AUTH API Audit — WELIFE · 2026-08-06

WP: WP-AUTH-COMPAT-01 · Domain: D-AUTH Lỗi gốc: Cannot POST /api/v1/register (404)

Verdict

Path	Live	Ghi chú
`POST /api/v1/register`	200	Alias compat — trước đây 404
`POST /api/v1/auth/register`	200	Canonical — mobile `AuthApi.registerPassword`
`POST /api/v1/login`	200	Alias → loginPassword
`POST /api/v1/auth/login`	200	Alias baotienweb — nhận `email` hoặc `identifier`
`POST /api/v1/auth/login/password`	200	Canonical — nhận `email` hoặc `identifier`
`POST /api/v1/auth/email/otp/*`	200	SMTP Mailpit `:1026` · `mailSent=true`
`POST /api/v1/auth/login/password/2fa`	ALIVE	Email/TOTP 2FA
`POST /api/v1/auth/2fa/email/enable`	ALIVE	JWT
`GET /api/v1/auth/me`	200	Alias → `/users/me`
`GET /api/v1/users/me`	200	Canonical profile
`POST /auth/password/forgot\|reset`	ALIVE	Anti-enumeration
`POST /auth/otp/send\|verify`	ALIVE	Phone OTP (console SMS local)
`POST /auth/refresh`	401 (bad token)	Route sống
`GET /auth/sessions` · `2fa/status`	200 (JWT)

Nguyên nhân 404

Client gọi /api/v1/register (thiếu /auth). Mobile WELIFE đã đúng /auth/register — lỗi từ Postman / Swagger / client ngoài / base URL sai.

Luồng dữ liệu (Consumer)

RegisterScreen
  → AuthContext.registerPassword
  → AuthApi.registerPassword  path=/auth/register
  → http://…/api/v1/auth/register
  → AuthService.registerPassword
       · bcrypt passwordHash → Redis OTP (REGISTER)
       · MailService → SMTP 127.0.0.1:1026 → Mailpit UI :8026
  → VerifyEmailScreen → POST /auth/email/otp/verify
       · User.passwordHash + JWT session (Postgres)

LoginScreen (password)
  → AuthApi.loginPassword → /auth/login/password
       body: { identifier|email, password }
  → nếu UserTwoFactor.enabled
       → OTP email (PASSWORD_2FA) · { requiresTwoFa }
       → /auth/login/password/2fa → JWT
  → else JWT + AuthSession row

FE callers (đã pin)

Surface	File	Path
CON	`mobile/src/services/api.ts`	`/auth/register`, `/auth/login/password`, …
CON	`RegisterScreen` / `AuthContext`	qua AuthApi
DRV	`driver/.../RegisterScreen`	`/driver/register` (hồ sơ tài xế, không auth user)
ADM	dashboard	email OTP (không password register)

So với `BE-baotienweb.cloud`

baotienweb	WELIFE	Status
`POST /auth/register`	`POST /auth/register` + `/register`	OK
`POST /auth/login`	`/auth/login/password` + aliases	OK
`GET /auth/me`	`/auth/me` + `/users/me`	OK
`POST /auth/2fa/login/*`	`login/password` → `requiresTwoFa` + `/login/password/2fa`	OK (khác shape)
`POST /auth/2fa/register/*`	gộp register + email/otp	OK (khác shape)
`forgot-password` / `reset-password*`	`/auth/password/forgot` · `/reset`	Path khác — dùng WELIFE
Biometric · Apple · RBAC matrix	chưa	OWNER / sau
Google live Client IDs	stub/verify path có	OWNER_REQUIRED

Env SMTP (local)

SMTP_HOST=127.0.0.1 · SMTP_PORT=1026
UI: http://localhost:8026
Sai 1025 → mailSent=false

Files đụng (WP-AUTH-COMPAT-01)

api/src/modules/auth/auth-alias.controller.ts — /register, /login
api/src/modules/auth/dto/auth-compat.dto.ts
api/src/modules/auth/auth.controller.ts — /auth/login, /auth/me, email map
api/src/modules/auth/dto/auth.dto.ts — email alias fields
api/src/common/filters/safe-http-exception.filter.ts — error name theo status
mobile/src/services/api.ts — skip refresh cho /register·/login
docs/reports/AUTH-API-AUDIT.md

Test pin (2026-08-06)

# Alias trước đây 404
curl -X POST http://localhost:3000/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"email":"a@test.com","password":"Wl!TestPass99","name":"A"}'
# → 200 mailSent

# Login body baotienweb
curl -X POST http://localhost:3000/api/v1/auth/login/password \
  -H "Content-Type: application/json" \
  -d '{"email":"…","password":"…"}'
# → 200 accessToken