POST /auth/login

curl -X POST https://api.xem.email/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "john.doe@example.com",
    "password": "secure_password123"
  }'

const response = await fetch('https://api.xem.email/api/v1/auth/login', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'john.doe@example.com',
    password: 'secure_password123'
  })
});

const data = await response.json();

import requests

response = requests.post(
    'https://api.xem.email/api/v1/auth/login',
    json={
        'email': 'john.doe@example.com',
        'password': 'secure_password123'
    }
)

data = response.json()

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "user_123",
    "email": "john.doe@example.com",
    "first_name": "John",
    "last_name": "Doe",
    "role": "ADMIN",
    "team_id": "team_456",
    "created_at": "2024-01-01T00:00:00Z",
    "updated_at": "2024-01-01T00:00:00Z"
  },
  "team": {
    "id": "team_456",
    "name": "John's Team",
    "created_at": "2024-01-01T00:00:00Z"
  },
  "expires_in": 86400
}

{
  "error": "unauthorized",
  "message": "Invalid email or password",
  "code": "INVALID_CREDENTIALS"
}

{
  "error": "unauthorized",
  "message": "Account is locked due to too many failed attempts",
  "code": "ACCOUNT_LOCKED"
}

{
  "error": "validation_error",
  "message": "Email and password are required",
  "code": "VALIDATION_ERROR"
}

const response = await fetch('https://api.xem.email/api/v1/campaigns', {
  headers: {
    'Authorization': `Bearer ${data.access_token}`
  }
});

const refreshResponse = await fetch('https://api.xem.email/api/v1/auth/refresh', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    refresh_token: data.refresh_token
  })
});

async function login(email, password) {
  try {
    const response = await fetch('/auth/login', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email, password })
    });

    if (!response.ok) {
      const error = await response.json();
      
      switch (error.code) {
        case 'INVALID_CREDENTIALS':
          throw new Error('Invalid email or password');
        case 'ACCOUNT_LOCKED':
          throw new Error('Account is temporarily locked');
        default:
          throw new Error(error.message);
      }
    }

    return await response.json();
  } catch (error) {
    console.error('Login error:', error);
    throw error;
  }
}

// Store tokens securely (not in localStorage)
const secureStorage = {
  setTokens: (tokens) => {
    // Use secure HTTP-only cookies or encrypted storage
    document.cookie = `access_token=${tokens.access_token}; Secure; HttpOnly; SameSite=Strict`;
    document.cookie = `refresh_token=${tokens.refresh_token}; Secure; HttpOnly; SameSite=Strict`;
  },
  
  getTokens: () => {
    // Retrieve tokens from secure storage
    return {
      access_token: getCookie('access_token'),
      refresh_token: getCookie('refresh_token')
    };
  }
};

class TokenManager {
  constructor() {
    this.accessToken = null;
    this.refreshToken = null;
  }

  async refreshAccessToken() {
    const response = await fetch('/auth/refresh', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ refresh_token: this.refreshToken })
    });

    if (response.ok) {
      const data = await response.json();
      this.accessToken = data.access_token;
      return this.accessToken;
    } else {
      // Redirect to login
      window.location.href = '/login';
    }
  }

  async makeAuthenticatedRequest(url, options = {}) {
    if (!this.accessToken) {
      throw new Error('No access token available');
    }

    const response = await fetch(url, {
      ...options,
      headers: {
        ...options.headers,
        'Authorization': `Bearer ${this.accessToken}`
      }
    });

    if (response.status === 401) {
      // Token expired, try to refresh
      await this.refreshAccessToken();
      return this.makeAuthenticatedRequest(url, options);
    }

    return response;
  }
}

async function logout() {
  // Clear tokens from storage
  secureStorage.clearTokens();
  
  // Optionally call logout endpoint to invalidate tokens
  try {
    await fetch('/auth/logout', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${currentToken}`
      }
    });
  } catch (error) {
    console.error('Logout error:', error);
  }
  
  // Redirect to login page
  window.location.href = '/login';
}