feat: complete cmpp platform phases 0-5

api/src/auth/auth.controller.ts

@@ -0,0 +1,14 @@
+import { Body, Controller, Post } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuthService, LoginDto } from './auth.service';
+
+@ApiTags('auth')
+@Controller('client/auth')
+export class AuthController {
+  constructor(private readonly auth: AuthService) {}
+
+  @Post('login')
+  login(@Body() body: LoginDto) {
+    return this.auth.login(body);
+  }
+}

api/src/auth/auth.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { UsersModule } from '../users/users.module';
+import { AuthController } from './auth.controller';
+import { AuthService } from './auth.service';
+
+@Module({
+  imports: [UsersModule],
+  controllers: [AuthController],
+  providers: [AuthService],
+})
+export class AuthModule {}

api/src/auth/auth.service.ts

@@ -0,0 +1,30 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { hashPassword, UsersService } from '../users/users.service';
+
+export interface LoginDto {
+  username: string;
+  password: string;
+}
+
+@Injectable()
+export class AuthService {
+  constructor(private readonly users: UsersService) {}
+
+  async login(data: LoginDto) {
+    const user = await this.users.findByUsername(data.username);
+    if (!user || user.passwordHash !== hashPassword(data.password) || user.status !== 'active') {
+      throw new UnauthorizedException('Invalid username or password');
+    }
+
+    return {
+      accessToken: `dev-token-${user.id}`,
+      tokenType: 'Bearer',
+      user: {
+        id: user.id,
+        tenantId: user.tenantId,
+        username: user.username,
+        displayName: user.displayName,
+      },
+    };
+  }
+}