feat: add token authentication endpoints

[LuigimonSoft]

Summary

• add token generation and protected endpoints using secure random tokens
• document how to obtain and use the token via Swagger
• cover repository, service and controller layers with tests

Testing

• cargo test

---

https://chatgpt.com/codex/tasks/task_e_68a938d755d48320a5ccab7b6fa69d25

[Copilot]

Pull Request Overview

This pull request adds token-based authentication to the Rust backend with secure random token generation and protected endpoints using SHA-256 hashing and Bearer token validation.

• Implements a complete authentication layer with token generation, validation, and protected endpoints
• Adds comprehensive test coverage across repository, service, and controller layers
• Updates Swagger documentation to include authentication endpoints and security schemes

Reviewed Changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/controllers/auth_controller.rs	New authentication controller with token generation and protected endpoint handlers
src/services/auth_service.rs	Authentication service implementing secure token generation and validation logic
src/repositories/token_repository.rs	In-memory token storage with expiration handling
src/models/token_model.rs	Token response model for API serialization
src/controllers/mod.rs	Routing setup for authentication endpoints with authorization middleware
src/swagger.rs	Updated OpenAPI documentation with security schemes and authentication paths
src/test/*.rs	Comprehensive test coverage for all authentication components
Cargo.toml	Added dependencies for cryptographic operations and date handling

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The is_valid method modifies the token store by removing expired tokens during a read operation. This could cause issues if multiple threads call this method simultaneously, as one thread might remove tokens that another thread is trying to validate. Consider separating the cleanup logic into a dedicated method or using a more thread-safe approach.

Suggested change

	let mut tokens = self.tokens.lock().unwrap();
	let now = Utc::now();
	tokens.retain(|t| t.expires_at > now);
	tokens.iter().any(|t| t.hashed == hashed_token)
	let tokens = self.tokens.lock().unwrap();
	let now = Utc::now();
	tokens.iter().any(|t| t.hashed == hashed_token && t.expires_at > now)

[Copilot]

Pull Request Overview

This PR adds token-based authentication to the Rust backend application, introducing secure endpoints for token generation and protected resource access using Bearer tokens.

• Implements a complete authentication flow with token generation and validation
• Adds protected endpoints that require valid Bearer tokens
• Updates Swagger documentation to include authentication schema and new endpoints

Reviewed Changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/controllers/auth_controller.rs	New controller handling token generation with user/client credentials
src/controllers/protected_controller.rs	New controller for protected endpoints requiring authentication
src/controllers/mod.rs	Updated routing to include auth and protected routes with authorization middleware
src/services/auth_service.rs	Authentication service implementing token generation and validation logic
src/repositories/token_repository.rs	In-memory token storage with expiration handling
src/repositories/credentials_repository.rs	Credential validation for hardcoded users and clients
src/models/auth_request.rs	Data models for authentication requests
src/models/token_model.rs	Response model for token generation
src/swagger.rs	Updated OpenAPI spec with security schemes and new endpoints
src/test/*	Comprehensive test coverage for all authentication components

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Hardcoded credentials in source code pose a security risk. Consider using environment variables or a secure configuration system for default credentials.

Suggested change

	users.insert("admin".to_string(), "password".to_string());
	let mut clients = HashMap::new();
	clients.insert("client".to_string(), "secret".to_string());
	// Load admin credentials from environment variables
	if let (Ok(admin_username), Ok(admin_password)) = (
	env::var("ADMIN_USERNAME"),
	env::var("ADMIN_PASSWORD"),
	) {
	users.insert(admin_username, admin_password);
	}
	let mut clients = HashMap::new();
	// Load client credentials from environment variables
	if let (Ok(client_id), Ok(client_secret)) = (
	env::var("CLIENT_ID"),
	env::var("CLIENT_SECRET"),
	) {
	clients.insert(client_id, client_secret);
	}