Update documentation and gate tag creation behind admin role, create default admin on database seeding

T120B165-ImgBoard/Controllers/AuthController.cs

@@ -12,8 +12,16 @@ namespace T120B165_ImgBoard.Controllers;
 public class AuthController(UserManager<User> userManager, ITokenService tokenService): ControllerBase
 {
 
+    /// <summary>
+    /// Creates a new user account.
+    /// </summary>
+    /// <param name="dto">Registration data</param>
+    /// <response code="200">Returns user data</response>
+    /// <response code="400">If user supplied credentials fail validation</response>
     [HttpPost("register")]
-    public async Task<ActionResult<User>> Register(RegisterDto dto)
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<ActionResult<SlimUserDto>> Register(RegisterDto dto)
     {
         var user = new User
         {
@@ -27,9 +35,15 @@ public class AuthController(UserManager<User> userManager, ITokenService tokenSe
         {
             return BadRequest(result.Errors);
         }
-        return Ok(user);
+        return Ok(SlimUserDto.FromUser(user));
     }
 
+    /// <summary>
+    /// Authenticates and creates a pair of access and refresh tokens.
+    /// </summary>
+    /// <param name="dto">Data with refresh token</param>
+    /// <response code="200">Returns refresh and access tokens</response>
+    /// <response code="401">If the credentials are incorrect</response>
     [HttpPost("login")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status401Unauthorized)]
@@ -44,6 +58,12 @@ public class AuthController(UserManager<User> userManager, ITokenService tokenSe
         return Ok(new TokenDto(AccessToken: accessToken, RefreshToken: refreshToken));
     }
 
+    /// <summary>
+    /// Consume refresh token to create new access and refresh tokens.
+    /// </summary>
+    /// <param name="dto">Data with refresh token</param>
+    /// <response code="200">Returns new refresh and access tokens</response>
+    /// <response code="401">If refresh token is missing or is expired</response>
     [HttpPost("refresh")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status401Unauthorized)]