feat(auth): Initialize authentication API

[feryardiant]

Essentially this PR is an extraction of what's already implemented in our skeleton with the exception of UI.

Method	End-point	Name	Purpose
GET HEAD	/auth	base.verify	Verify that the authentication token is valid
DELETE	/auth	base.logout	Destroy current login session and auth token
POST	/auth/login	base.login	Create new login session and auth token
POST	/auth/refresh	base.refresh	Creat new auth token using existing valid refresh token
POST	/auth/register	base.register	Register new credential account
POST	/auth/forgot-password	base.password.forgot	Request new credential password
GET HEAD	/auth/reset-password/{token}	base.password.reset	Email link for user who forgot their password
PUT	/auth/reset-password	base.password.update	Update user' password
POST	/auth/email/verification-send	base.verification.send	Request new email verification
GET HEAD	/auth/email/verify/{id}/{hash}	base.verification.verify	Email link to verify user' email

---

base.verify

End-point: GET {APP_URL}/auth

Headers:

Key	Value
Authorization	Bearer {ACCESS_TOKEN}
Accept	application/json

Response:

• Success

  Status: 200 Ok

  {
      "data": {
          "id": 1,
          "name": "creasi",
          "email": "[email protected]",
          "email_verified_at": null,
          "created_at": "2024-02-10T10:38:46.000000Z",
          "updated_at": "2024-02-10T10:38:46.000000Z"
      }
  }

• Invalid Access Token

  Status: 401 Unauthorized

  {
      "message": "Unauthenticated"
  }

---

base.logout

End-point: DELETE {APP_URL}/auth

Headers:

Key	Value
Authorization	Bearer {ACCESS_TOKEN}
Accept	application/json

Response:

• Success Status: 204 No Content

• Invalid Access Token

  Status: 401 Unauthorized

  {
      "message": "Unauthenticated"
  }

---

base.login

End-point: POST {APP_URL}/auth/login

Headers:

Key	Value
Accept	application/json
Content-Type	application/json

Body:

Field	Rule	Option	Description
credential	string	required	-
password	string	required	-
remember	boolean	optional	-
device_token	string	optional	-

Response:

• Success

  Status: 201 Created

  {
      "data": {
          "id": 1,
          "name": "creasi",
          "email": "[email protected]",
          "email_verified_at": null,
          "created_at": "2024-02-10T10:38:46.000000Z",
          "updated_at": "2024-02-10T10:38:46.000000Z"
      },
      "auth": {
          "access_token": "random-string",
          "expires_at": "timestamp",
          "refresh_token": "random-string"
      }
  }

• Invalid Inputs

  Status: 422 Unprocessable Content

  {
      "message": "These credentials do not match our records.",
      "errors": {
          "credential": [
              "These credentials do not match our records."
          ]
      }
  }

---

base.refresh

End-point: POST {APP_URL}/auth/refresh

Headers:

Key	Value
Authorization	Bearer {REFRESH_TOKEN}
Accept	application/json

Response:

• Success

  Status: 201 Created

  {
      "data": {
          "id": 1,
          "name": "creasi",
          "email": "[email protected]",
          "email_verified_at": null,
          "created_at": "2024-02-10T10:38:46.000000Z",
          "updated_at": "2024-02-10T10:38:46.000000Z"
      },
      "auth": {
          "access_token": "1|abcdef123qAeVTkCdfzXSpU5SWDneKD0f6aNAeQ2a5b48f5",
          "expires_at": "2024-02-10T17:34:05.000000Z",
          "refresh_token": "2|abcdef1235Q8tMs2npYxMsXmH7YpLVwFE6qktI0f3ef274b"
      }
  }

• Invalid Access Token

  Status: 401 Unauthorized

  {
      "message": "Unauthenticated"
  }

---

base.register

End-point: POST {APP_URL}/auth/register

Headers:

Key	Value
Accept	application/json
Content-Type	application/json

Body:

Field	Rule	Option	Description
name	string min:2 max:150	required	-
email	string unique email	required	-
password	string min:8	required	-
password_confirmation	string equals:password	required	-

Response:

• Success

  Status: 201 Created

  {
      // Based on `creasico::auth.registered-no-verify` or `creasico::auth.registered-needs-verify` translation
      "message": "You have successfully registered. Don\'t forget to verify your email address."
  }

• Invalid Inputs

  Status: 422 Unprocessable Content

  {
      "message": "The name has already been taken. (and 1 more error)",
      "errors": {
          "name": [
              "The name has already been taken."
          ],
          "email": [
              "The email has already been taken."
          ]
      }
  }

---

base.password.forgot

End-point: POST {APP_URL}/auth/forgot-password

Headers:

Key	Value
Accept	application/json
Content-Type	application/json

Body:

Field	Rule	Option	Description
email	string exists email	required	-

Response:

• Success

  Status: 200 Ok

  {
      // Based on `passwords.send` translation
      "message": "We have emailed your password reset link!"
  }

• Invalid Inputs

  Status: 422 Unprocessable Content

  {
      "message": "The selected email is invalid.",
      "errors": {
          "email": [
              "The selected email is invalid."
          ]
      }
  }

---

base.password.reset

End-point: GET {APP_URL}/auth/reset-password/{token}

Route Params:

Field	Rule	Option	Description
token	string	required	Random string

Response:

Note
Not yet implemented! This should be a page that user can put their new password before send it to base.password.update, or it could be redirection so the front-end can handle it.

---

base.password.update

End-point: PUT {APP_URL}/auth/reset-password

Headers:

Key	Value
Accept	application/json
Content-Type	application/json

Body:

Field	Rule	Option	Description
token	string	required	The token that user receive in their email, or see base.password.reset route
email	string exists email	required	-
password	string	required	-
password_confirmation	string	required	-

Response:

• Success

  Status: 200 Ok

  {
      // Based on `passwords.reset` translation
      "message": "Your password has been reset!"
  }

---

base.verification.send

End-point: POST {APP_URL}/auth/email/verification-send

Headers:

Key	Value
Authorization	Bearer {ACCESS_TOKEN}
Accept	application/json

Response:

• Success

  Status: 200 Ok

  {
      // Based on `creasico::auth.email-verification-sent` translation
      "message": "A new verification link has been sent to your email address."
  }

• Invalid Access Token

  Status: 401 Unauthorized

  {
      "message": "Unauthenticated"
  }

---

base.verification.verify

End-point: GET {APP_URL}/auth/email/verify/{id}/{hash}

Route Params:

Field	Rule	Option	Description
id	string	required	User ID
hash	string	required	Random string

Response:

Note
Not yet implemented! This should be a page that user can put their new password before send it to base.password.update, or it could be redirection so the front-end can handle it.

[creasi]

Implementasi saat ini memang masih belum bisa meng-cover semua case yang umumnya kita butuhkan, tapi setidaknya sudah cukup untuk dijadikan pondasi feature apa saja yang perlu kita sediakan berikutnya.