// POST /cms/auth/login — exchange email+password for a session token (public).
// Guard the body type: since the platform fix (F-026) non-JSON bodies now reach
// the script (text -> string, binary -> base64), so an endpoint expecting a JSON
// object must type-check rather than assume a map (else it throws -> 502).
let b = ctx.request.body;
if type_of(b) != "map" || b.email == () || b.password == () {
    return #{ statusCode: 400, body: #{ error: "email and password required" } };
}
let token = ();
try { token = users::login(b.email, b.password); } catch(e) { token = (); }
if token == () {
    return #{ statusCode: 401, body: #{ error: "invalid credentials" } };
}
let u = users::verify(token);
let roles = [];
for r in ["admin", "author", "reader"] { if users::has_role(u.id, r) { roles.push(r); } }
#{
    statusCode: 200,
    body: #{
        token: token,
        user: #{ id: u.id, email: u.email, display_name: u.display_name, roles: roles }
    }
}