# AuthApi document shapes

This service expects JSON request bodies for its auth endpoints and stores user
documents in MongoDB.

Inbound JSON documents
- RegisterRequest (`POST /api/auth/register`)
  ```json
  {
    "username": "string",
    "password": "string",
    "email": "string"
  }
  ```
  Usernames must be 3-24 characters containing only letters, numbers, or
  underscores. Passwords must contain at least 8 characters, and email is
  required with a valid address format.
- LoginRequest (`POST /api/auth/login`)
  ```json
  {
    "username": "string",
    "password": "string"
  }
  ```
- RefreshRequest (`POST /api/auth/refresh`)
  ```json
  {
    "username": "string",
    "refreshToken": "string"
  }
  ```
- ChangeRoleRequest (`POST /api/auth/role`)
  ```json
  {
    "username": "string",
    "newRole": "USER | SUPER"
  }
  ```

Stored documents (MongoDB)
- User
  ```json
  {
    "id": "string (ObjectId)",
    "username": "string",
    "passwordHash": "string",
    "role": "USER | SUPER",
    "email": "string",
    "refreshToken": "string (optional)",
    "refreshTokenExpiry": "string (optional, ISO-8601 datetime)"
  }
  ```