Add auth

API.md

@@ -3,7 +3,85 @@
 ## Base URL
 `http://localhost:8080`
 
-## Endpoints
+## Authentication
+The API uses JWT tokens for authentication. Include the token in the Authorization header:
+```
+Authorization: Bearer <your_token>
+```
+
+### Register
+Create a new user account.
+
+```bash
+POST /api/auth/register
+```
+
+Request Body:
+```json
+{
+  "email": string,     // Required: Valid email address
+  "password": string   // Required: Password
+}
+```
+
+Example:
+```bash
+curl -X POST http://localhost:8080/api/auth/register \
+  -H "Content-Type: application/json" \
+  -d '{
+    "email": "user@example.com",
+    "password": "your_password"
+  }'
+```
+
+Response (200 OK):
+```json
+{
+  "token": "eyJ0eXAiOiJKV1QiLCJhbGc...",
+  "user": {
+    "id": 1,
+    "email": "user@example.com"
+  }
+}
+```
+
+### Login
+Authenticate and receive a JWT token.
+
+```bash
+POST /api/auth/login
+```
+
+Request Body:
+```json
+{
+  "email": string,     // Required: Registered email address
+  "password": string   // Required: Password
+}
+```
+
+Example:
+```bash
+curl -X POST http://localhost:8080/api/auth/login \
+  -H "Content-Type: application/json" \
+  -d '{
+    "email": "user@example.com",
+    "password": "your_password"
+  }'
+```
+
+Response (200 OK):
+```json
+{
+  "token": "eyJ0eXAiOiJKV1QiLCJhbGc...",
+  "user": {
+    "id": 1,
+    "email": "user@example.com"
+  }
+}
+```
+
+## Protected Endpoints
 
 ### Health Check
 Check if the service and database are running.
@@ -28,7 +106,7 @@ Response (503 Service Unavailable):
 ```
 
 ### Create Short URL
-Create a new shortened URL with optional custom code.
+Create a new shortened URL with optional custom code. Requires authentication.
 
 ```bash
 POST /api/shorten
@@ -49,6 +127,7 @@ Examples:
 ```bash
 curl -X POST http://localhost:8080/api/shorten \
   -H "Content-Type: application/json" \
+  -H "Authorization: Bearer YOUR_TOKEN" \
   -d '{
     "url": "https://example.com",
     "source": "curl-test"
@@ -59,6 +138,7 @@ Response (201 Created):
 ```json
 {
   "id": 1,
+  "user_id": 1,
   "original_url": "https://example.com",
   "short_code": "Xa7Bc9",
   "created_at": "2024-03-01T12:34:56Z",
@@ -70,6 +150,7 @@ Response (201 Created):
 ```bash
 curl -X POST http://localhost:8080/api/shorten \
   -H "Content-Type: application/json" \
+  -H "Authorization: Bearer YOUR_TOKEN" \
   -d '{
     "url": "https://example.com",
     "custom_code": "example",
@@ -81,6 +162,7 @@ Response (201 Created):
 ```json
 {
   "id": 2,
+  "user_id": 1,
   "original_url": "https://example.com",
   "short_code": "example",
   "created_at": "2024-03-01T12:34:56Z",
@@ -111,8 +193,15 @@ Invalid custom code (400 Bad Request):
 }
 ```
 
+Unauthorized (401 Unauthorized):
+```json
+{
+  "error": "Unauthorized"
+}
+```
+
 ### Get All Links
-Retrieve all shortened URLs.
+Retrieve all shortened URLs for the authenticated user.
 
 ```bash
 GET /api/links
@@ -120,7 +209,7 @@ GET /api/links
 
 Example:
 ```bash
-curl http://localhost:8080/api/links
+curl -H "Authorization: Bearer YOUR_TOKEN" http://localhost:8080/api/links
 ```
 
 Response (200 OK):
@@ -128,6 +217,7 @@ Response (200 OK):
 [
   {
     "id": 1,
+    "user_id": 1,
     "original_url": "https://example.com",
     "short_code": "Xa7Bc9",
     "created_at": "2024-03-01T12:34:56Z",
@@ -135,6 +225,7 @@ Response (200 OK):
   },
   {
     "id": 2,
+    "user_id": 1,
     "original_url": "https://example.org",
     "short_code": "example",
     "created_at": "2024-03-01T12:35:00Z",
@@ -144,15 +235,15 @@ Response (200 OK):
 ```
 
 ### Redirect to Original URL
-Use the shortened URL to redirect to the original URL.
+Use the shortened URL to redirect to the original URL. Source tracking via query parameter is supported.
 
 ```bash
-GET /{short_code}
+GET /{short_code}?source={source}
 ```
 
 Example:
 ```bash
-curl -i http://localhost:8080/example
+curl -i http://localhost:8080/example?source=email
 ```
 
 Response (307 Temporary Redirect):
@@ -169,48 +260,62 @@ Error Response (404 Not Found):
 ```
 
 ## Custom Code Rules
-
 1. Length: 1-32 characters
 2. Allowed characters: letters, numbers, underscores, and hyphens
 3. Case-sensitive
 4. Cannot use reserved words: ["api", "health", "admin", "static", "assets"]
 
 ## Rate Limiting
-
 Currently, no rate limiting is implemented.
 
 ## Notes
-
 1. All timestamps are in UTC
 2. Click counts are incremented on successful redirects
-3. Source tracking is optional but recommended for analytics
+3. Source tracking is supported both at link creation and during redirection via query parameter
 4. Custom codes are case-sensitive
 5. URLs must include protocol (http:// or https://)
+6. All create/read operations require authentication
+7. Users can only see and manage their own links
 
 ## Error Codes
-
 - 200: Success
 - 201: Created
 - 307: Temporary Redirect
 - 400: Bad Request (invalid input)
+- 401: Unauthorized (missing or invalid token)
 - 404: Not Found
 - 503: Service Unavailable
 
 ## Database Schema
-
 ```sql
+-- Users table for authentication
+CREATE TABLE users (
+    id SERIAL PRIMARY KEY,
+    email VARCHAR(255) NOT NULL UNIQUE,
+    password_hash TEXT NOT NULL
+);
+
+-- Links table with user association
 CREATE TABLE links (
     id SERIAL PRIMARY KEY,
     original_url TEXT NOT NULL,
     short_code VARCHAR(8) NOT NULL UNIQUE,
     created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-    clicks BIGINT NOT NULL DEFAULT 0
+    clicks BIGINT NOT NULL DEFAULT 0,
+    user_id INTEGER REFERENCES users(id)
 );
 
+-- Click tracking with source information
 CREATE TABLE clicks (
     id SERIAL PRIMARY KEY,
     link_id INTEGER REFERENCES links(id),
     source TEXT,
+    query_source TEXT,
     created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
+
+-- Indexes
+CREATE INDEX idx_short_code ON links(short_code);
+CREATE INDEX idx_user_id ON links(user_id);
+CREATE INDEX idx_link_id ON clicks(link_id);
 ```