[Backend] Implement JWT Authentication Module #429
Description
The platform needs a complete authentication system built with NestJS. This module will be the security foundation for all protected API routes.
Requirements
POST /api/auth/register— Create a new user account (firstName, lastName, email, password). Hash password with bcrypt before storing.POST /api/auth/login— Validate credentials, return short-lived JWT access token (15 min) and long-lived refresh token (7 days). Store a bcrypt hash of the refresh token on the user row.POST /api/auth/refresh— Accept a valid refresh token in the request body, return a new access token.POST /api/auth/logout— Invalidate the stored refresh token hash for the authenticated user.GET /api/auth/me— Return the currently authenticated user's profile.- JWT strategy using
@nestjs/passport+passport-jwt. Guard exported asJwtAuthGuard. @CurrentUser()parameter decorator to inject the authenticated user into controller methods.- DTOs with
class-validatorfor all request bodies.
Tech Stack
- NestJS 10,
@nestjs/jwt,@nestjs/passport,passport-jwt,bcrypt,class-validator
Acceptance Criteria
- All 5 endpoints functional and protected/unprotected correctly
- Passwords never stored in plain text
- Refresh token hashed before storage
-
JwtAuthGuardand@CurrentUser()decorator available for other modules to use