عرض عملي: إصدار JWT والتحقق منه

خطوة بخطوة

1. Add a POST /api/auth/login that checks credentials and builds a JWT with sub, iss, aud, short exp.
2. Sign it with a key read from configuration (not from source code).
3. Configure the API as a resource server: oauth2ResourceServer(o -> o.jwt(...)) with a JwtDecoder that checks issuer and audience.
4. Call the API with the token and see 200.
5. Planned mistake: putting the user's email and phone in the claims. Fix: keep only the ID and roles.
6. Decode the token on a debugger site and point out the readable payload.