Authentication

Endpoints for logging in, refreshing tokens, managing the current user's profile, and changing credentials.

Endpoints overview

Method	Endpoint	Permission	Description
POST	/auth/login	—	Log in, receive tokens
POST	/auth/refresh	—	Refresh access token
POST	/auth/logout	authenticated	Clear refresh token
GET	/auth/me	authenticated	Get current user
PATCH	/auth/me	authenticated	Update current user profile
PATCH	/auth/change-password	authenticated	Change password
PATCH	/auth/avatar	authenticated	Upload avatar
DELETE	/auth/avatar	authenticated	Delete avatar

Endpoints

Login

POST /auth/login

Rate limited.

Request body

{ "login": "user@example.com", "password": "secret" }

Response — 200

{ "accessToken": "<jwt>" }

The refresh token is returned as an HttpOnly cookie.

---

Refresh token

POST /auth/refresh

Rate limited. Reads the refresh token from the HttpOnly cookie and issues a new access token.

Response — 200

{ "accessToken": "<new_jwt>" }

---

Logout

POST /auth/logout — Auth required

Clears the refresh token cookie server-side.

Response — 204

---

Get current user

GET /auth/me — Auth required

Response — 200

{
  "id": "a1b2c3d4-0000-0000-0000-000000000001",
  "email": "jane@example.com",
  "enName": "Jane",
  "enSurname": "Smith",
  "uaName": "Джейн",
  "uaSurname": "Сміт",
  "roleId": "role-uuid",
  "role": "Editor",
  "avatarUrl": "/api/characters/file/avatars/jane.jpg",
  "createdAt": "2025-01-10T09:00:00.000Z",
  "permissions": [
    { "name": "episode:create", "scope": "global" },
    { "name": "scene:edit", "scope": "assigned" }
  ]
}

---

Update current user profile

PATCH /auth/me — Auth required

Request body (all fields optional)

{
  "enName": "Jane",
  "enSurname": "Smith",
  "uaName": "Джейн",
  "uaSurname": "Сміт",
  "roleId": "role-uuid"
}

Response — 200 — updated user object (same shape as GET /auth/me)

---

Change password

PATCH /auth/change-password — Auth required, Rate limited

All active sessions are revoked after a successful password change.

Request body

{
  "currentPassword": "old_secret",
  "newPassword": "new_secret"
}

Response — 204

---

Upload avatar

PATCH /auth/avatar — Auth required, Rate limited, multipart/form-data

Form field: file — image file (JPEG / PNG)

Response — 200 — updated user object (same shape as GET /auth/me)

---

Delete avatar

DELETE /auth/avatar — Auth required

Response — 200 — updated user object with avatarUrl: null