add backend auth

backend/cmd/server/main.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/joho/godotenv"
+	"github.com/vaultdrop/backend/internal/auth"
 	"github.com/vaultdrop/backend/internal/config"
 	"github.com/vaultdrop/backend/internal/db"
 	"github.com/vaultdrop/backend/internal/handler"
@@ -32,14 +33,18 @@ func main() {
 	fileSvc := service.NewFileService(queries, cfg)
 	ocrSvc := service.NewOCRService(cfg, fileSvc)
 	urlSvc := service.NewURLService(cfg.HMACSecret, cfg.ServerHost)
+	authSvc, err := auth.NewAuthService(queries, cfg)
+	if err != nil {
+		log.Fatalf("Failed to create auth service: %v", err)
+	}
 
 	ocrSvc.Start()
 	defer ocrSvc.Stop()
 
-	h := handler.New(fileSvc, ocrSvc, urlSvc)
+	h := handler.New(fileSvc, ocrSvc, urlSvc, auth.NewAuthHandler(authSvc))
 
 	r := gin.Default()
-	handler.SetupRoutes(r, h)
+	handler.SetupRoutes(r, h, authSvc)
 
 	log.Printf("Server starting on port %s", cfg.Port)
 	if err := r.Run(":" + cfg.Port); err != nil {

backend/go.mod

@@ -3,14 +3,18 @@ module github.com/vaultdrop/backend
 go 1.26.4
 
 require (
+	aidanwoods.dev/go-paseto v1.6.0
 	github.com/gin-gonic/gin v1.12.0
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/google/uuid v1.6.0
+	github.com/joho/godotenv v1.5.1
 	github.com/ledongthuc/pdf v0.0.0-20250511090121-5959a4027728
 	github.com/lib/pq v1.12.3
+	golang.org/x/crypto v0.52.0
 )
 
 require (
+	aidanwoods.dev/go-result v0.3.1 // indirect
 	github.com/bytedance/gopkg v0.1.3 // indirect
 	github.com/bytedance/sonic v1.15.0 // indirect
 	github.com/bytedance/sonic/loader v0.5.0 // indirect
@@ -22,7 +26,6 @@ require (
 	github.com/go-playground/validator/v10 v10.30.1 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
-	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
@@ -36,7 +39,6 @@ require (
 	github.com/ugorji/go/codec v1.3.1 // indirect
 	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
 	golang.org/x/arch v0.22.0 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/net v0.54.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect

backend/go.sum

@@ -1,3 +1,7 @@
+aidanwoods.dev/go-paseto v1.6.0 h1:JA/PFk5lVsB/PakQGqnfmik/1tIHjE6F0UoPPoAO/nU=
+aidanwoods.dev/go-paseto v1.6.0/go.mod h1:LdqkL0Z2mLL0kBWzmHVR1cGFniX+zyOweQmbNKYrDxQ=
+aidanwoods.dev/go-result v0.3.1 h1:ee98hpohYUVYbI+pa6gUHTyoRerIudgjky/IPSowDXQ=
+aidanwoods.dev/go-result v0.3.1/go.mod h1:GKnFg8p/BKulVD3wsfULiPhpPmrTWyiTIbz8EWuUqSk=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=

backend/internal/auth/handler.go

@@ -0,0 +1,135 @@
+package auth
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/vaultdrop/backend/pkg/api"
+)
+
+type AuthHandler struct {
+	auth *AuthService
+}
+
+func NewAuthHandler(auth *AuthService) *AuthHandler {
+	return &AuthHandler{auth: auth}
+}
+
+type registerRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+type loginRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+type refreshRequest struct {
+	RefreshToken string `json:"refresh_token" binding:"required"`
+}
+
+type logoutRequest struct {
+	RefreshToken string `json:"refresh_token" binding:"required"`
+}
+
+type authResponse struct {
+	User         UserResponse `json:"user"`
+	AccessToken  string       `json:"access_token"`
+	RefreshToken string       `json:"refresh_token"`
+}
+
+type tokenResponse struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+}
+
+func (h *AuthHandler) Register(c *gin.Context) {
+	var req registerRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "username and password are required")
+		return
+	}
+
+	tokens, user, err := h.auth.Register(c.Request.Context(), req.Username, req.Password)
+	if err != nil {
+		switch {
+		case errors.Is(err, ErrUsernameTaken):
+			api.Error(c, http.StatusConflict, "USERNAME_TAKEN", "username already taken")
+		default:
+			api.Error(c, http.StatusBadRequest, "VALIDATION_ERROR", err.Error())
+		}
+		return
+	}
+
+	c.JSON(http.StatusCreated, authResponse{
+		User:         *user,
+		AccessToken:  tokens.AccessToken,
+		RefreshToken: tokens.RefreshToken,
+	})
+}
+
+func (h *AuthHandler) Login(c *gin.Context) {
+	var req loginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "username and password are required")
+		return
+	}
+
+	tokens, user, err := h.auth.Login(c.Request.Context(), req.Username, req.Password)
+	if err != nil {
+		switch {
+		case errors.Is(err, ErrInvalidCredentials):
+			api.Error(c, http.StatusUnauthorized, "INVALID_CREDENTIALS", "invalid username or password")
+		default:
+			api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
+		}
+		return
+	}
+
+	c.JSON(http.StatusOK, authResponse{
+		User:         *user,
+		AccessToken:  tokens.AccessToken,
+		RefreshToken: tokens.RefreshToken,
+	})
+}
+
+func (h *AuthHandler) Refresh(c *gin.Context) {
+	var req refreshRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "refresh_token is required")
+		return
+	}
+
+	tokens, err := h.auth.Refresh(c.Request.Context(), req.RefreshToken)
+	if err != nil {
+		switch {
+		case errors.Is(err, ErrInvalidToken):
+			api.Error(c, http.StatusUnauthorized, "INVALID_TOKEN", "invalid or expired refresh token")
+		default:
+			api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
+		}
+		return
+	}
+
+	c.JSON(http.StatusOK, tokenResponse{
+		AccessToken:  tokens.AccessToken,
+		RefreshToken: tokens.RefreshToken,
+	})
+}
+
+func (h *AuthHandler) Logout(c *gin.Context) {
+	var req logoutRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "refresh_token is required")
+		return
+	}
+
+	if err := h.auth.Logout(c.Request.Context(), req.RefreshToken); err != nil {
+		api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
+}

backend/internal/auth/middleware.go

@@ -0,0 +1,41 @@
+package auth
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+const UserIDKey = "userID"
+
+func (s *AuthService) RequireAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		header := c.GetHeader("Authorization")
+		if header == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{"code": "MISSING_TOKEN", "message": "authorization header required"},
+			})
+			return
+		}
+
+		parts := strings.SplitN(header, " ", 2)
+		if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{"code": "INVALID_TOKEN", "message": "invalid authorization format"},
+			})
+			return
+		}
+
+		claims, err := s.ValidateAccessToken(parts[1])
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{"code": "INVALID_TOKEN", "message": "invalid or expired token"},
+			})
+			return
+		}
+
+		c.Set(UserIDKey, claims)
+		c.Next()
+	}
+}

backend/internal/auth/service.go

@@ -0,0 +1,250 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"aidanwoods.dev/go-paseto"
+	"github.com/vaultdrop/backend/internal/config"
+	"github.com/vaultdrop/backend/internal/db"
+	"golang.org/x/crypto/argon2"
+)
+
+var (
+	ErrInvalidCredentials = errors.New("invalid credentials")
+	ErrUsernameTaken      = errors.New("username already taken")
+	ErrInvalidToken       = errors.New("invalid or expired token")
+)
+
+const (
+	accessTokenTTL  = 30 * time.Minute
+	refreshTokenTTL = 7 * 24 * time.Hour
+	saltLength       = 16
+)
+
+type AuthService struct {
+	queries *db.Queries
+	key     paseto.V4SymmetricKey
+	parser  *paseto.Parser
+}
+
+type TokenPair struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+}
+
+type UserResponse struct {
+	ID       string `json:"id"`
+	Username string `json:"username"`
+}
+
+func NewAuthService(queries *db.Queries, cfg *config.Config) (*AuthService, error) {
+	key, err := paseto.V4SymmetricKeyFromHex(cfg.PASETOKey)
+	if err != nil {
+		return nil, fmt.Errorf("invalid paseto key: %w", err)
+	}
+
+	parser := paseto.NewParser()
+	parser.AddRule(paseto.NotExpired())
+
+	return &AuthService{
+		queries: queries,
+		key:     key,
+		parser:  &parser,
+	}, nil
+}
+
+func (s *AuthService) Register(ctx context.Context, username, password string) (*TokenPair, *UserResponse, error) {
+	username = strings.TrimSpace(username)
+	if len(username) < 3 || len(username) > 30 {
+		return nil, nil, fmt.Errorf("username must be 3-30 characters")
+	}
+	if len(password) < 8 {
+		return nil, nil, fmt.Errorf("password must be at least 8 characters")
+	}
+
+	existing, err := s.queries.GetUserByUsername(ctx, username)
+	if err == nil && existing.ID != "" {
+		return nil, nil, ErrUsernameTaken
+	}
+
+	hash, err := hashPassword(password)
+	if err != nil {
+		return nil, nil, fmt.Errorf("hash password: %w", err)
+	}
+
+	user, err := s.queries.CreateUser(ctx, db.CreateUserParams{
+		Username:     username,
+		PasswordHash: hash,
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("create user: %w", err)
+	}
+
+	tokens, err := s.generateTokens(ctx, user.ID)
+	if err != nil {
+		return nil, nil, fmt.Errorf("generate tokens: %w", err)
+	}
+
+	return tokens, &UserResponse{ID: user.ID, Username: user.Username}, nil
+}
+
+func (s *AuthService) Login(ctx context.Context, username, password string) (*TokenPair, *UserResponse, error) {
+	user, err := s.queries.GetUserByUsername(ctx, strings.TrimSpace(username))
+	if err != nil {
+		return nil, nil, ErrInvalidCredentials
+	}
+
+	if !verifyPassword(password, user.PasswordHash) {
+		return nil, nil, ErrInvalidCredentials
+	}
+
+	tokens, err := s.generateTokens(ctx, user.ID)
+	if err != nil {
+		return nil, nil, fmt.Errorf("generate tokens: %w", err)
+	}
+
+	return tokens, &UserResponse{ID: user.ID, Username: user.Username}, nil
+}
+
+func (s *AuthService) Refresh(ctx context.Context, refreshToken string) (*TokenPair, error) {
+	userID, err := s.validateRefreshToken(refreshToken)
+	if err != nil {
+		return nil, ErrInvalidToken
+	}
+
+	tokenHash := hashToken(refreshToken)
+	stored, err := s.queries.GetRefreshToken(ctx, tokenHash)
+	if err != nil {
+		return nil, ErrInvalidToken
+	}
+
+	if stored.UserID != userID {
+		return nil, ErrInvalidToken
+	}
+
+	if err := s.queries.RevokeRefreshToken(ctx, tokenHash); err != nil {
+		return nil, fmt.Errorf("revoke refresh token: %w", err)
+	}
+
+	tokens, err := s.generateTokens(ctx, userID)
+	if err != nil {
+		return nil, fmt.Errorf("generate tokens: %w", err)
+	}
+
+	return tokens, nil
+}
+
+func (s *AuthService) Logout(ctx context.Context, refreshToken string) error {
+	tokenHash := hashToken(refreshToken)
+	return s.queries.RevokeRefreshToken(ctx, tokenHash)
+}
+
+func (s *AuthService) ValidateAccessToken(token string) (string, error) {
+	parsed, err := s.parser.ParseV4Local(s.key, token, nil)
+	if err != nil {
+		return "", ErrInvalidToken
+	}
+
+	userID, err := parsed.GetString("user_id")
+	if err != nil || userID == "" {
+		return "", ErrInvalidToken
+	}
+
+	return userID, nil
+}
+
+func (s *AuthService) generateTokens(ctx context.Context, userID string) (*TokenPair, error) {
+	accessToken, err := s.createAccessToken(userID)
+	if err != nil {
+		return nil, err
+	}
+
+	refreshToken, err := s.createRefreshToken(userID)
+	if err != nil {
+		return nil, err
+	}
+
+	refreshHash := hashToken(refreshToken)
+	_, err = s.queries.CreateRefreshToken(ctx, db.CreateRefreshTokenParams{
+		UserID:    userID,
+		TokenHash: refreshHash,
+		ExpiresAt: time.Now().Add(refreshTokenTTL),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("store refresh token: %w", err)
+	}
+
+	return &TokenPair{
+		AccessToken:  accessToken,
+		RefreshToken: refreshToken,
+	}, nil
+}
+
+func (s *AuthService) createAccessToken(userID string) (string, error) {
+	token := paseto.NewToken()
+	token.Set("user_id", userID)
+	token.SetExpiration(time.Now().Add(accessTokenTTL))
+	return token.V4Encrypt(s.key, nil), nil
+}
+
+func (s *AuthService) createRefreshToken(userID string) (string, error) {
+	token := paseto.NewToken()
+	token.Set("user_id", userID)
+	token.SetExpiration(time.Now().Add(refreshTokenTTL))
+	return token.V4Encrypt(s.key, nil), nil
+}
+
+func (s *AuthService) validateRefreshToken(token string) (string, error) {
+	parsed, err := s.parser.ParseV4Local(s.key, token, nil)
+	if err != nil {
+		return "", ErrInvalidToken
+	}
+
+	userID, err := parsed.GetString("user_id")
+	if err != nil || userID == "" {
+		return "", ErrInvalidToken
+	}
+
+	return userID, nil
+}
+
+func hashPassword(password string) (string, error) {
+	salt := make([]byte, saltLength)
+	if _, err := rand.Read(salt); err != nil {
+		return "", err
+	}
+	hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
+	return fmt.Sprintf("$argon2id$v=19$m=65536,t=1,p=4$%s$%s",
+		base64.RawStdEncoding.EncodeToString(salt),
+		base64.RawStdEncoding.EncodeToString(hash),
+	), nil
+}
+
+func verifyPassword(password, encodedHash string) bool {
+	parts := strings.Split(encodedHash, "$")
+	if len(parts) != 6 {
+		return false
+	}
+	salt, err := base64.RawStdEncoding.DecodeString(parts[4])
+	if err != nil {
+		return false
+	}
+	expectedHash, err := base64.RawStdEncoding.DecodeString(parts[5])
+	if err != nil {
+		return false
+	}
+	hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
+	return sha256.Sum256(hash) == sha256.Sum256(expectedHash)
+}
+
+func hashToken(token string) string {
+	h := sha256.Sum256([]byte(token))
+	return base64.RawURLEncoding.EncodeToString(h[:])
+}

backend/internal/config/config.go

@@ -9,6 +9,7 @@ type Config struct {
 	UploadDir   string
 	HMACSecret  string
 	ServerHost  string
+	PASETOKey   string
 }
 
 func Load() *Config {
@@ -19,6 +20,7 @@ func Load() *Config {
 		UploadDir:   envOr("UPLOAD_DIR", "./uploads"),
 		HMACSecret:  envOr("HMAC_SECRET", "thisismyrandomstring"),
 		ServerHost:  envOr("SERVER_HOST", "http://192.168.1.17:8080"),
+		PASETOKey:   envOr("PASETO_KEY", "01234567890123456789012345678901234567890123456789012345678901234"),
 	}
 }
 

backend/internal/db/auth.sql.go

@@ -0,0 +1,132 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: auth.sql
+
+package db
+
+import (
+	"context"
+	"time"
+)
+
+const createRefreshToken = `-- name: CreateRefreshToken :one
+INSERT INTO refresh_tokens (user_id, token_hash, expires_at)
+VALUES ($1, $2, $3)
+RETURNING id, user_id, token_hash, expires_at, revoked, created_at
+`
+
+type CreateRefreshTokenParams struct {
+	UserID    string    `json:"user_id"`
+	TokenHash string    `json:"token_hash"`
+	ExpiresAt time.Time `json:"expires_at"`
+}
+
+func (q *Queries) CreateRefreshToken(ctx context.Context, arg CreateRefreshTokenParams) (RefreshToken, error) {
+	row := q.db.QueryRowContext(ctx, createRefreshToken, arg.UserID, arg.TokenHash, arg.ExpiresAt)
+	var i RefreshToken
+	err := row.Scan(
+		&i.ID,
+		&i.UserID,
+		&i.TokenHash,
+		&i.ExpiresAt,
+		&i.Revoked,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const createUser = `-- name: CreateUser :one
+INSERT INTO users (username, password_hash)
+VALUES ($1, $2)
+RETURNING id, username, password_hash, created_at, updated_at
+`
+
+type CreateUserParams struct {
+	Username     string `json:"username"`
+	PasswordHash string `json:"password_hash"`
+}
+
+func (q *Queries) CreateUser(ctx context.Context, arg CreateUserParams) (User, error) {
+	row := q.db.QueryRowContext(ctx, createUser, arg.Username, arg.PasswordHash)
+	var i User
+	err := row.Scan(
+		&i.ID,
+		&i.Username,
+		&i.PasswordHash,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getRefreshToken = `-- name: GetRefreshToken :one
+SELECT id, user_id, token_hash, expires_at, revoked, created_at FROM refresh_tokens
+WHERE token_hash = $1 AND revoked = FALSE AND expires_at > NOW()
+`
+
+func (q *Queries) GetRefreshToken(ctx context.Context, tokenHash string) (RefreshToken, error) {
+	row := q.db.QueryRowContext(ctx, getRefreshToken, tokenHash)
+	var i RefreshToken
+	err := row.Scan(
+		&i.ID,
+		&i.UserID,
+		&i.TokenHash,
+		&i.ExpiresAt,
+		&i.Revoked,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const getUserByID = `-- name: GetUserByID :one
+SELECT id, username, password_hash, created_at, updated_at FROM users WHERE id = $1
+`
+
+func (q *Queries) GetUserByID(ctx context.Context, id string) (User, error) {
+	row := q.db.QueryRowContext(ctx, getUserByID, id)
+	var i User
+	err := row.Scan(
+		&i.ID,
+		&i.Username,
+		&i.PasswordHash,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getUserByUsername = `-- name: GetUserByUsername :one
+SELECT id, username, password_hash, created_at, updated_at FROM users WHERE username = $1
+`
+
+func (q *Queries) GetUserByUsername(ctx context.Context, username string) (User, error) {
+	row := q.db.QueryRowContext(ctx, getUserByUsername, username)
+	var i User
+	err := row.Scan(
+		&i.ID,
+		&i.Username,
+		&i.PasswordHash,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const revokeAllUserRefreshTokens = `-- name: RevokeAllUserRefreshTokens :exec
+UPDATE refresh_tokens SET revoked = TRUE WHERE user_id = $1
+`
+
+func (q *Queries) RevokeAllUserRefreshTokens(ctx context.Context, userID string) error {
+	_, err := q.db.ExecContext(ctx, revokeAllUserRefreshTokens, userID)
+	return err
+}
+
+const revokeRefreshToken = `-- name: RevokeRefreshToken :exec
+UPDATE refresh_tokens SET revoked = TRUE WHERE token_hash = $1
+`
+
+func (q *Queries) RevokeRefreshToken(ctx context.Context, tokenHash string) error {
+	_, err := q.db.ExecContext(ctx, revokeRefreshToken, tokenHash)
+	return err
+}

backend/internal/db/migrations/009_users_default.down.sql

@@ -0,0 +1,5 @@
+CREATE TABLE users (
+  id          TEXT NOT NULL DEFAULT gen_random_uuid(),
+  created_at  TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at  TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);

backend/internal/db/migrations/009_users_default.up.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS users;

backend/internal/db/migrations/010_auth.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE IF EXISTS refresh_tokens;
+DROP TABLE IF EXISTS users;

backend/internal/db/migrations/010_auth.up.sql

@@ -0,0 +1,19 @@
+CREATE TABLE users (
+  id            TEXT PRIMARY KEY DEFAULT gen_random_uuid(),
+  username      TEXT NOT NULL UNIQUE,
+  password_hash TEXT NOT NULL,
+  created_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE refresh_tokens (
+  id         TEXT NOT NULL DEFAULT gen_random_uuid(),
+  user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  revoked    BOOLEAN NOT NULL DEFAULT FALSE,
+  created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_refresh_tokens_user_id ON refresh_tokens(user_id);
+CREATE INDEX idx_refresh_tokens_token_hash ON refresh_tokens(token_hash);

backend/internal/db/models.go

@@ -29,6 +29,15 @@ type FileTag struct {
 	FileID sql.NullString `json:"file_id"`
 }
 
+type RefreshToken struct {
+	ID        string    `json:"id"`
+	UserID    string    `json:"user_id"`
+	TokenHash string    `json:"token_hash"`
+	ExpiresAt time.Time `json:"expires_at"`
+	Revoked   bool      `json:"revoked"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
 type Tag struct {
 	ID          string         `json:"id"`
 	ParentTagID sql.NullString `json:"parent_tag_id"`
@@ -37,3 +46,11 @@ type Tag struct {
 	CreatedAt   time.Time      `json:"created_at"`
 	UpdatedAt   time.Time      `json:"updated_at"`
 }
+
+type User struct {
+	ID           string    `json:"id"`
+	Username     string    `json:"username"`
+	PasswordHash string    `json:"password_hash"`
+	CreatedAt    time.Time `json:"created_at"`
+	UpdatedAt    time.Time `json:"updated_at"`
+}

backend/internal/db/queries/auth.sql

@@ -0,0 +1,25 @@
+-- name: CreateUser :one
+INSERT INTO users (username, password_hash)
+VALUES ($1, $2)
+RETURNING *;
+
+-- name: GetUserByUsername :one
+SELECT * FROM users WHERE username = $1;
+
+-- name: GetUserByID :one
+SELECT * FROM users WHERE id = $1;
+
+-- name: CreateRefreshToken :one
+INSERT INTO refresh_tokens (user_id, token_hash, expires_at)
+VALUES ($1, $2, $3)
+RETURNING *;
+
+-- name: GetRefreshToken :one
+SELECT * FROM refresh_tokens
+WHERE token_hash = $1 AND revoked = FALSE AND expires_at > NOW();
+
+-- name: RevokeRefreshToken :exec
+UPDATE refresh_tokens SET revoked = TRUE WHERE token_hash = $1;
+
+-- name: RevokeAllUserRefreshTokens :exec
+UPDATE refresh_tokens SET revoked = TRUE WHERE user_id = $1;

backend/internal/handler/handler.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"github.com/vaultdrop/backend/internal/auth"
 	"github.com/vaultdrop/backend/internal/service"
 )
 
@@ -8,12 +9,14 @@ type Handler struct {
 	File   *FileHandler
 	OCR    *OCRHandler
 	Health *HealthHandler
+	Auth   *auth.AuthHandler
 }
 
-func New(fileSvc *service.FileService, ocrSvc *service.OCRService, urlSvc *service.URLService) *Handler {
+func New(fileSvc *service.FileService, ocrSvc *service.OCRService, urlSvc *service.URLService, authHandler *auth.AuthHandler) *Handler {
 	return &Handler{
 		File:   &FileHandler{files: fileSvc, urls: urlSvc, ocr: ocrSvc},
 		OCR:    &OCRHandler{ocr: ocrSvc, files: fileSvc},
 		Health: &HealthHandler{ocr: ocrSvc},
+		Auth:   authHandler,
 	}
 }

backend/internal/handler/router.go

@@ -1,25 +1,37 @@
 package handler
 
-import "github.com/gin-gonic/gin"
+import (
+	"github.com/gin-gonic/gin"
+	"github.com/vaultdrop/backend/internal/auth"
+)
 
-func SetupRoutes(r *gin.Engine, h *Handler) {
+func SetupRoutes(r *gin.Engine, h *Handler, authMiddleware *auth.AuthService) {
 	api := r.Group("/api/v1")
 
+	// Public
 	api.GET("/health", h.Health.Check)
+	api.POST("/auth/register", h.Auth.Register)
+	api.POST("/auth/login", h.Auth.Login)
+	api.POST("/auth/refresh", h.Auth.Refresh)
+	api.POST("/auth/logout", h.Auth.Logout)
 
-	api.GET("/files", h.File.List)
+	// Protected
-	api.POST("/files/upload", h.File.Upload)
+	protected := api.Group("")
-	api.POST("/files/move", h.File.MoveFiles)
+	protected.Use(authMiddleware.RequireAuth())
-	api.POST("/files/folders", h.File.CreateFolder)
-	api.GET("/files/folders", h.File.ListFolders)
-	api.GET("/files/folders/:id/files", h.File.ListFilesByParent)
-	api.GET("/files/download/:id", h.File.Download)
-	api.DELETE("/files/:id", h.File.Delete)
-	api.GET("/files/:id", h.File.Get)
 
-	api.POST("/files/:id/tags", h.File.AddTags)
+	protected.GET("/files", h.File.List)
-	api.GET("/files/:id/tags", h.File.GetTags)
+	protected.POST("/files/upload", h.File.Upload)
+	protected.POST("/files/move", h.File.MoveFiles)
+	protected.POST("/files/folders", h.File.CreateFolder)
+	protected.GET("/files/folders", h.File.ListFolders)
+	protected.GET("/files/folders/:id/files", h.File.ListFilesByParent)
+	protected.GET("/files/download/:id", h.File.Download)
+	protected.DELETE("/files/:id", h.File.Delete)
+	protected.GET("/files/:id", h.File.Get)
 
-	api.POST("/ocr/jobs", h.OCR.CreateJob)
+	protected.POST("/files/:id/tags", h.File.AddTags)
-	api.GET("/ocr/jobs/:id", h.OCR.GetJobStatus)
+	protected.GET("/files/:id/tags", h.File.GetTags)
+
+	protected.POST("/ocr/jobs", h.OCR.CreateJob)
+	protected.GET("/ocr/jobs/:id", h.OCR.GetJobStatus)
 }

mobile/App.tsx

@@ -1,8 +1,12 @@
 import React from 'react';
 import { StatusBar } from 'expo-status-bar';
+import { ActivityIndicator, View } from 'react-native';
 import { NavigationContainer } from '@react-navigation/native';
 import { createNativeStackNavigator } from '@react-navigation/native-stack';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { AuthProvider, useAuth } from './contexts/AuthContext';
+import { LoginScreen } from './app/login';
+import { RegisterScreen } from './app/register';
 import { HomeScreen } from './app/index';
 import { UploadScreen } from './app/upload';
 import { ScanScreen } from './app/scan';
@@ -16,32 +20,61 @@ import { FolderScreen } from './app/folder';
 const Stack = createNativeStackNavigator();
 const queryClient = new QueryClient();
 
+function AppNavigator() {
+  const { user, isLoading } = useAuth();
+
+  if (isLoading) {
+    return (
+      <View style={{ flex: 1, justifyContent: 'center', alignItems: 'center' }}>
+        <ActivityIndicator size="large" />
+      </View>
+    );
+  }
+
+  return (
+    <NavigationContainer>
+      <Stack.Navigator initialRouteName={user ? 'Home' : 'Login'}>
+        {user ? (
+          <>
+            <Stack.Screen
+              name="Home"
+              component={HomeScreen}
+              options={{
+                title: 'Dot.',
+                headerTitleStyle: { fontSize: 18 },
+              }}
+            />
+            <Stack.Screen name="Upload" component={UploadScreen} options={{ title: 'Upload' }} />
+            <Stack.Screen name="Scan" component={ScanScreen} options={{ title: 'Scan' }} />
+            <Stack.Screen name="Search" component={SearchScreen} options={{ title: 'Recherche' }} />
+            <Stack.Screen name="BatchReview" component={BatchReviewScreen} options={{ title: 'Revue du lot' }} />
+            <Stack.Screen name="PendingReview" component={PendingReviewScreen} options={{ title: 'Réorganisation' }} />
+            <Stack.Screen
+              name="FileDetail"
+              component={FileDetailScreen}
+              options={{ title: 'Détails', headerTintColor: '#fff', headerStyle: { backgroundColor: '#000' } }}
+            />
+            <Stack.Screen name="FileEdit" component={FileEditScreen} options={{ title: 'Édition' }} />
+            <Stack.Screen name="Folder" component={FolderScreen} options={{ title: 'Dossier' }} />
+          </>
+        ) : (
+          <>
+            <Stack.Screen name="Login" component={LoginScreen} options={{ headerShown: false }} />
+            <Stack.Screen name="Register" component={RegisterScreen} options={{ headerShown: false }} />
+          </>
+        )}
+      </Stack.Navigator>
+    </NavigationContainer>
+  );
+}
+
 export default function App() {
   return (
     <QueryClientProvider client={queryClient}>
-      <NavigationContainer>
+      <AuthProvider>
-        <Stack.Navigator initialRouteName="Home">
+        <AppNavigator />
-          <Stack.Screen name="Home" component={HomeScreen} 
+        <StatusBar style="auto" />
-          options={{ 
+      </AuthProvider>
-            title: 'Dot.',
-            headerTitleStyle: { fontSize: 18 },
-          }} 
-          />
-          <Stack.Screen name="Upload" component={UploadScreen} options={{ title: 'Upload' }} />
-          <Stack.Screen name="Scan" component={ScanScreen} options={{ title: 'Scan' }} />
-          <Stack.Screen name="Search" component={SearchScreen} options={{ title: 'Recherche' }} />
-          <Stack.Screen name="BatchReview" component={BatchReviewScreen} options={{ title: 'Revue du lot' }} />
-          <Stack.Screen name="PendingReview" component={PendingReviewScreen} options={{ title: 'Réorganisation' }} />
-          <Stack.Screen
-            name="FileDetail"
-            component={FileDetailScreen}
-            options={{ title: 'Détails', headerTintColor: '#fff', headerStyle: { backgroundColor: '#000' } }}
-          />
-          <Stack.Screen name="FileEdit" component={FileEditScreen} options={{ title: 'Édition' }} />
-          <Stack.Screen name="Folder" component={FolderScreen} options={{ title: 'Dossier' }} />
-        </Stack.Navigator>
-      </NavigationContainer>
-      <StatusBar style="auto" />
     </QueryClientProvider>
   );
 }

mobile/api/client.ts

@@ -1,26 +1,47 @@
 import { API_BASE_URL, ENDPOINTS } from '../constants/api';
 import { ApiError, HttpError } from '../types';
+import { tokenStorage } from './secureStorage';
 
 class ApiClient {
   private baseUrl: string;
+  private accessToken: string | null = null;
 
   constructor(baseUrl: string) {
     this.baseUrl = baseUrl;
   }
 
+  setAccessToken(token: string | null) {
+    this.accessToken = token;
+  }
+
   private async request<T>(
     endpoint: string,
-    options: RequestInit = {}
+    options: RequestInit = {},
+    isRetry = false
   ): Promise<T> {
     const url = `${this.baseUrl}${endpoint}`;
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+      ...(options.headers as Record<string, string>),
+    };
+
+    if (this.accessToken) {
+      headers['Authorization'] = `Bearer ${this.accessToken}`;
+    }
+
     const response = await fetch(url, {
       ...options,
-      headers: {
+      headers,
-        'Content-Type': 'application/json',
-        ...options.headers,
-      },
     });
 
+    if (response.status === 401 && !isRetry) {
+      const refreshed = await this.tryRefreshToken();
+      if (refreshed) {
+        return this.request<T>(endpoint, options, true);
+      }
+      throw new HttpError(401, 'Session expirée', 'UNAUTHORIZED');
+    }
+
     if (!response.ok) {
       let message = 'Request failed';
       let code: string | undefined;
@@ -35,6 +56,39 @@ class ApiClient {
     return response.json();
   }
 
+  private async tryRefreshToken(): Promise<boolean> {
+    try {
+      const refreshToken = await tokenStorage.getRefreshToken();
+      if (!refreshToken) return false;
+
+      const url = `${this.baseUrl}${ENDPOINTS.AUTH_REFRESH}`;
+      const response = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ refresh_token: refreshToken }),
+      });
+
+      if (!response.ok) {
+        await this.clearAuth();
+        return false;
+      }
+
+      const data = await response.json();
+      this.accessToken = data.access_token;
+      await tokenStorage.setRefreshToken(data.refresh_token);
+      return true;
+    } catch {
+      await this.clearAuth();
+      return false;
+    }
+  }
+
+  private async clearAuth() {
+    this.accessToken = null;
+    await tokenStorage.deleteRefreshToken();
+    await tokenStorage.deleteUser();
+  }
+
   async get<T>(endpoint: string): Promise<T> {
     return this.request<T>(endpoint);
   }

mobile/api/secureStorage.ts

@@ -0,0 +1,30 @@
+import * as SecureStore from 'expo-secure-store';
+
+const REFRESH_KEY = 'vaultdrop_refresh_token';
+const USER_KEY = 'vaultdrop_user';
+
+export const tokenStorage = {
+  async getRefreshToken(): Promise<string | null> {
+    return SecureStore.getItemAsync(REFRESH_KEY);
+  },
+
+  async setRefreshToken(token: string): Promise<void> {
+    await SecureStore.setItemAsync(REFRESH_KEY, token);
+  },
+
+  async deleteRefreshToken(): Promise<void> {
+    await SecureStore.deleteItemAsync(REFRESH_KEY);
+  },
+
+  async getUser(): Promise<string | null> {
+    return SecureStore.getItemAsync(USER_KEY);
+  },
+
+  async setUser(user: string): Promise<void> {
+    await SecureStore.setItemAsync(USER_KEY, user);
+  },
+
+  async deleteUser(): Promise<void> {
+    await SecureStore.deleteItemAsync(USER_KEY);
+  },
+};

mobile/app.json

@@ -31,6 +31,9 @@
     },
     "web": {
       "favicon": "./assets/favicon.png"
-    }
+    },
+    "plugins": [
+      "expo-secure-store"
+    ]
   }
 }

mobile/app/file-edit.tsx

@@ -30,9 +30,11 @@ type FileEditRouteParams = {
 
 interface FileEditItemProps {
   fileId: string;
+  selected: boolean;
+  onPress: () => void;
 }
 
-function FileEditItem({ fileId }: FileEditItemProps) {
+function FileEditItem({ fileId, selected, onPress }: FileEditItemProps) {
   const { data: fileData, isLoading: fileLoading } = useFile(fileId);
   const { data: imageData, isLoading: imageLoading } = useFileImage(fileId);
   const file = fileData as any;
@@ -41,14 +43,14 @@ function FileEditItem({ fileId }: FileEditItemProps) {
 
   if (isLoading) {
     return (
-      <View style={[styles.gridItem, styles.gridItemLoading]}>
+      <TouchableOpacity style={[styles.gridItem, styles.gridItemLoading]} onPress={onPress} activeOpacity={0.7}>
         <ActivityIndicator size="small" color="#1976D2" />
-      </View>
+      </TouchableOpacity>
     );
   }
 
   return (
-    <View style={styles.gridItem}>
+    <TouchableOpacity style={styles.gridItem} onPress={onPress} activeOpacity={0.7}>
       {uri && file?.mimeType?.startsWith('image/') ? (
         <Image source={{ uri }} style={styles.thumb} />
       ) : (
@@ -58,7 +60,14 @@ function FileEditItem({ fileId }: FileEditItemProps) {
           size={ITEM_SIZE}
         />
       )}
-    </View>
+      {selected && (
+        <View style={styles.selectedOverlay}>
+          <View style={styles.checkCircle}>
+            <MaterialIcons name="check" size={18} color="#fff" />
+          </View>
+        </View>
+      )}
+    </TouchableOpacity>
   );
 }
 
@@ -74,6 +83,26 @@ export function FileEditScreen() {
   const [tagInput, setTagInput] = useState('');
   const [pendingTags, setPendingTags] = useState<string[]>([]);
   const [uploading, setUploading] = useState(false);
+  const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set());
+
+  const hasSelection = selectedIds.size > 0;
+  const targetIds = hasSelection ? Array.from(selectedIds) : fileIds;
+
+  const toggleSelection = useCallback((id: string) => {
+    setSelectedIds((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  }, []);
+
+  const toggleSelectAll = useCallback(() => {
+    setSelectedIds((prev) => {
+      if (prev.size === fileIds.length) return new Set();
+      return new Set(fileIds);
+    });
+  }, [fileIds]);
 
   const handleAddTag = () => {
     const tag = tagInput.trim().toLowerCase();
@@ -88,21 +117,21 @@ export function FileEditScreen() {
 
   const handleApplyTags = useCallback(async () => {
     if (pendingTags.length === 0) return;
-    for (const fileId of fileIds) {
+    for (const fileId of targetIds) {
       await addTags.mutateAsync({ fileId, tags: pendingTags });
     }
     Alert.alert('Succès', `${pendingTags.length} tag${pendingTags.length > 1 ? 's' : ''} ajouté${pendingTags.length > 1 ? 's' : ''}`);
     setPendingTags([]);
-  }, [pendingTags, fileIds, addTags]);
+  }, [pendingTags, targetIds, addTags]);
 
   const handleGeneratePdf = useCallback(async () => {
-    if (fileIds.length === 0) return;
+    if (targetIds.length === 0) return;
 
     setUploading(true);
     try {
       const imageUris: { uri: string }[] = [];
 
-      for (const fileId of fileIds) {
+      for (const fileId of targetIds) {
         const response = await fetch(`${process.env.EXPO_PUBLIC_API_BASE_URL || 'http://192.168.1.17:8080/api/v1'}/files/${fileId}`);
         const data = await response.json();
         const url = data?.data?.url;
@@ -152,17 +181,26 @@ export function FileEditScreen() {
     } finally {
       setUploading(false);
     }
-  }, [fileIds, generatePdf, upload, navigation]);
+  }, [targetIds, generatePdf, upload, navigation]);
 
   const isLoading = generating || uploading;
 
   return (
     <View style={styles.container}>
       <View style={styles.header}>
-        <Text style={styles.title}>Édition</Text>
+        <View style={styles.headerRow}>
-        <Text style={styles.subtitle}>
+          <View>
-          {fileIds.length} fichier{fileIds.length > 1 ? 's' : ''} sélectionné{fileIds.length > 1 ? 's' : ''}
+            <Text style={styles.title}>Édition</Text>
-        </Text>
+            <Text style={styles.subtitle}>
+              {hasSelection
+                ? `${selectedIds.size} sélectionné${selectedIds.size > 1 ? 's' : ''} / ${fileIds.length}`
+                : `${fileIds.length} fichier${fileIds.length > 1 ? 's' : ''}`}
+            </Text>
+          </View>
+          <TouchableOpacity style={styles.selectAllBtn} onPress={toggleSelectAll}>
+            <Text style={styles.selectAllText}>{hasSelection && selectedIds.size === fileIds.length ? 'Tout' : 'Tout'}</Text>
+          </TouchableOpacity>
+        </View>
       </View>
 
       <FlatList
@@ -171,7 +209,13 @@ export function FileEditScreen() {
         keyExtractor={(item) => item}
         contentContainerStyle={styles.grid}
         columnWrapperStyle={styles.gridRow}
-        renderItem={({ item }) => <FileEditItem fileId={item} />}
+        renderItem={({ item }) => (
+          <FileEditItem
+            fileId={item}
+            selected={hasSelection ? selectedIds.has(item) : true}
+            onPress={() => toggleSelection(item)}
+          />
+        )}
       />
 
       <View style={styles.tagSection}>
@@ -243,6 +287,11 @@ const styles = StyleSheet.create({
     borderBottomWidth: 1,
     borderBottomColor: '#e0e0e0',
   },
+  headerRow: {
+    flexDirection: 'row',
+    justifyContent: 'space-between',
+    alignItems: 'center',
+  },
   title: {
     fontSize: 20,
     fontWeight: '700',
@@ -252,6 +301,17 @@ const styles = StyleSheet.create({
     fontSize: 14,
     color: '#666',
   },
+  selectAllBtn: {
+    paddingHorizontal: 12,
+    paddingVertical: 6,
+    borderRadius: 16,
+    backgroundColor: '#E3F2FD',
+  },
+  selectAllText: {
+    fontSize: 13,
+    fontWeight: '600',
+    color: '#1976D2',
+  },
   grid: {
     padding: 16,
   },
@@ -270,6 +330,24 @@ const styles = StyleSheet.create({
     justifyContent: 'center',
     alignItems: 'center',
   },
+  selectedOverlay: {
+    position: 'absolute',
+    top: 0,
+    left: 0,
+    right: 0,
+    bottom: 0,
+    justifyContent: 'flex-start',
+    alignItems: 'flex-end',
+    padding: 4,
+  },
+  checkCircle: {
+    width: 24,
+    height: 24,
+    borderRadius: 12,
+    backgroundColor: '#1976D2',
+    justifyContent: 'center',
+    alignItems: 'center',
+  },
   thumb: {
     width: '100%',
     height: '100%',

mobile/app/login.tsx

@@ -0,0 +1,141 @@
+import React, { useState } from 'react';
+import {
+  View,
+  Text,
+  TextInput,
+  TouchableOpacity,
+  StyleSheet,
+  Alert,
+  KeyboardAvoidingView,
+  Platform,
+  ActivityIndicator,
+} from 'react-native';
+import { useAuth } from '../contexts/AuthContext';
+
+export function LoginScreen({ navigation }: any) {
+  const { login } = useAuth();
+  const [username, setUsername] = useState('');
+  const [password, setPassword] = useState('');
+  const [loading, setLoading] = useState(false);
+
+  async function handleLogin() {
+    if (!username.trim() || !password) {
+      Alert.alert('Erreur', 'Veuillez remplir tous les champs');
+      return;
+    }
+
+    setLoading(true);
+    try {
+      await login(username.trim(), password);
+    } catch (error: any) {
+      Alert.alert('Erreur', error.message || 'Connexion échouée');
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  return (
+    <KeyboardAvoidingView
+      style={styles.container}
+      behavior={Platform.OS === 'ios' ? 'padding' : 'height'}
+    >
+      <View style={styles.inner}>
+        <Text style={styles.title}>Dot.</Text>
+        <Text style={styles.subtitle}>Connectez-vous à votre compte</Text>
+
+        <TextInput
+          style={styles.input}
+          placeholder="Nom d'utilisateur"
+          value={username}
+          onChangeText={setUsername}
+          autoCapitalize="none"
+          autoCorrect={false}
+          editable={!loading}
+        />
+
+        <TextInput
+          style={styles.input}
+          placeholder="Mot de passe"
+          value={password}
+          onChangeText={setPassword}
+          secureTextEntry
+          editable={!loading}
+        />
+
+        <TouchableOpacity
+          style={[styles.button, loading && styles.buttonDisabled]}
+          onPress={handleLogin}
+          disabled={loading}
+        >
+          {loading ? (
+            <ActivityIndicator color="#fff" />
+          ) : (
+            <Text style={styles.buttonText}>Se connecter</Text>
+          )}
+        </TouchableOpacity>
+
+        <TouchableOpacity
+          style={styles.linkButton}
+          onPress={() => navigation.navigate('Register')}
+          disabled={loading}
+        >
+          <Text style={styles.linkText}>Pas de compte ? S'inscrire</Text>
+        </TouchableOpacity>
+      </View>
+    </KeyboardAvoidingView>
+  );
+}
+
+const styles = StyleSheet.create({
+  container: {
+    flex: 1,
+    backgroundColor: '#fff',
+  },
+  inner: {
+    flex: 1,
+    justifyContent: 'center',
+    paddingHorizontal: 32,
+  },
+  title: {
+    fontSize: 32,
+    fontWeight: 'bold',
+    textAlign: 'center',
+    marginBottom: 8,
+  },
+  subtitle: {
+    fontSize: 16,
+    color: '#666',
+    textAlign: 'center',
+    marginBottom: 32,
+  },
+  input: {
+    borderWidth: 1,
+    borderColor: '#ddd',
+    borderRadius: 8,
+    padding: 16,
+    fontSize: 16,
+    marginBottom: 16,
+  },
+  button: {
+    backgroundColor: '#000',
+    borderRadius: 8,
+    padding: 16,
+    alignItems: 'center',
+    marginBottom: 16,
+  },
+  buttonDisabled: {
+    opacity: 0.6,
+  },
+  buttonText: {
+    color: '#fff',
+    fontSize: 16,
+    fontWeight: '600',
+  },
+  linkButton: {
+    alignItems: 'center',
+  },
+  linkText: {
+    color: '#000',
+    fontSize: 14,
+  },
+});

mobile/app/register.tsx

@@ -0,0 +1,161 @@
+import React, { useState } from 'react';
+import {
+  View,
+  Text,
+  TextInput,
+  TouchableOpacity,
+  StyleSheet,
+  Alert,
+  KeyboardAvoidingView,
+  Platform,
+  ActivityIndicator,
+} from 'react-native';
+import { useAuth } from '../contexts/AuthContext';
+
+export function RegisterScreen({ navigation }: any) {
+  const { register } = useAuth();
+  const [username, setUsername] = useState('');
+  const [password, setPassword] = useState('');
+  const [confirmPassword, setConfirmPassword] = useState('');
+  const [loading, setLoading] = useState(false);
+
+  async function handleRegister() {
+    if (!username.trim() || !password || !confirmPassword) {
+      Alert.alert('Erreur', 'Veuillez remplir tous les champs');
+      return;
+    }
+
+    if (password !== confirmPassword) {
+      Alert.alert('Erreur', 'Les mots de passe ne correspondent pas');
+      return;
+    }
+
+    if (password.length < 8) {
+      Alert.alert('Erreur', 'Le mot de passe doit contenir au moins 8 caractères');
+      return;
+    }
+
+    setLoading(true);
+    try {
+      await register(username.trim(), password);
+    } catch (error: any) {
+      Alert.alert('Erreur', error.message || "Inscription échouée");
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  return (
+    <KeyboardAvoidingView
+      style={styles.container}
+      behavior={Platform.OS === 'ios' ? 'padding' : 'height'}
+    >
+      <View style={styles.inner}>
+        <Text style={styles.title}>Dot.</Text>
+        <Text style={styles.subtitle}>Créez votre compte</Text>
+
+        <TextInput
+          style={styles.input}
+          placeholder="Nom d'utilisateur"
+          value={username}
+          onChangeText={setUsername}
+          autoCapitalize="none"
+          autoCorrect={false}
+          editable={!loading}
+        />
+
+        <TextInput
+          style={styles.input}
+          placeholder="Mot de passe"
+          value={password}
+          onChangeText={setPassword}
+          secureTextEntry
+          editable={!loading}
+        />
+
+        <TextInput
+          style={styles.input}
+          placeholder="Confirmer le mot de passe"
+          value={confirmPassword}
+          onChangeText={setConfirmPassword}
+          secureTextEntry
+          editable={!loading}
+        />
+
+        <TouchableOpacity
+          style={[styles.button, loading && styles.buttonDisabled]}
+          onPress={handleRegister}
+          disabled={loading}
+        >
+          {loading ? (
+            <ActivityIndicator color="#fff" />
+          ) : (
+            <Text style={styles.buttonText}>S'inscrire</Text>
+          )}
+        </TouchableOpacity>
+
+        <TouchableOpacity
+          style={styles.linkButton}
+          onPress={() => navigation.navigate('Login')}
+          disabled={loading}
+        >
+          <Text style={styles.linkText}>Déjà un compte ? Se connecter</Text>
+        </TouchableOpacity>
+      </View>
+    </KeyboardAvoidingView>
+  );
+}
+
+const styles = StyleSheet.create({
+  container: {
+    flex: 1,
+    backgroundColor: '#fff',
+  },
+  inner: {
+    flex: 1,
+    justifyContent: 'center',
+    paddingHorizontal: 32,
+  },
+  title: {
+    fontSize: 32,
+    fontWeight: 'bold',
+    textAlign: 'center',
+    marginBottom: 8,
+  },
+  subtitle: {
+    fontSize: 16,
+    color: '#666',
+    textAlign: 'center',
+    marginBottom: 32,
+  },
+  input: {
+    borderWidth: 1,
+    borderColor: '#ddd',
+    borderRadius: 8,
+    padding: 16,
+    fontSize: 16,
+    marginBottom: 16,
+  },
+  button: {
+    backgroundColor: '#000',
+    borderRadius: 8,
+    padding: 16,
+    alignItems: 'center',
+    marginBottom: 16,
+  },
+  buttonDisabled: {
+    opacity: 0.6,
+  },
+  buttonText: {
+    color: '#fff',
+    fontSize: 16,
+    fontWeight: '600',
+  },
+  linkButton: {
+    alignItems: 'center',
+  },
+  linkText: {
+    color: '#000',
+    fontSize: 14,
+  },
+});

mobile/constants/api.ts

@@ -9,4 +9,8 @@ export const ENDPOINTS = {
   FOLDERS: '/files/folders',
   OCR_JOBS: '/ocr/jobs',
   HEALTH: '/health',
+  AUTH_LOGIN: '/auth/login',
+  AUTH_REGISTER: '/auth/register',
+  AUTH_REFRESH: '/auth/refresh',
+  AUTH_LOGOUT: '/auth/logout',
 } as const;

mobile/contexts/AuthContext.tsx

@@ -0,0 +1,90 @@
+import React, { createContext, useContext, useEffect, useState } from 'react';
+import { apiClient } from '../api/client';
+import { tokenStorage } from '../api/secureStorage';
+import { ENDPOINTS } from '../constants/api';
+import { AuthResponse, User } from '../types';
+
+interface AuthContextType {
+  user: User | null;
+  isLoading: boolean;
+  login: (username: string, password: string) => Promise<void>;
+  register: (username: string, password: string) => Promise<void>;
+  logout: () => Promise<void>;
+}
+
+const AuthContext = createContext<AuthContextType | undefined>(undefined);
+
+export function AuthProvider({ children }: { children: React.ReactNode }) {
+  const [user, setUser] = useState<User | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+
+  useEffect(() => {
+    loadUser();
+  }, []);
+
+  async function loadUser() {
+    try {
+      const stored = await tokenStorage.getUser();
+      if (stored) {
+        const userData = JSON.parse(stored) as User;
+        setUser(userData);
+      }
+    } catch {
+      await tokenStorage.deleteUser();
+    } finally {
+      setIsLoading(false);
+    }
+  }
+
+  async function login(username: string, password: string) {
+    const response = await apiClient.post<AuthResponse>(ENDPOINTS.AUTH_LOGIN, {
+      username,
+      password,
+    });
+
+    apiClient.setAccessToken(response.access_token);
+    await tokenStorage.setRefreshToken(response.refresh_token);
+    await tokenStorage.setUser(JSON.stringify(response.user));
+    setUser(response.user);
+  }
+
+  async function register(username: string, password: string) {
+    const response = await apiClient.post<AuthResponse>(ENDPOINTS.AUTH_REGISTER, {
+      username,
+      password,
+    });
+
+    apiClient.setAccessToken(response.access_token);
+    await tokenStorage.setRefreshToken(response.refresh_token);
+    await tokenStorage.setUser(JSON.stringify(response.user));
+    setUser(response.user);
+  }
+
+  async function logout() {
+    try {
+      const refreshToken = await tokenStorage.getRefreshToken();
+      if (refreshToken) {
+        await apiClient.post(ENDPOINTS.AUTH_LOGOUT, { refresh_token: refreshToken });
+      }
+    } catch {}
+
+    apiClient.setAccessToken(null);
+    await tokenStorage.deleteRefreshToken();
+    await tokenStorage.deleteUser();
+    setUser(null);
+  }
+
+  return (
+    <AuthContext.Provider value={{ user, isLoading, login, register, logout }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}
+
+export function useAuth() {
+  const context = useContext(AuthContext);
+  if (!context) {
+    throw new Error('useAuth must be used within an AuthProvider');
+  }
+  return context;
+}

mobile/package-lock.json

@@ -17,6 +17,7 @@
         "expo-file-system": "~57.0.0",
         "expo-image-picker": "~57.0.2",
         "expo-print": "~57.0.0",
+        "expo-secure-store": "~57.0.0",
         "expo-status-bar": "~57.0.0",
         "react": "19.2.3",
         "react-native": "0.86.0",
@@ -2924,6 +2925,15 @@
         "react-native": "*"
       }
     },
+    "node_modules/expo-secure-store": {
+      "version": "57.0.0",
+      "resolved": "https://registry.npmjs.org/expo-secure-store/-/expo-secure-store-57.0.0.tgz",
+      "integrity": "sha512-vkP16rhW7b4bljW5BC4kKXBpNxQ0O1E9SpI5NIfh2biZnszLTpI/gUF4oBsvOY2nvkh7oXS2ERuUoA8cuS8FWQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "expo": "*"
+      }
+    },
     "node_modules/expo-server": {
       "version": "57.0.0",
       "resolved": "https://registry.npmjs.org/expo-server/-/expo-server-57.0.0.tgz",

mobile/package.json

@@ -12,6 +12,7 @@
     "expo-file-system": "~57.0.0",
     "expo-image-picker": "~57.0.2",
     "expo-print": "~57.0.0",
+    "expo-secure-store": "~57.0.0",
     "expo-status-bar": "~57.0.0",
     "react": "19.2.3",
     "react-native": "0.86.0",

mobile/types/index.ts

@@ -83,3 +83,24 @@ export type Batch = {
   photos: CapturedPhoto[];
   tags: string[];
 };
+
+export interface User {
+  id: string;
+  username: string;
+}
+
+export interface AuthTokens {
+  access_token: string;
+  refresh_token: string;
+}
+
+export interface AuthResponse {
+  user: User;
+  access_token: string;
+  refresh_token: string;
+}
+
+export interface RefreshResponse {
+  access_token: string;
+  refresh_token: string;
+}