[Wave 200pts] Implement Full User Registration and Login Flow with Password Hashing, JWT Issuance, and Refresh Token Rotation

[portableDD]

Summary

AuthModule exists with partial AuthService but there are no registration or login endpoints. JwtAuthGuard is fully implemented but has nothing to authenticate.

Why This Matters

No user can authenticate without login and registration. Every other feature in the platform depends on auth. This is the most foundational missing feature in the application.

What Needs to Be Done

• Build POST /auth/register: validate DTO, hash password with bcrypt, create user, issue JWT + refresh token
• Build POST /auth/login: validate credentials, issue tokens
• Build POST /auth/logout: blacklist refresh token
• Build POST /auth/refresh: rotate refresh token, issue new JWT
• Implement refresh token family tracking to detect reuse attacks
• Write unit and integration tests covering all flows

Key Files

• src/modules/auth/auth.service.ts — add register, login, logout, refreshTokens
• src/modules/auth/auth.controller.ts — create with all endpoints
• src/modules/auth/auth.module.ts — register all providers
• src/modules/users/entities/user.entity.ts — ensure password, refreshToken, status fields exist
• src/database/migrations/xxxx-auth-fields.ts — add missing auth columns
• src/modules/auth/auth.service.spec.ts — unit tests
• test/auth.e2e-spec.ts — integration tests

Acceptance Criteria

• POST /auth/register creates user, hashes password, returns JWT + refresh token
• POST /auth/login validates credentials and returns tokens
• POST /auth/logout blacklists the refresh token
• POST /auth/refresh rotates refresh token — old token rejected after rotation
• Passwords stored with bcrypt cost factor ≥ 12
• JWT uses SecretsService.getValidSecrets() for signing
• Duplicate email registration returns 409
• All integration tests pass

Constraints

• Refresh tokens must be stored hashed
• JWT payload must include sub, email, role, iat, exp
• Refresh token family tracking must detect reuse attacks
• Complexity: High — 200 points