+pub async fn handle_login(req: LoginRequest) -> Result<Token> {
+ // ⚠️ review: 需添加 rate limiting
+ let user = auth::verify(&req.credential).await?;
let token = jwt::sign(user.id)?;
- Ok(Response::new(token))
+ Ok(Response::new(TokenResponse { token, expires_in: 3600 }))