Authentication REST API

Manager's public authentication endpoints live under /api/auth/*. Except for the WebView HTML page identified below, responses use the standard envelope:

{
  "success": true,
  "code": 0,
  "message": "",
  "data": {}
}

Fields use snake_case. Business refusals (such as a wrong password or rejected credential change) normally remain HTTP 200, so clients must inspect success and code. A protected request without a valid login session returns HTTP 401 with the same envelope shape.

Current Endpoints

Method	Path	Purpose
POST	/api/auth/login	Sign in with username or email; an input containing @ uses only the email lane
POST	/api/auth/logout	Idempotently end the current browser session
GET	/api/auth/me	Return the current-user DTO in the standard envelope
PATCH	/api/auth/credentials	Change credentials for the current account
POST	/api/auth/register	Register
POST	/api/auth/verify-email	Complete email verification with a single-use token
POST	/api/auth/resend-verification	Resend verification with a neutral response
POST	/api/auth/forgot-password	Request a password-reset email with a neutral response
POST	/api/auth/reset-password	Set a new password with a single-use token
POST	/api/auth/confirm-email-change	Confirm an email change for the current account
POST	/api/auth/confirm-account-deletion	Confirm deletion and start the cooling-off period
GET	/api/auth/config	Return public registration, username, and challenge settings
GET	/api/auth/turnstile	Return the manager-origin Turnstile HTML page for native mobile WebViews (not a JSON envelope)
GET	/api/auth/providers	Return the currently available external sign-in providers

The data returned by GET /api/auth/me is CurrentUserDto, including an optional user id, name, avatar, email, access level, and optional target connection for the current session. An unauthenticated client must use HTTP 401 and the standard envelope rather than interpreting a historical template response.

Change credentials by posting required current_username and current_password, plus optional new_username and new_password, to PATCH /api/auth/credentials; clients should use only the current paths listed above. Third-party OAuth authorization, callback, and identity linking remain under /api/oauth/*.