Login Endpoint

The login endpoint checks the email and password with the same AuthenticationManager that form login uses. Spring Boot builds it from your UserDetailsService and PasswordEncoder beans (see the basic level); we only need to expose it as a bean.

@Bean
AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
    return config.getAuthenticationManager();
}

@Bean
PasswordEncoder passwordEncoder() {
    return PasswordEncoderFactories.createDelegatingPasswordEncoder(); // bcrypt by default
}

package in.shopease.auth;

public record LoginRequest(@NotBlank @Email String email, @NotBlank String password) {}

public record UserSummary(String email, List<String> roles) {}

public record LoginResponse(String accessToken, String tokenType, long expiresIn, UserSummary user) {}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final AuthenticationManager authenticationManager;
    private final JwtService jwtService;

    public AuthController(AuthenticationManager authenticationManager, JwtService jwtService) {
        this.authenticationManager = authenticationManager;
        this.jwtService = jwtService;
    }

    @PostMapping("/login")
    public LoginResponse login(@Valid @RequestBody LoginRequest req) {
        // throws BadCredentialsException (-> 401) if the password is wrong
        Authentication auth = authenticationManager.authenticate(
                UsernamePasswordAuthenticationToken.unauthenticated(req.email(), req.password()));

        UserDetails user = (UserDetails) auth.getPrincipal();
        List<String> roles = user.getAuthorities().stream().map(GrantedAuthority::getAuthority).toList();
        return new LoginResponse(jwtService.generateAccessToken(user), "Bearer",
                jwtService.accessTtlSeconds(), new UserSummary(user.getUsername(), roles));
    }
}