at least 8 characters long.
• Invalid or missing inputs return:
  • 400 Bad Request
• Password is securely hashed before storing in the database.
• On success:
  • returns 201 Created

---

POST /login

• Authenticates user using email and password.
• If user does not exist:
  • returns 401 Unauthorized
• If password is incorrect:
  • returns 401 Unauthorized
• On successful authentication:
  • issues JWT access token
  • issues refresh token
• Refresh token is stored in an HttpOnly cookie
• Access token is returned in response body

---

POST /logout

• Logs out the user by invalidating the refresh token
• Refresh token is removed from:
  • client cookie
  • (and server store, if applicable)
• Returns:
  • 200 OK

---

POST /refresh

• Generates a new access token using a valid refresh token
• Refresh token is validated before issuing a new access token
• If refresh token is invalid or expired:
  • returns 401 Unauthorized
• On success:
  • returns a new access token