feat(username|email): pass2: accept login via email orusername

- login via (username or email) + password
    - hurl test to cover the feature

tests/api/auth_login.hurl

@@ -0,0 +1,84 @@
+# =============================================================
+# OxiCloud — login dispatcher (PR 17)
+# =============================================================
+# After PR 17 the `username` field on /api/auth/login accepts BOTH
+# a username (no `@`) and an email address. The server dispatches
+# on `@`-in-input: with `@` → email lookup, without → username
+# lookup. The two namespaces are provably disjoint (PR 16 forbids
+# `@` in usernames), so this is unambiguous.
+# =============================================================
+
+
+# ─────────────────────────────────────────────────────────────
+# Case 1 — Login by username (the classic path).
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/login
+Content-Type: application/json
+{ "username": "{{username}}", "password": "{{password}}" }
+
+HTTP 200
+[Asserts]
+jsonpath "$.access_token" exists
+jsonpath "$.user.email" == "{{email}}"
+
+
+# ─────────────────────────────────────────────────────────────
+# Case 2 — Login by email (new path).
+#           The same DTO field, different lookup branch because
+#           the input contains `@`.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/login
+Content-Type: application/json
+{ "username": "{{email}}", "password": "{{password}}" }
+
+HTTP 200
+[Asserts]
+jsonpath "$.access_token" exists
+jsonpath "$.user.email" == "{{email}}"
+
+
+# ─────────────────────────────────────────────────────────────
+# Case 3 — Wrong password on the username path → uniform 403.
+#           Anti-enumeration: same error shape as unknown-user.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/login
+Content-Type: application/json
+{ "username": "{{username}}", "password": "definitely-wrong" }
+
+HTTP 403
+
+
+# ─────────────────────────────────────────────────────────────
+# Case 4 — Wrong password on the email path → uniform 403.
+#           Same as Case 3 but with the email path. The error
+#           shape is identical regardless of which branch fired.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/login
+Content-Type: application/json
+{ "username": "{{email}}", "password": "definitely-wrong" }
+
+HTTP 403
+
+
+# ─────────────────────────────────────────────────────────────
+# Case 5 — Unknown username → uniform 403, audit reason
+#           `unknown_user`. The visible response is identical
+#           to wrong-password (Case 3) so a probing attacker
+#           can't distinguish "user exists" from "user doesn't".
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/login
+Content-Type: application/json
+{ "username": "ghost-user-that-doesnt-exist", "password": "{{password}}" }
+
+HTTP 403
+
+
+# ─────────────────────────────────────────────────────────────
+# Case 6 — Unknown email → uniform 403, same anti-enumeration
+#           guarantee as Case 5 but exercising the email branch.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/auth/login
+Content-Type: application/json
+{ "username": "ghost@nowhere.invalid", "password": "{{password}}" }
+
+HTTP 403

tests/api/run.sh

@@ -90,6 +90,7 @@ log "Server is ready."
 log "Running Hurl tests..."
 hurl --variables-file "$API_DIR/test.env" --file-root "$REPO_ROOT/tests" --test --jobs 1 \
   "$API_DIR/setup.hurl" \
+  "$API_DIR/auth_login.hurl" \
   "$API_DIR/files-folders.hurl" \
   "$API_DIR/favorites.hurl" \
   "$API_DIR/trash.hurl" \