// internal/models/jwt.go
type JwtClaims struct {
    UserID       uint64 `json:"userId"`
    Email        string `json:"email"`
    Role         string `json:"role"`
    Roles        []string `json:"roles"`
    MerchantID   string `json:"merchantId"`
    BranchID     string `json:"branchId"`
    SessionID    string `json:"sessionId"`
    LoginMethod  string `json:"loginMethod"`
    LoginAt      int64  `json:"loginAt"`
    jwt.StandardClaims
}

// internal/config/config.go
type SystemConfig struct {
    JwtSecret   string `env:"SYSTEM_JWT_SECRET"`
    JwtExpired  int    `env:"SYSTEM_EXPIRED_JWT" envDefault:"60"` // minutes
}

// internal/middleware/auth.go
func AuthMiddleware(c *fiber.Ctx) error {
    // Parse Bearer token
    authHeader := c.Get("Authorization")
    token := strings.TrimPrefix(authHeader, "Bearer ")

    // Validate JWT
    claims, err := utils_jwt.CheckJWTValid(config.Apps.System.JwtSecret, token)
    if err != nil {
        return c.Status(401).JSON(fiber.Map{
            "error": "Unauthorized"
        })
    }

    // Set claims to context
    c.Locals("user_session", claims)
    return c.Next()
}

POST /api/v2/core/auth/login
Content-Type: application/json

{
  "email": "[email protected]",
  "password": "your_password",
  "login_method": "password"  // password | google | apple
}

POST /api/v2/core/auth/refresh-token
Content-Type: application/json

{
  "refresh_token": "your_refresh_token"
}

POST /api/v2/core/auth/logout
Authorization: Bearer {access_token}

POST /api/v2/core/auth/logout-all
Authorization: Bearer {access_token}

-- session_activity table
| Column       | Type      | Description |
|--------------|-----------|-------------|
| id           | bigint    | Primary key |
| user_id      | bigint    | FK to users |
| session_id   | varchar   | UUID session |
| login_method | varchar   | password/google/apple |
| login_time   | timestamp | Login timestamp |
| ip_address   | varchar   | Client IP |
| user_agent   | text      | Browser/Device info |