Agent-Fusion

```/backend/src/routes/auth.js
// POST /api/v1/auth/login - Authenticates user credentials
async function login(req, res) {
  const { email, password } = req.body;
  const user = await User.findOne({ email });
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
  const isValid = await bcrypt.compare(password, user.password);
  if (!isValid) return res.status(401).json({ error: 'Invalid credentials' });
  const token = jwt.sign({ userId: user._id }, process.env.JWT_SECRET);
  res.json({ token });
}

// POST /api/v1/auth/refresh - Refreshes JWT token
async function refreshToken(req, res) {
  const { token } = req.body;
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    const newToken = jwt.sign({ userId: decoded.userId }, process.env.JWT_SECRET);
    res.json({ token: newToken });
  } catch (err) {
    res.status(401).json({ error: 'Invalid token' });
  }
}
```

```/backend/docs/authentication.md
# Authentication Flow
The system uses JWT tokens for stateless authentication. Tokens expire after 1 hour and can be refreshed via `/api/v1/auth/refresh`.

## Security Considerations
- Always use HTTPS in production
- Store JWT_SECRET in environment variables
- Rate limit `/api/v1/auth/login` to prevent brute force attacks
```

```/backend/config/auth.config.js
module.exports = {
  jwt: {
    secret: process.env.JWT_SECRET || 'default-secret-change-in-production',
    expiresIn: '1h',
    refreshExpiresIn: '7d'
  }
};
```