Files

T

john-okeefe 8a6ea39ed2 docs(auth): document 7-day session authentication with constants

- Add comprehensive authentication overview.md explaining:
  - 7-day session duration for JWT and refresh tokens
  - Constants-based implementation (no hardcoded values)
  - Complete authentication flow (register/login/refresh/logout)
  - Session expiration handling (HTML redirect vs JSON error)
  - Security features (HTTP-only cookies, token rotation)
  - Token storage recommendations
- Update login.md with 7-day expires_in field and cookie MaxAge
- Update register.md with 7-day session duration details
- Update refresh_token.md with expires_in: 604800

Documentation provides complete reference for authentication
endpoints with examples and security considerations.

2026-02-16 16:50:43 -05:00

1.5 KiB

Raw Blame History

Register User

Create a new user account.

Endpoint: POST /api/auth/register Auth: Not required Content-Type: application/json or application/x-www-form-urlencoded

Request Body

Field	Type	Required	Description
email	string	Yes	User's email address
username	string	Yes	Desired username (3-50 chars)
password	string	Yes	Password (min 8 chars, must meet complexity requirements)
first_name	string	No	User's first name
last_name	string	No	User's last name

Example Request

{
  "email": "user@example.com",
  "username": "john",
  "password": "SecureP@ss123!",
  "first_name": "John",
  "last_name": "Doe"
}

Response (201 Created)

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token": "d4f5g6h7...",
  "token_type": "Bearer",
  "expires_in": 604800,
  "user": {
    "id": "uuid-here",
    "email": "user@example.com",
    "username": "john",
    "first_name": "John",
    "last_name": "Doe",
    "role": "user",
    "theme": "tokyo-night",
    "created_at": "2026-01-31T10:00:00Z"
  }
}

Set-Cookie Header:

Set-Cookie: token=eyJhbG...; Max-Age=604800; Path=/; HttpOnly

Session Duration: 7 days (604800 seconds)

First User: The first user registered automatically becomes an admin.

Error Responses

Code	Description
400	Invalid email format, weak password, or missing fields
409	Email or username already exists

1.5 KiB Raw Blame History