Authentifizierung

import { jwt } from "std:auth";

// Login und Token erstellen
@POST("/api/login")
fn login(email: string, password: string): LoginResponse {
    let user = db.findBy(User, "email", email);
    
    if (!crypto.argon2Verify(password, user.passwordHash)) {
        throw HttpError(401, "Ungültige Anmeldedaten");
    }
    
    let token = jwt.sign({
        sub: user.id,
        role: user.role,
        exp: now() + "7d",
    }, env.JWT_SECRET);
    
    return LoginResponse { token, user };
}

// Token validieren
@Auth
@GET("/api/profile")
fn getProfile(): User {
    // currentUser() extrahiert User aus validiertem Token
    return currentUser();
}

// OAuth2-geschützter Endpunkt
@OAuth2
@GET("/api/profile")
fn getOAuthProfile(): User {
    return currentUser();
}

// OpenID Connect
@OIDC
@GET("/api/userinfo")
fn getUserInfo(): UserInfo {
    return fetchUserInfo();
}

// Multi-Factor Authentication
@MFA
@POST("/api/sensitive-action")
fn performSensitiveAction(): ActionResult {
    return executeAction();
}

// Vault Integration für Secrets
@VaultSecret("secret/data/api", "api_key")
struct ApiConfig {
    apiKey: string,
}