Authentication

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 604800,
  "user": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "email": "user@example.com",
    "name": "John Doe",
    "role": "employee",
    "organizationId": "org-uuid"
  }
}

curl -X POST "https://api.hitler.app/api/auth/register" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "newuser@example.com",
    "password": "secure-password-123",
    "name": "Jane Smith",
    "organizationId": "org-uuid"
  }'

1. Frontend requests OAuth URL
2. User redirected to Slack
3. User authorizes
4. Slack redirects to callback
5. API exchanges code for tokens
6. JWT returned to frontend

curl "https://api.hitler.app/api/auth/slack/url?returnUrl=https://app.hitler.app"

{
  "url": "https://slack.com/oauth/v2/authorize?client_id=...",
  "state": "random-state-string",
  "callbackUrl": "https://api.hitler.app/api/auth/slack/callback",
  "type": "signin"
}

curl "https://api.hitler.app/api/auth/me" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

curl -X POST "https://api.hitler.app/api/auth/refresh" \
  -H "Authorization: Bearer YOUR_CURRENT_TOKEN"

{
  "accessToken": "new-jwt-token...",
  "expiresIn": 604800,
  "user": { ... }
}

curl "https://api.hitler.app/api/auth/me" \
  -H "Authorization: Bearer YOUR_TOKEN"

{
  "id": "user-uuid",
  "email": "user@example.com",
  "name": "John Doe",
  "role": "employee",
  "organizationId": "org-uuid"
}

{
  "sub": "user-uuid",
  "orgId": "organization-uuid",
  "role": "employee",
  "iat": 1642089600,
  "exp": 1642694400
}

{
  "statusCode": 401,
  "message": "Invalid credentials",
  "error": "Unauthorized"
}

{
  "statusCode": 401,
  "message": "Token expired",
  "error": "Unauthorized"
}

{
  "statusCode": 409,
  "message": "Email already registered",
  "error": "Conflict"
}