Auth — реализация

Endpoints

Method	Path	Статус
POST	/api/v1/auth/guest	✅
POST	/api/v1/auth/register	✅
POST	/api/v1/auth/login	✅
POST	/api/v1/auth/refresh	✅
POST	/api/v1/auth/telegram	✅
GET	/api/v1/auth/me	✅

Механизмы

• Guest token: JWT HS256, TTL 24h, Authorization: Guest <token>
• JWT access: 15 минут, Authorization: Bearer <token>
• Refresh token: SHA256 hash в БД, TTL 7 дней
• Telegram Login: HMAC-SHA256 verify по auth-flows.md
• Password: bcrypt

Файлы

• services/api/app/modules/auth/service.py
• services/api/app/modules/auth/router.py
• services/api/app/db/models.py — users, refresh_tokens

Rate limiting

slowapi на уровне приложения (Phase 3): auth 10/min, actions 30/min.