5b74e9d76a
input validation: email + password required. constructs EmailAddress vo (BadRequest on bad format). looks up user; absent or password-mismatch -> UnauthorizedException with constant 'invalid credentials' message (no enumeration leak). password verified through PasswordHasher->verify against stored hash on the User entity (no separate profile lookup -> tide keeps password on the user row). returns the User entity for the caller (typically CreateSession + AuthController). 27 tests pass. |
||
|---|---|---|
| .. | ||
| Auth | ||
| Exceptions | ||
| Providers | ||
| Shared/ValueObject | ||
| User | ||