Class AuthController
- Namespace
- Builvero.Api.Controllers
- Assembly
- Builvero.Api.dll
Provides authentication API endpoints for user signup, login, and OAuth authentication.
[ApiController]
[Route("api/auth")]
public class AuthController : ControllerBase- Inheritance
-
AuthController
- Inherited Members
Remarks
This controller handles all authentication flows:
- Email/password signup with invitation code validation
- Email/password login with credential verification
- OAuth authentication (Google, LinkedIn) with callback handling
Most endpoints are marked with [AllowAnonymous] to permit unauthenticated access.
OAuth endpoints redirect to external providers and handle callbacks.
Constructors
AuthController(IAuthService, IConfiguration)
Initializes a new instance of the AuthController class.
public AuthController(IAuthService authService, IConfiguration configuration)Parameters
authServiceIAuthServiceService for authentication operations.
configurationIConfigurationApplication configuration for accessing settings.
Methods
Login(LoginRequest, CancellationToken)
Authenticates a user with email and password credentials.
[AllowAnonymous]
[HttpPost("login")]
public Task<ActionResult<AuthResponse>> Login(LoginRequest request, CancellationToken cancellationToken)Parameters
requestLoginRequestThe login request containing email and password.
cancellationTokenCancellationTokenCancellation token to cancel the operation.
Returns
- Task<ActionResult<AuthResponse>>
200 OK: Returns AuthResponse with JWT token and user information
401 Unauthorized: Invalid credentials or account disabled
Remarks
This endpoint is publicly accessible (no authentication required). Blocked or disabled accounts cannot log in. The response includes a flag indicating whether profile completion is required.
OAuthCallback(string, string?)
Handles the OAuth callback from external providers after user authentication.
[AllowAnonymous]
[HttpGet("oauth/{provider}/callback")]
public Task<IActionResult> OAuthCallback(string provider, string? invite = null)Parameters
providerstringThe OAuth provider name (e.g., "google", "linkedin").
invitestringOptional invitation code that was passed during OAuth initiation.
Returns
- Task<IActionResult>
302 Redirect: Redirects to frontend with authentication token in query string or error message
400 Bad Request: OAuth authentication failed, missing claims, or unsupported provider
Remarks
This endpoint is publicly accessible. It processes the OAuth callback by:
- Extracting user information from OAuth provider claims (email, name, photo, provider user ID)
- Mapping provider string to OAuthProvider enum
- Calling HandleOAuthCallbackAsync(OAuthProvider, string, string, string?, string?, string?, CancellationToken) to authenticate or create user
- Redirecting to frontend with token or error
On success, redirects to: {frontendBaseUrl}/auth/oauth-callback.html?token={jwtToken}
On error, redirects to: {frontendBaseUrl}/auth/signin.html?error={errorMessage}
OAuthLogin(string, string?)
Initiates OAuth authentication flow by redirecting to the external provider's login page.
[AllowAnonymous]
[HttpGet("oauth/{provider}")]
public IActionResult OAuthLogin(string provider, string? invite = null)Parameters
providerstringThe OAuth provider name (e.g., "google", "linkedin").
invitestringOptional invitation code to include in the OAuth callback URL.
Returns
- IActionResult
A challenge result that redirects the user to the OAuth provider's authentication page.
Remarks
This endpoint is publicly accessible. After authentication, the provider redirects to
/api/auth/oauth/{provider}/callback with the invitation code (if provided) as a query parameter.
Supported providers: Google, LinkedIn.
Signup(SignupRequest, CancellationToken)
Registers a new user account with email and password.
[AllowAnonymous]
[HttpPost("signup/email")]
public Task<ActionResult<AuthResponse>> Signup(SignupRequest request, CancellationToken cancellationToken)Parameters
requestSignupRequestThe signup request containing email, password, password confirmation, and invitation code.
cancellationTokenCancellationTokenCancellation token to cancel the operation.
Returns
- Task<ActionResult<AuthResponse>>
200 OK: Returns AuthResponse with JWT token and user information
400 Bad Request: Invalid request data, invitation code issues, or email already registered
Remarks
This endpoint is publicly accessible (no authentication required). Requires a valid invitation code. The response includes a flag indicating whether profile completion is required.
VerifyEmail(VerifyEmailRequest, CancellationToken)
Verifies a user's email using a verification code.
[AllowAnonymous]
[HttpPost("verify-email")]
public Task<ActionResult<AuthResponse>> VerifyEmail(VerifyEmailRequest request, CancellationToken cancellationToken)Parameters
requestVerifyEmailRequestThe verification request containing email and code.
cancellationTokenCancellationTokenCancellation token to cancel the operation.
Returns
- Task<ActionResult<AuthResponse>>
200 OK with an AuthResponse when verification succeeds.