chore: build

backend/internal/modules/auth/admin_handler.go

@@ -31,14 +31,14 @@ func NewAdminHandler(service *Service, cookieSecure bool) *AdminHandler {
 }
 
 type loginRequest struct {
-	Email    string `json:"email" binding:"required,email"`
+	Username string `json:"username" binding:"required"`
 	Password string `json:"password" binding:"required"`
 }
 
 type authUserResponse struct {
-	ID    uuid.UUID `json:"id"`
-	Email string    `json:"email"`
-	Role  string    `json:"role"`
+	ID       uuid.UUID `json:"id"`
+	Username string    `json:"username"`
+	Role     string    `json:"role"`
 }
 
 type accessTokenResponse struct {
@@ -53,7 +53,7 @@ func (h *AdminHandler) Login(c *gin.Context) {
 		return
 	}
 
-	pair, user, err := h.service.Login(c.Request.Context(), security.AudienceAdmin, users.RoleAdmin, req.Email, req.Password)
+	pair, user, err := h.service.Login(c.Request.Context(), security.AudienceAdmin, users.RoleAdmin, req.Username, req.Password)
 	if err != nil {
 		h.respondLoginError(c, err)
 		return
@@ -62,7 +62,7 @@ func (h *AdminHandler) Login(c *gin.Context) {
 	h.setRefreshCookie(c, pair.RefreshToken)
 	c.JSON(http.StatusOK, accessTokenResponse{
 		AccessToken: pair.AccessToken,
-		User:        &authUserResponse{ID: user.ID, Email: user.Email, Role: user.Role},
+		User:        &authUserResponse{ID: user.ID, Username: user.Username, Role: user.Role},
 	})
 }
 
@@ -107,7 +107,7 @@ func (h *AdminHandler) Me(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load user"})
 		return
 	}
-	c.JSON(http.StatusOK, authUserResponse{ID: user.ID, Email: user.Email, Role: user.Role})
+	c.JSON(http.StatusOK, authUserResponse{ID: user.ID, Username: user.Username, Role: user.Role})
 }
 
 func (h *AdminHandler) respondLoginError(c *gin.Context, err error) {

backend/internal/modules/auth/customer_handler.go

@@ -1,6 +1,7 @@
 package auth
 
 import (
+	"context"
 	"errors"
 	"net/http"
 
@@ -18,28 +19,123 @@ const (
 	customerRefreshCookiePath = "/api/auth/customer"
 )
 
+// UserCreator is the minimal slice of users.Service that customer
+// registration needs (create-only, consumer-defined per the project's Go
+// interface convention).
+type UserCreator interface {
+	Create(ctx context.Context, username, password, role string) (*users.User, error)
+}
+
+// AccountsGate reports whether the admin has turned on the customer login
+// page and the customer registration page. CustomerRegistrationEnabled is a
+// sub-toggle of CustomerLoginEnabled (site.Settings.CustomerLoginEnabled /
+// CustomerRegistrationEnabled): an admin can allow login for already-existing
+// accounts while keeping self-service registration closed, but turning login
+// off always closes registration too, since a newly registered account is
+// signed in immediately.
+type AccountsGate interface {
+	CustomerLoginEnabled(ctx context.Context) (bool, error)
+	CustomerRegistrationEnabled(ctx context.Context) (bool, error)
+}
+
 // CustomerHandler mirrors AdminHandler but issues/accepts only
-// customer-audience tokens. Not mounted by main.go in this phase (no
-// customer-facing module needs it yet) — it exists so the future
-// cart/orders module can activate customer auth without touching the admin
-// code path at all.
+// customer-audience tokens, and additionally gates on AccountsGate since
+// this space, unlike the admin one, can be turned off entirely by the
+// site's admin.
 type CustomerHandler struct {
 	service      *Service
+	users        UserCreator
+	gate         AccountsGate
 	cookieSecure bool
 }
 
-func NewCustomerHandler(service *Service, cookieSecure bool) *CustomerHandler {
-	return &CustomerHandler{service: service, cookieSecure: cookieSecure}
+func NewCustomerHandler(service *Service, users UserCreator, gate AccountsGate, cookieSecure bool) *CustomerHandler {
+	return &CustomerHandler{service: service, users: users, gate: gate, cookieSecure: cookieSecure}
+}
+
+func (h *CustomerHandler) loginEnabledOrAbort(c *gin.Context) bool {
+	enabled, err := h.gate.CustomerLoginEnabled(c.Request.Context())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to check customer login setting"})
+		return false
+	}
+	if !enabled {
+		c.JSON(http.StatusForbidden, gin.H{"error": "customer login is currently disabled"})
+		return false
+	}
+	return true
+}
+
+func (h *CustomerHandler) registrationEnabledOrAbort(c *gin.Context) bool {
+	enabled, err := h.gate.CustomerRegistrationEnabled(c.Request.Context())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to check customer registration setting"})
+		return false
+	}
+	if !enabled {
+		c.JSON(http.StatusForbidden, gin.H{"error": "customer registration is currently disabled"})
+		return false
+	}
+	return true
+}
+
+type registerRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required,min=8"`
+}
+
+func (h *CustomerHandler) Register(c *gin.Context) {
+	// Registration is a sub-toggle of login: creating an account is pointless
+	// (and issuePair below would hand out a session) if the admin has turned
+	// customer login off, so both gates must pass.
+	if !h.loginEnabledOrAbort(c) {
+		return
+	}
+	if !h.registrationEnabledOrAbort(c) {
+		return
+	}
+
+	var req registerRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "validation error", "details": err.Error()})
+		return
+	}
+
+	user, err := h.users.Create(c.Request.Context(), req.Username, req.Password, users.RoleCustomer)
+	if err != nil {
+		if errors.Is(err, users.ErrUsernameTaken) {
+			c.JSON(http.StatusConflict, gin.H{"error": "username already taken"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create account"})
+		return
+	}
+
+	pair, err := h.service.issuePair(c.Request.Context(), security.AudienceCustomer, user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "account created but failed to sign in"})
+		return
+	}
+
+	h.setRefreshCookie(c, pair.RefreshToken)
+	c.JSON(http.StatusCreated, accessTokenResponse{
+		AccessToken: pair.AccessToken,
+		User:        &authUserResponse{ID: user.ID, Username: user.Username, Role: user.Role},
+	})
 }
 
 func (h *CustomerHandler) Login(c *gin.Context) {
+	if !h.loginEnabledOrAbort(c) {
+		return
+	}
+
 	var req loginRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "validation error", "details": err.Error()})
 		return
 	}
 
-	pair, user, err := h.service.Login(c.Request.Context(), security.AudienceCustomer, users.RoleCustomer, req.Email, req.Password)
+	pair, user, err := h.service.Login(c.Request.Context(), security.AudienceCustomer, users.RoleCustomer, req.Username, req.Password)
 	if err != nil {
 		switch {
 		case errors.Is(err, ErrInvalidCredentials), errors.Is(err, ErrAccountDisabled):
@@ -53,7 +149,7 @@ func (h *CustomerHandler) Login(c *gin.Context) {
 	h.setRefreshCookie(c, pair.RefreshToken)
 	c.JSON(http.StatusOK, accessTokenResponse{
 		AccessToken: pair.AccessToken,
-		User:        &authUserResponse{ID: user.ID, Email: user.Email, Role: user.Role},
+		User:        &authUserResponse{ID: user.ID, Username: user.Username, Role: user.Role},
 	})
 }
 
@@ -98,7 +194,7 @@ func (h *CustomerHandler) Me(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load user"})
 		return
 	}
-	c.JSON(http.StatusOK, authUserResponse{ID: user.ID, Email: user.Email, Role: user.Role})
+	c.JSON(http.StatusOK, authUserResponse{ID: user.ID, Username: user.Username, Role: user.Role})
 }
 
 func (h *CustomerHandler) setRefreshCookie(c *gin.Context, token string) {

backend/internal/modules/auth/customer_routes.go

@@ -2,12 +2,14 @@ package auth
 
 import "github.com/gin-gonic/gin"
 
-// RegisterCustomerRoutes mounts the customer-space auth endpoints. Deliberately
-// NOT called from cmd/api/main.go in this phase: there is no customer-facing
-// module (cart/orders) yet, so exposing these routes today would just be a
-// dead surface. Wiring is ready for when that module is activated.
+// RegisterCustomerRoutes mounts the customer-space auth endpoints. Always
+// mounted (unlike earlier phases), but Register/Login reject every request
+// with 403 while the admin has customer accounts turned off
+// (CustomerHandler.accountsEnabledOrAbort), so the surface is a no-op until
+// then.
 func RegisterCustomerRoutes(rg *gin.RouterGroup, h *CustomerHandler, requireCustomer gin.HandlerFunc, loginRateLimit gin.HandlerFunc) {
 	group := rg.Group("/auth/customer")
+	group.POST("/register", loginRateLimit, h.Register)
 	group.POST("/login", loginRateLimit, h.Login)
 	group.POST("/refresh", h.Refresh)
 	group.POST("/logout", h.Logout)

backend/internal/modules/auth/service.go

@@ -16,7 +16,7 @@ import (
 // Defined here (consumer side) rather than depending on the full
 // users.Repository, so auth only ever reads user records, never writes them.
 type UserFinder interface {
-	FindByEmail(ctx context.Context, email string) (*users.User, error)
+	FindByUsername(ctx context.Context, username string) (*users.User, error)
 	FindByID(ctx context.Context, id uuid.UUID) (*users.User, error)
 }
 
@@ -43,8 +43,8 @@ func (s *Service) RefreshTTL() time.Duration { return s.refreshTTL }
 // Login authenticates a user for a specific space (aud) and enforces that
 // the account's role matches that space (an admin account cannot log into
 // the customer space and vice versa, even before the customer module ships).
-func (s *Service) Login(ctx context.Context, aud security.Audience, expectedRole, email, password string) (*TokenPair, *users.User, error) {
-	user, err := s.users.FindByEmail(ctx, email)
+func (s *Service) Login(ctx context.Context, aud security.Audience, expectedRole, username, password string) (*TokenPair, *users.User, error) {
+	user, err := s.users.FindByUsername(ctx, username)
 	if err != nil {
 		if errors.Is(err, users.ErrNotFound) {
 			return nil, nil, ErrInvalidCredentials