Backend: Authentication & Authorization #22
Description
Description: Implement JWT-based authentication with refresh tokens, user sessions, and rate limiting.
Acceptance Criteria:
- POST /api/auth/login endpoint (wallet signature verification)
- POST /api/auth/refresh endpoint for token refresh
- JWT middleware to protect private routes
- Rate limiting middleware (100 req/min per user)
- Session management with Redis
- Wallet address verification (Stellar)
- Unit + integration tests for auth flows
Tests (minimum):
- Valid login returns JWT tokens
- Invalid credentials rejected with 401
- Protected routes require valid JWT
- Rate limiter blocks excessive requests
- Refresh token flow works correctly
Files: backend/src/routes/auth.ts, backend/src/middleware/auth.ts, backend/src/services/auth.ts
Dependencies: None (can start immediately)