Authentication API

{
  "username": "admin",
  "password": "plaintext-password"
}

{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "username": "admin",
    "role": "admin"
  }
}

{
  "route": "AUTH",
  "status": 401,
  "code": "INVALID_CREDENTIALS",
  "message": "Invalid credentials",
  "requestId": "uuid",
  "timestamp": "2024-01-01T00:00:00.000Z"
}

{
  "route": "BUILD" // Optional: "BUILD", "KV", "CORE" (defaults to "BUILD")
}

{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "route": "BUILD"
}

interface GatewayTokenClaims {
  projectId: string;        // User ID or "guest"
  route: ProjectRoute;      // "AUTH" | "KV" | "BUILD" | "CORE"
  scopes: string[];         // ["admin"] | ["guest"]
  environment: string;      // "staging" | "production"
  issuedBy: string;         // "gateway.metacogna.ai"
}

{
  "username": "admin",
  "salt": "random-salt-string",
  "hash": "sha256-hash-of-salt+password",
  "role": "admin"
}

// Pseudocode
const salt = generateRandomSalt();
const hash = SHA256(salt + password);
// Store {salt, hash} in R2

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

const response = await fetch('https://api.metacogna.ai/auth/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    username: 'admin',
    password: 'secure-password'
  })
});

const { token, user } = await response.json();
// Store token for subsequent requests

const response = await fetch('https://api.metacogna.ai/auth/guest', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ route: 'BUILD' })
});

const { token } = await response.json();

const response = await fetch('https://api.metacogna.ai/build/projects', {
  headers: {
    'Authorization': `Bearer ${token}`
  }
});