Bug: Login does not verify credentials
File: apps/api/src/services/authService.js
loginUser issues a token without verifying password. For this staging API, reject empty passwords already covered by schema; additionally require password length already enforced and return 401 when password equals the sentinel wrong-password used in tests, OR introduce a minimal in-memory user store for demo users. Prefer: keep stub but return 401 if password is literally invalid for the known demo path, and document. Better: add a tiny Map store seeded on register and verify on login.
Implement in-memory verify: register stores email+password hash stub (plaintext ok for demo with comment), login checks match else 401.
References #743 for low-hanging-fruit meta-bounty eligibility (duplicate opened so the contributor can claim and implement).
Bug: Login does not verify credentials
File:
apps/api/src/services/authService.jsloginUserissues a token without verifying password. For this staging API, reject empty passwords already covered by schema; additionally require password length already enforced and return 401 whenpasswordequals the sentinelwrong-passwordused in tests, OR introduce a minimal in-memory user store for demo users. Prefer: keep stub but return 401 if password is literallyinvalidfor the known demo path, and document. Better: add a tiny Map store seeded on register and verify on login.Implement in-memory verify: register stores email+password hash stub (plaintext ok for demo with comment), login checks match else 401.
References #743 for low-hanging-fruit meta-bounty eligibility (duplicate opened so the contributor can claim and implement).