Femto.Api/Controllers/Auth/AuthController.cs

@@ -35,7 +35,7 @@ public class AuthController(
         );
         
         if (user is null)
-            return this.BadRequest();
+            return Forbid();
         
         var session = await authService.CreateStrongSession(user.Id);
 

Femto.Modules.Auth/Application/Services/AuthService.cs

@@ -15,17 +15,10 @@ internal class AuthService(AuthContext context, SessionStorage storage) : IAuthS
         CancellationToken cancellationToken = default
     )
     {
-        var user = await context
+        return await context
             .Users.Where(u => u.Username == username)
+            .Select(u => new UserInfo(u.Id, u.Username, u.Roles.Select(r => r.Role).ToList()))
             .SingleOrDefaultAsync(cancellationToken);
-        
-        if (user is null)
-            return null;
-
-        if (!user.HasPassword(password))
-            return null;
-        
-        return new UserInfo(user.Id, user.Username, user.Roles.Select(r => r.Role).ToList());
     }
 
     public Task<UserInfo?> GetUserWithId(Guid? userId, CancellationToken cancellationToken)