feat(rocie-server): Implement basic user handling and authentication

44 files changed, 1198 insertions, 251 deletions

diff --git a/crates/rocie-server/Cargo.toml b/crates/rocie-server/Cargo.toml
index 51df09c..9e20321 100644
--- a/crates/rocie-server/Cargo.toml
+++ b/crates/rocie-server/Cargo.toml
@@ -35,6 +35,7 @@ actix-cors = "0.7.1"
 actix-identity = "0.9.0"
 actix-session = { version = "0.11.0", features = ["cookie-session"] }
 actix-web = "4.11.0"
+argon2 = "0.5.3"
 chrono = "0.4.41"
 clap = { version = "4.5.45", features = ["derive", "env"] }
 env_logger = "0.11.8"
diff --git a/crates/rocie-server/src/api/get/inventory.rs b/crates/rocie-server/src/api/get/auth/inventory.rs
index d1ca436..24a8e3d 100644
--- a/crates/rocie-server/src/api/get/inventory.rs
+++ b/crates/rocie-server/src/api/get/auth/inventory.rs
@@ -1,8 +1,12 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, get, web};
 
 use crate::{
     app::App,
-    storage::sql::{product::{ProductId, ProductIdStub}, product_amount::ProductAmount},
+    storage::sql::{
+        product::{ProductId, ProductIdStub},
+        product_amount::ProductAmount,
+    },
 };
 
 /// Get the amount of an product
@@ -18,6 +22,10 @@ use crate::{
             description = "Product not found in database"
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -34,6 +42,7 @@ use crate::{
 pub(crate) async fn amount_by_id(
     app: web::Data<App>,
     id: web::Path<ProductIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
diff --git a/crates/rocie-server/src/api/get/auth/mod.rs b/crates/rocie-server/src/api/get/auth/mod.rs
new file mode 100644
index 0000000..c51f6a7
--- /dev/null
+++ b/crates/rocie-server/src/api/get/auth/mod.rs
@@ -0,0 +1,32 @@
+use actix_web::web;
+
+pub(crate) mod inventory;
+pub(crate) mod product;
+pub(crate) mod product_parent;
+pub(crate) mod recipe;
+pub(crate) mod unit;
+pub(crate) mod unit_property;
+pub(crate) mod user;
+
+pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {
+    cfg.service(inventory::amount_by_id)
+        .service(product::product_by_id)
+        .service(product::product_by_name)
+        .service(product::product_suggestion_by_name)
+        .service(product::products_by_product_parent_id_direct)
+        .service(product::products_by_product_parent_id_indirect)
+        .service(product::products_in_storage)
+        .service(product::products_registered)
+        .service(product_parent::product_parents)
+        .service(product_parent::product_parents_toplevel)
+        .service(product_parent::product_parents_under)
+        .service(recipe::recipe_by_id)
+        .service(recipe::recipes)
+        .service(unit::unit_by_id)
+        .service(unit::units)
+        .service(unit::units_by_property_id)
+        .service(unit_property::unit_properties)
+        .service(unit_property::unit_property_by_id)
+        .service(user::users)
+        .service(user::user_by_id);
+}
diff --git a/crates/rocie-server/src/api/get/product.rs b/crates/rocie-server/src/api/get/auth/product.rs
index 4216f9b..1a1e31d 100644
--- a/crates/rocie-server/src/api/get/product.rs
+++ b/crates/rocie-server/src/api/get/auth/product.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpRequest, HttpResponse, Responder, Result, get, web};
 use log::info;
 use percent_encoding::percent_decode_str;
@@ -31,23 +32,43 @@ impl UrlEncodedString {
 /// Get Product by id
 #[utoipa::path(
     responses(
-        (status = OK, description = "Product found from database", body = Product),
-        (status = NOT_FOUND, description = "Product not found in database"),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Product found from database",
+            body = Product
+        ),
+        (
+            status = NOT_FOUND,
+            description = "Product not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("id" = ProductId, description = "Product id" ),
+        (
+            "id" = ProductId,
+            description = "Product id"
+        ),
     )
 )]
 #[get("/product/by-id/{id}")]
 pub(crate) async fn product_by_id(
     app: web::Data<App>,
     id: web::Path<ProductIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
     match Product::from_id(&app, id.into()).await? {
         Some(product) => Ok(HttpResponse::Ok().json(product)),
+
         None => Ok(HttpResponse::NotFound().finish()),
     }
 }
@@ -55,12 +76,30 @@ pub(crate) async fn product_by_id(
 /// Get Product by name
 #[utoipa::path(
     responses(
-        (status = OK, description = "Product found from database", body = Product),
-        (status = NOT_FOUND, description = "Product not found in database"),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Product found from database",
+            body = Product
+        ),
+        (
+            status = NOT_FOUND,
+            description = "Product not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("name" = String, description = "Name of the product" ),
+        (
+            "name" = String,
+            description = "Name of the product"
+        ),
     )
 )]
 #[get("/product/by-name/{name}")]
@@ -68,6 +107,7 @@ pub(crate) async fn product_by_name(
     app: web::Data<App>,
     req: HttpRequest,
     name: web::Path<String>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     drop(name);
 
@@ -80,6 +120,7 @@ pub(crate) async fn product_by_name(
 
     match Product::from_name(&app, name).await? {
         Some(product) => Ok(HttpResponse::Ok().json(product)),
+
         None => Ok(HttpResponse::NotFound().finish()),
     }
 }
@@ -87,11 +128,26 @@ pub(crate) async fn product_by_name(
 /// Get Product suggestion by name
 #[utoipa::path(
     responses(
-        (status = OK, description = "Product suggestions found from database", body = Vec<Product>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Product suggestions found from database",
+            body = Vec<Product>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("name" = String, description = "Partial name of a product" ),
+        (
+            "name" = String,
+            description = "Partial name of a product"
+        ),
     )
 )]
 #[get("/product/by-part-name/{name}")]
@@ -99,6 +155,7 @@ pub(crate) async fn product_suggestion_by_name(
     app: web::Data<App>,
     req: HttpRequest,
     name: web::Path<String>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     drop(name);
 
@@ -122,12 +179,27 @@ pub(crate) async fn product_suggestion_by_name(
 /// Return all registered products
 #[utoipa::path(
     responses(
-        (status = OK, description = "All products found", body = Vec<Product>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "All products found",
+            body = Vec<Product>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
 )]
 #[get("/products_registered/")]
-pub(crate) async fn products_registered(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn products_registered(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
     let all = Product::get_all(&app).await?;
 
     Ok(HttpResponse::Ok().json(all))
@@ -136,12 +208,27 @@ pub(crate) async fn products_registered(app: web::Data<App>) -> Result<impl Resp
 /// Return all products, which non-null amount in storage
 #[utoipa::path(
     responses(
-        (status = OK, description = "All products found", body = Vec<Product>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "All products found",
+            body = Vec<Product>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
 )]
 #[get("/products_in_storage/")]
-pub(crate) async fn products_in_storage(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn products_in_storage(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
     let all = Product::get_all(&app).await?;
 
     let mut output_products = Vec::with_capacity(all.len());
@@ -161,18 +248,37 @@ pub(crate) async fn products_in_storage(app: web::Data<App>) -> Result<impl Resp
 /// This will also return all products below this product parent id
 #[utoipa::path(
     responses(
-        (status = OK, description = "Products found from database", body = Vec<Product>),
-        (status = NOT_FOUND, description = "Product parent id not found in database"),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Products found from database",
+            body = Vec<Product>
+        ),
+        (
+            status = NOT_FOUND,
+            description = "Product parent id not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("id" = ProductParentId, description = "Product parent id" ),
+        (
+            "id" = ProductParentId,
+            description = "Product parent id"
+        ),
     )
 )]
 #[get("/product/by-product-parent-id-indirect/{id}")]
 pub(crate) async fn products_by_product_parent_id_indirect(
     app: web::Data<App>,
     id: web::Path<ProductParentIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
@@ -208,18 +314,37 @@ pub(crate) async fn products_by_product_parent_id_indirect(
 /// This will only return products directly associated with this product parent id
 #[utoipa::path(
     responses(
-        (status = OK, description = "Products found from database", body = Vec<Product>),
-        (status = NOT_FOUND, description = "Product parent id not found in database"),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Products found from database",
+            body = Vec<Product>
+        ),
+        (
+            status = NOT_FOUND,
+            description = "Product parent id not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("id" = ProductParentId, description = "Product parent id" ),
+        (
+            "id" = ProductParentId,
+            description = "Product parent id"
+        ),
     )
 )]
 #[get("/product/by-product-parent-id-direct/{id}")]
 pub(crate) async fn products_by_product_parent_id_direct(
     app: web::Data<App>,
     id: web::Path<ProductParentIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
diff --git a/crates/rocie-server/src/api/get/auth/product_parent.rs b/crates/rocie-server/src/api/get/auth/product_parent.rs
new file mode 100644
index 0000000..6c3351d
--- /dev/null
+++ b/crates/rocie-server/src/api/get/auth/product_parent.rs
@@ -0,0 +1,111 @@
+use actix_identity::Identity;
+use actix_web::{HttpResponse, Responder, error::Result, get, web};
+
+use crate::{
+    app::App,
+    storage::sql::product_parent::{ProductParent, ProductParentId, ProductParentIdStub},
+};
+
+/// Return all registered product parents
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "All parents found",
+            body = Vec<ProductParent>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+)]
+#[get("/product_parents/")]
+pub(crate) async fn product_parents(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
+    let all: Vec<ProductParent> = ProductParent::get_all(&app).await?;
+
+    Ok(HttpResponse::Ok().json(all))
+}
+
+/// Return all registered product parents, that have no parents themselves
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "All parents found",
+            body = Vec<ProductParent>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+)]
+#[get("/product_parents_toplevel/")]
+pub(crate) async fn product_parents_toplevel(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
+    let all: Vec<ProductParent> = ProductParent::get_all(&app)
+        .await?
+        .into_iter()
+        .filter(|parent| parent.parent.is_none())
+        .collect();
+
+    Ok(HttpResponse::Ok().json(all))
+}
+
+/// Return all parents, that have this parent as parent
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "All parents found",
+            body = Vec<ProductParent>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+    params(
+        (
+            "id" = ProductParentId,
+            description = "Product parent id"
+        ),
+    ),
+)]
+#[get("/product_parents_under/{id}")]
+pub(crate) async fn product_parents_under(
+    app: web::Data<App>,
+    id: web::Path<ProductParentIdStub>,
+    _user: Identity,
+) -> Result<impl Responder> {
+    let id = id.into_inner().into();
+
+    let all: Vec<_> = ProductParent::get_all(&app)
+        .await?
+        .into_iter()
+        .filter(|parent| parent.parent.is_some_and(|found| found == id))
+        .collect();
+
+    Ok(HttpResponse::Ok().json(all))
+}
diff --git a/crates/rocie-server/src/api/get/recipe.rs b/crates/rocie-server/src/api/get/auth/recipe.rs
index 70bab39..cb80597 100644
--- a/crates/rocie-server/src/api/get/recipe.rs
+++ b/crates/rocie-server/src/api/get/auth/recipe.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, error::Result, get, web};
 
 use crate::{
@@ -14,6 +15,10 @@ use crate::{
             body = Recipe,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = NOT_FOUND,
             description = "Recipe not found in database"
         ),
@@ -34,6 +39,7 @@ use crate::{
 pub(crate) async fn recipe_by_id(
     app: web::Data<App>,
     id: web::Path<RecipeIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
@@ -52,6 +58,10 @@ pub(crate) async fn recipe_by_id(
             body = Recipe,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -59,7 +69,7 @@ pub(crate) async fn recipe_by_id(
     ),
 )]
 #[get("/recipe/all")]
-pub(crate) async fn recipes(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn recipes(app: web::Data<App>, _user: Identity) -> Result<impl Responder> {
     let all = Recipe::get_all(&app).await?;
 
     Ok(HttpResponse::Ok().json(all))
diff --git a/crates/rocie-server/src/api/get/unit.rs b/crates/rocie-server/src/api/get/auth/unit.rs
index caafaa3..980d9c7 100644
--- a/crates/rocie-server/src/api/get/unit.rs
+++ b/crates/rocie-server/src/api/get/auth/unit.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, get, web};
 
 use crate::{
@@ -17,6 +18,10 @@ use crate::{
             body = Vec<Unit>
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -24,7 +29,7 @@ use crate::{
     ),
 )]
 #[get("/units/")]
-pub(crate) async fn units(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn units(app: web::Data<App>, _user: Identity) -> Result<impl Responder> {
     let all = Unit::get_all(&app).await?;
 
     Ok(HttpResponse::Ok().json(all))
@@ -39,6 +44,10 @@ pub(crate) async fn units(app: web::Data<App>) -> Result<impl Responder> {
             body = Vec<Unit>
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -55,6 +64,7 @@ pub(crate) async fn units(app: web::Data<App>) -> Result<impl Responder> {
 pub(crate) async fn units_by_property_id(
     app: web::Data<App>,
     id: web::Path<UnitPropertyIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
     let all = Unit::get_all(&app)
@@ -75,6 +85,10 @@ pub(crate) async fn units_by_property_id(
             body = Unit
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = NOT_FOUND,
             description = "Unit not found in database"
         ),
@@ -95,6 +109,7 @@ pub(crate) async fn units_by_property_id(
 pub(crate) async fn unit_by_id(
     app: web::Data<App>,
     id: web::Path<UnitIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
diff --git a/crates/rocie-server/src/api/get/unit_property.rs b/crates/rocie-server/src/api/get/auth/unit_property.rs
index 3160480..f5b070a 100644
--- a/crates/rocie-server/src/api/get/unit_property.rs
+++ b/crates/rocie-server/src/api/get/auth/unit_property.rs
@@ -1,10 +1,9 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, get, web};
 
 use crate::{
     app::App,
-    storage::sql::{
-        unit_property::{UnitProperty, UnitPropertyId, UnitPropertyIdStub},
-    },
+    storage::sql::unit_property::{UnitProperty, UnitPropertyId, UnitPropertyIdStub},
 };
 
 /// Return all registered unit properties
@@ -16,6 +15,10 @@ use crate::{
             body = Vec<UnitProperty>
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -23,7 +26,10 @@ use crate::{
     ),
 )]
 #[get("/unit-properties/")]
-pub(crate) async fn unit_properties(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn unit_properties(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
     let all = UnitProperty::get_all(&app).await?;
 
     Ok(HttpResponse::Ok().json(all))
@@ -42,6 +48,10 @@ pub(crate) async fn unit_properties(app: web::Data<App>) -> Result<impl Responde
             description = "Unit Property not found in database"
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -58,6 +68,7 @@ pub(crate) async fn unit_properties(app: web::Data<App>) -> Result<impl Responde
 pub(crate) async fn unit_property_by_id(
     app: web::Data<App>,
     id: web::Path<UnitPropertyIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
diff --git a/crates/rocie-server/src/api/get/auth/user.rs b/crates/rocie-server/src/api/get/auth/user.rs
new file mode 100644
index 0000000..e4a5046
--- /dev/null
+++ b/crates/rocie-server/src/api/get/auth/user.rs
@@ -0,0 +1,85 @@
+use actix_identity::Identity;
+use actix_web::{HttpResponse, Responder, Result, get, web};
+
+use crate::{
+    app::App,
+    storage::sql::user::{User, UserId, UserIdStub},
+};
+
+/// Get all registered users.
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "Users found in database and fetched",
+            body = Vec<User>,
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+)]
+#[get("/users")]
+async fn users(app: web::Data<App>, _user: Identity) -> Result<impl Responder> {
+    let output = User::get_all(&app).await?;
+
+    Ok(HttpResponse::Ok().json(output))
+}
+
+/// Get an specific user by id.
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "User found in database and fetched",
+            body = User,
+        ),
+        (
+            status = NOT_FOUND,
+            description = "User not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = FORBIDDEN,
+            description = "The current logged in user is not allowed to access this end-point."
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+    params(
+        (
+            "id" = UserId,
+            description = "User id"
+        ),
+    )
+)]
+#[get("/user/{id}")]
+async fn user_by_id(
+    id: web::Path<UserIdStub>,
+    app: web::Data<App>,
+    user: Identity,
+) -> Result<impl Responder> {
+    let id: UserId = id.into_inner().into();
+
+    if user.id().expect("to have one") != id.to_string() {
+        return Ok(HttpResponse::Forbidden()
+            .body("You must be logged-in as the same user, you request the info for."));
+    }
+
+    match User::from_id(&app, id).await? {
+        Some(user) => Ok(HttpResponse::Ok().json(user)),
+        None => Ok(HttpResponse::NotFound().finish()),
+    }
+}
diff --git a/crates/rocie-server/src/api/get/mod.rs b/crates/rocie-server/src/api/get/mod.rs
index 487b55c..c6ee9ab 100644
--- a/crates/rocie-server/src/api/get/mod.rs
+++ b/crates/rocie-server/src/api/get/mod.rs
@@ -1,29 +1,2 @@
-use actix_web::web;
-
-pub(crate) mod inventory;
-pub(crate) mod product;
-pub(crate) mod product_parent;
-pub(crate) mod recipe;
-pub(crate) mod unit;
-pub(crate) mod unit_property;
-
-pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {
-    cfg.service(product::product_by_id)
-        .service(product::product_by_name)
-        .service(product::product_suggestion_by_name)
-        .service(product::products_registered)
-        .service(product::products_in_storage)
-        .service(product::products_by_product_parent_id_indirect)
-        .service(product::products_by_product_parent_id_direct)
-        .service(product_parent::product_parents)
-        .service(product_parent::product_parents_toplevel)
-        .service(product_parent::product_parents_under)
-        .service(recipe::recipe_by_id)
-        .service(recipe::recipes)
-        .service(unit::units)
-        .service(unit::units_by_property_id)
-        .service(unit::unit_by_id)
-        .service(unit_property::unit_properties)
-        .service(unit_property::unit_property_by_id)
-        .service(inventory::amount_by_id);
-}
+pub(crate) mod auth;
+pub(crate) mod no_auth;
diff --git a/crates/rocie-server/src/api/get/no_auth/mod.rs b/crates/rocie-server/src/api/get/no_auth/mod.rs
new file mode 100644
index 0000000..38a041c
--- /dev/null
+++ b/crates/rocie-server/src/api/get/no_auth/mod.rs
@@ -0,0 +1,3 @@
+use actix_web::web;
+
+pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {}
diff --git a/crates/rocie-server/src/api/get/product_parent.rs b/crates/rocie-server/src/api/get/product_parent.rs
deleted file mode 100644
index a62397c..0000000
--- a/crates/rocie-server/src/api/get/product_parent.rs
+++ /dev/null
@@ -1,64 +0,0 @@
-use actix_web::{HttpResponse, Responder, error::Result, get, web};
-
-use crate::{
-    app::App,
-    storage::sql::product_parent::{ProductParent, ProductParentId, ProductParentIdStub},
-};
-
-/// Return all registered product parents
-#[utoipa::path(
-    responses(
-        (status = OK, description = "All parents found", body = Vec<ProductParent>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
-    ),
-)]
-#[get("/product_parents/")]
-pub(crate) async fn product_parents(app: web::Data<App>) -> Result<impl Responder> {
-    let all: Vec<ProductParent> = ProductParent::get_all(&app).await?;
-
-    Ok(HttpResponse::Ok().json(all))
-}
-
-/// Return all registered product parents, that have no parents themselves
-#[utoipa::path(
-    responses(
-        (status = OK, description = "All parents found", body = Vec<ProductParent>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
-    ),
-)]
-#[get("/product_parents_toplevel/")]
-pub(crate) async fn product_parents_toplevel(app: web::Data<App>) -> Result<impl Responder> {
-    let all: Vec<ProductParent> = ProductParent::get_all(&app)
-        .await?
-        .into_iter()
-        .filter(|parent| parent.parent.is_none())
-        .collect();
-
-    Ok(HttpResponse::Ok().json(all))
-}
-
-/// Return all parents, that have this parent as parent
-#[utoipa::path(
-    responses(
-        (status = OK, description = "All parents found", body = Vec<ProductParent>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
-    ),
-    params(
-        ("id" = ProductParentId, description = "Product parent id" ),
-    ),
-)]
-#[get("/product_parents_under/{id}")]
-pub(crate) async fn product_parents_under(
-    app: web::Data<App>,
-    id: web::Path<ProductParentIdStub>,
-) -> Result<impl Responder> {
-    let id = id.into_inner().into();
-
-    let all: Vec<_> = ProductParent::get_all(&app)
-        .await?
-        .into_iter()
-        .filter(|parent| parent.parent.is_some_and(|found| found == id))
-        .collect();
-
-    Ok(HttpResponse::Ok().json(all))
-}
diff --git a/crates/rocie-server/src/api/set/barcode.rs b/crates/rocie-server/src/api/set/auth/barcode.rs
index bb84bbf..1d97852 100644
--- a/crates/rocie-server/src/api/set/barcode.rs
+++ b/crates/rocie-server/src/api/set/auth/barcode.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, post, web};
 use log::debug;
 
@@ -22,20 +23,31 @@ use crate::{
             description = "Barcode id was not found",
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String,
         )
     ),
     params(
-        ("barcode_id" = BarcodeId, description = "The numeric value of the barcode"),
-        ("times" = u16, description = "How often to buy the barcode"),
+        (
+            "barcode_id" = BarcodeId,
+            description = "The numeric value of the barcode"
+        ),
+        (
+            "times" = u16,
+            description = "How often to buy the barcode"
+        ),
     )
 )]
 #[post("/barcode/{barcode_id}/buy/{times}")]
 pub(crate) async fn buy_barcode(
     app: web::Data<App>,
     path: web::Path<(BarcodeIdStub, u16)>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let (barcode_id, times) = path.into_inner();
 
@@ -69,13 +81,20 @@ pub(crate) async fn buy_barcode(
             description = "Barcode id was not found",
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String,
         )
     ),
     params(
-        ("id" = BarcodeId, description = "The numeric value of the barcode"),
+        (
+            "id" = BarcodeId,
+            description = "The numeric value of the barcode"
+        ),
     ),
     request_body = UnitAmount,
 )]
@@ -84,6 +103,7 @@ pub(crate) async fn consume_barcode(
     app: web::Data<App>,
     barcode_id: web::Path<BarcodeIdStub>,
     unit_amount: web::Json<UnitAmount>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let mut ops = Operations::new("consume barcode unit");
 
diff --git a/crates/rocie-server/src/api/set/auth/mod.rs b/crates/rocie-server/src/api/set/auth/mod.rs
new file mode 100644
index 0000000..4e733a9
--- /dev/null
+++ b/crates/rocie-server/src/api/set/auth/mod.rs
@@ -0,0 +1,21 @@
+use actix_web::web;
+
+pub(crate) mod barcode;
+pub(crate) mod product;
+pub(crate) mod product_parent;
+pub(crate) mod recipe;
+pub(crate) mod unit;
+pub(crate) mod unit_property;
+pub(crate) mod user;
+
+pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {
+    cfg.service(product::register_product)
+        .service(product::associate_barcode)
+        .service(product_parent::register_product_parent)
+        .service(recipe::add_recipe)
+        .service(unit::register_unit)
+        .service(unit_property::register_unit_property)
+        .service(barcode::consume_barcode)
+        .service(barcode::buy_barcode)
+        .service(user::register_user);
+}
diff --git a/crates/rocie-server/src/api/set/product.rs b/crates/rocie-server/src/api/set/auth/product.rs
index 74a92d2..b2a751f 100644
--- a/crates/rocie-server/src/api/set/product.rs
+++ b/crates/rocie-server/src/api/set/auth/product.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, post, web};
 use serde::Deserialize;
 use utoipa::ToSchema;
@@ -40,6 +41,10 @@ struct ProductStub {
             body = ProductId,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String,
@@ -51,13 +56,15 @@ struct ProductStub {
 pub(crate) async fn register_product(
     app: web::Data<App>,
     product_stub: web::Json<ProductStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
+    let product_stub = product_stub.into_inner();
     let mut ops = Operations::new("register product");
 
     let product = Product::register(
-        product_stub.name.clone(),
-        product_stub.description.clone(),
-        product_stub.parent.into(),
+        product_stub.name,
+        product_stub.description,
+        product_stub.parent,
         product_stub.unit_property,
         &mut ops,
     );
@@ -79,7 +86,11 @@ pub(crate) async fn register_product(
             description = "Product id not found in database",
         ),
         (
-            status = FORBIDDEN,
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = BAD_REQUEST,
             description = "Unit used in request has not been registered yet",
             body = String,
         ),
@@ -102,13 +113,14 @@ pub(crate) async fn associate_barcode(
     app: web::Data<App>,
     id: web::Path<ProductIdStub>,
     barcode: web::Json<Barcode>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let mut ops = Operations::new("associated barcode with product");
 
     {
         let units = Unit::get_all(&app).await?;
         if !units.into_iter().any(|unit| unit.id == barcode.amount.unit) {
-            return Ok(HttpResponse::Forbidden()
+            return Ok(HttpResponse::BadRequest()
                 .body("The used unit has not been registered; it cannot be used.\n"));
         }
     }
diff --git a/crates/rocie-server/src/api/set/product_parent.rs b/crates/rocie-server/src/api/set/auth/product_parent.rs
index f917207..416875b 100644
--- a/crates/rocie-server/src/api/set/product_parent.rs
+++ b/crates/rocie-server/src/api/set/auth/product_parent.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, post, web};
 use serde::Deserialize;
 use utoipa::ToSchema;
@@ -28,11 +29,15 @@ struct ProductParentStub {
 #[utoipa::path(
     responses(
         (
-            status = 200,
+            status = OK,
             description = "Product parent successfully registered in database",
             body = ProductParentId,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String,
@@ -44,13 +49,15 @@ struct ProductParentStub {
 pub(crate) async fn register_product_parent(
     app: web::Data<App>,
     product_stub: web::Json<ProductParentStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
+    let product_stub = product_stub.into_inner();
     let mut ops = Operations::new("register product parent");
 
     let product = ProductParent::register(
-        product_stub.name.clone(),
-        product_stub.description.clone(),
-        product_stub.parent.into(),
+        product_stub.name,
+        product_stub.description,
+        product_stub.parent,
         &mut ops,
     );
 
diff --git a/crates/rocie-server/src/api/set/recipe.rs b/crates/rocie-server/src/api/set/auth/recipe.rs
index bb5be37..43a034e 100644
--- a/crates/rocie-server/src/api/set/recipe.rs
+++ b/crates/rocie-server/src/api/set/auth/recipe.rs
@@ -1,5 +1,6 @@
 use std::path::PathBuf;
 
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, error::Result, post, web};
 use serde::Deserialize;
 use utoipa::ToSchema;
@@ -26,11 +27,15 @@ struct RecipeStub {
 #[utoipa::path(
     responses(
         (
-            status = 200,
+            status = OK,
             description = "Product parent successfully registered in database",
             body = RecipeId,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String,
@@ -42,6 +47,7 @@ struct RecipeStub {
 pub(crate) async fn add_recipe(
     app: web::Data<App>,
     stub: web::Json<RecipeStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let stub = stub.into_inner();
     let mut ops = Operations::new("add recipe parent");
diff --git a/crates/rocie-server/src/api/set/unit.rs b/crates/rocie-server/src/api/set/auth/unit.rs
index 1671918..21d1e11 100644
--- a/crates/rocie-server/src/api/set/unit.rs
+++ b/crates/rocie-server/src/api/set/auth/unit.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, post, web};
 use serde::Deserialize;
 use utoipa::ToSchema;
@@ -26,11 +27,15 @@ struct UnitStub {
 #[utoipa::path(
     responses(
         (
-            status = 200,
+            status = OK,
             description = "Unit successfully registered in database",
             body = UnitId,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String,
@@ -42,14 +47,16 @@ struct UnitStub {
 pub(crate) async fn register_unit(
     app: web::Data<App>,
     unit: web::Json<UnitStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
+    let unit = unit.into_inner();
     let mut ops = Operations::new("register unit");
 
     let unit = Unit::register(
-        unit.full_name_singular.clone(),
-        unit.full_name_plural.clone(),
-        unit.short_name.clone(),
-        unit.description.clone(),
+        unit.full_name_singular,
+        unit.full_name_plural,
+        unit.short_name,
+        unit.description,
         unit.unit_property,
         &mut ops,
     );
diff --git a/crates/rocie-server/src/api/set/unit_property.rs b/crates/rocie-server/src/api/set/auth/unit_property.rs
index ca2960f..2958e1f 100644
--- a/crates/rocie-server/src/api/set/unit_property.rs
+++ b/crates/rocie-server/src/api/set/auth/unit_property.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, post, web};
 use serde::Deserialize;
 use utoipa::ToSchema;
@@ -24,11 +25,15 @@ struct UnitPropertyStub {
 #[utoipa::path(
     responses(
         (
-            status = 200,
+            status = OK,
             description = "Unit property successfully registered in database",
             body = UnitPropertyId,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String,
@@ -40,6 +45,7 @@ struct UnitPropertyStub {
 pub(crate) async fn register_unit_property(
     app: web::Data<App>,
     unit: web::Json<UnitPropertyStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let mut ops = Operations::new("register unit property");
 
diff --git a/crates/rocie-server/src/api/set/auth/user.rs b/crates/rocie-server/src/api/set/auth/user.rs
new file mode 100644
index 0000000..1f262d5
--- /dev/null
+++ b/crates/rocie-server/src/api/set/auth/user.rs
@@ -0,0 +1,63 @@
+use actix_identity::Identity;
+use actix_web::{HttpResponse, Responder, Result, post, web};
+use serde::Deserialize;
+use utoipa::ToSchema;
+
+use crate::{
+    app::App,
+    storage::sql::{
+        insert::Operations,
+        user::{PasswordHash, User, UserId},
+    },
+};
+
+#[derive(Deserialize, ToSchema)]
+pub(crate) struct UserStub {
+    /// The name of the new user.
+    pub(crate) name: String,
+
+    /// The password of the new user.
+    pub(crate) password: String,
+
+    /// An optional description of the new user.
+    #[schema(nullable = false)]
+    pub(crate) description: Option<String>,
+}
+
+/// Register an new User
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "User successfully registered in database",
+            body = UserId,
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String,
+        )
+    ),
+    request_body = UserStub,
+)]
+#[post("/user/new")]
+pub(crate) async fn register_user(
+    app: web::Data<App>,
+    new_user: web::Json<UserStub>,
+    _user: Identity,
+) -> Result<impl Responder> {
+    let user = new_user.into_inner();
+
+    let mut ops = Operations::new("register user");
+
+    let password_hash = PasswordHash::from_password(&user.password);
+    let user = User::register(user.name, password_hash, user.description, &mut ops);
+
+    ops.apply(&app).await?;
+
+    Ok(HttpResponse::Ok().json(user.id))
+}
diff --git a/crates/rocie-server/src/api/set/mod.rs b/crates/rocie-server/src/api/set/mod.rs
index a6037b9..c6ee9ab 100644
--- a/crates/rocie-server/src/api/set/mod.rs
+++ b/crates/rocie-server/src/api/set/mod.rs
@@ -1,19 +1,2 @@
-use actix_web::web;
-
-pub(crate) mod barcode;
-pub(crate) mod product;
-pub(crate) mod product_parent;
-pub(crate) mod recipe;
-pub(crate) mod unit;
-pub(crate) mod unit_property;
-
-pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {
-    cfg.service(product::register_product)
-        .service(product::associate_barcode)
-        .service(product_parent::register_product_parent)
-        .service(recipe::add_recipe)
-        .service(unit::register_unit)
-        .service(unit_property::register_unit_property)
-        .service(barcode::consume_barcode)
-        .service(barcode::buy_barcode);
-}
+pub(crate) mod auth;
+pub(crate) mod no_auth;
diff --git a/crates/rocie-server/src/api/set/no_auth/mod.rs b/crates/rocie-server/src/api/set/no_auth/mod.rs
new file mode 100644
index 0000000..27783fc
--- /dev/null
+++ b/crates/rocie-server/src/api/set/no_auth/mod.rs
@@ -0,0 +1,7 @@
+use actix_web::web;
+
+pub(crate) mod user;
+
+pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {
+    cfg.service(user::login).service(user::logout).service(user::provision);
+}
diff --git a/crates/rocie-server/src/api/set/no_auth/user.rs b/crates/rocie-server/src/api/set/no_auth/user.rs
new file mode 100644
index 0000000..7acb482
--- /dev/null
+++ b/crates/rocie-server/src/api/set/no_auth/user.rs
@@ -0,0 +1,131 @@
+use actix_identity::Identity;
+use actix_web::{HttpMessage, HttpRequest, HttpResponse, Responder, Result, post, web};
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+
+use crate::{
+    api::set::auth::user::UserStub,
+    app::App,
+    storage::sql::{
+        insert::Operations,
+        user::{PasswordHash, User, UserId},
+    },
+};
+
+#[derive(ToSchema, Deserialize, Serialize)]
+struct LoginInfo {
+    /// The id of the user.
+    id: UserId,
+
+    /// The password of the user.
+    password: String,
+}
+
+/// Log in as a specific user
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "User logged in",
+        ),
+        (
+            status = NOT_FOUND,
+            description = "User id not found"
+        ),
+        (
+            status = FORBIDDEN,
+            description = "Password did not match"
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+    request_body = LoginInfo,
+)]
+#[post("/login")]
+async fn login(
+    request: HttpRequest,
+    app: web::Data<App>,
+    info: web::Json<LoginInfo>,
+) -> Result<impl Responder> {
+    let info = info.into_inner();
+
+    if let Some(user) = User::from_id(&app, info.id).await? {
+        if user.password_hash.verify(&info.password) {
+            Identity::login(&request.extensions(), info.id.to_string())?;
+            Ok(HttpResponse::Ok().finish())
+        } else {
+            Ok(HttpResponse::Forbidden().finish())
+        }
+    } else {
+        Ok(HttpResponse::NotFound().finish())
+    }
+}
+
+/// Log the current user out
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "User logged out",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+)]
+#[post("/logout")]
+async fn logout(user: Identity) -> impl Responder {
+    user.logout();
+    HttpResponse::Ok()
+}
+
+/// Provision this instance.
+///
+/// This only works, if no users exist yet.
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "User created and logged in",
+            body = UserId,
+        ),
+        (
+            status = FORBIDDEN,
+            description = "Instance already provisioned",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+    request_body = UserStub,
+)]
+#[post("/provision")]
+async fn provision(
+    request: HttpRequest,
+    app: web::Data<App>,
+    new_user: web::Json<UserStub>,
+) -> Result<impl Responder> {
+    if User::get_all(&app).await?.is_empty() {
+        let user = new_user.into_inner();
+
+        let mut ops = Operations::new("register user (during provisioning)");
+
+        let password_hash = PasswordHash::from_password(&user.password);
+        let user = User::register(user.name, password_hash, user.description, &mut ops);
+
+        ops.apply(&app).await?;
+
+        Identity::login(&request.extensions(), user.id.to_string())?;
+
+        Ok(HttpResponse::Ok().json(user.id))
+    } else {
+        Ok(HttpResponse::Forbidden().finish())
+    }
+}
diff --git a/crates/rocie-server/src/cli.rs b/crates/rocie-server/src/cli.rs
index 80b4292..01c4199 100644
--- a/crates/rocie-server/src/cli.rs
+++ b/crates/rocie-server/src/cli.rs
@@ -20,7 +20,7 @@ pub(crate) enum Command {
 
         /// Print the used port as single u16 to stdout when started.
         ///
-        /// This can be used, to determine the used port, when the `port` was left at `None`.
+        /// This can be used to determine the used port, when the `port` was left at `None`.
         #[arg(long)]
         print_port: bool,
 
diff --git a/crates/rocie-server/src/main.rs b/crates/rocie-server/src/main.rs
index dc5be0b..caa210d 100644
--- a/crates/rocie-server/src/main.rs
+++ b/crates/rocie-server/src/main.rs
@@ -26,39 +26,42 @@ use actix_session::{SessionMiddleware, storage::CookieSessionStore};
 async fn main() -> Result<(), std::io::Error> {
     #[derive(OpenApi)]
     #[openapi(
-    paths(
-            api::get::product::product_by_id,
-            api::get::product::product_by_name,
-            api::get::product::product_suggestion_by_name,
-            api::get::product::products_registered,
-            api::get::product::products_in_storage,
-            api::get::product::products_by_product_parent_id_indirect,
-            api::get::product::products_by_product_parent_id_direct,
-            api::get::product_parent::product_parents,
-            api::get::product_parent::product_parents_toplevel,
-            api::get::product_parent::product_parents_under,
-            api::get::recipe::recipe_by_id,
-            api::get::recipe::recipes,
-            api::get::unit::units,
-            api::get::unit::units_by_property_id,
-            api::get::unit::unit_by_id,
-            api::get::unit_property::unit_property_by_id,
-            api::get::unit_property::unit_properties,
-            api::get::inventory::amount_by_id,
-            api::set::product::register_product,
-            api::set::product::associate_barcode,
-            api::set::product_parent::register_product_parent,
-            api::set::recipe::add_recipe,
-            api::set::unit::register_unit,
-            api::set::unit_property::register_unit_property,
-            api::set::barcode::buy_barcode,
-            api::set::barcode::consume_barcode,
+        paths(
+            api::get::auth::product::product_by_id,
+            api::get::auth::product::product_by_name,
+            api::get::auth::product::product_suggestion_by_name,
+            api::get::auth::product::products_registered,
+            api::get::auth::product::products_in_storage,
+            api::get::auth::product::products_by_product_parent_id_indirect,
+            api::get::auth::product::products_by_product_parent_id_direct,
+            api::get::auth::product_parent::product_parents,
+            api::get::auth::product_parent::product_parents_toplevel,
+            api::get::auth::product_parent::product_parents_under,
+            api::get::auth::recipe::recipe_by_id,
+            api::get::auth::recipe::recipes,
+            api::get::auth::unit::units,
+            api::get::auth::unit::units_by_property_id,
+            api::get::auth::unit::unit_by_id,
+            api::get::auth::unit_property::unit_property_by_id,
+            api::get::auth::unit_property::unit_properties,
+            api::get::auth::inventory::amount_by_id,
+            api::get::auth::user::users,
+            api::get::auth::user::user_by_id,
+            //
+            api::set::auth::product::register_product,
+            api::set::auth::product::associate_barcode,
+            api::set::auth::product_parent::register_product_parent,
+            api::set::auth::recipe::add_recipe,
+            api::set::auth::unit::register_unit,
+            api::set::auth::unit_property::register_unit_property,
+            api::set::auth::barcode::buy_barcode,
+            api::set::auth::barcode::consume_barcode,
+            api::set::auth::user::register_user,
+            //
+            api::set::no_auth::user::login,
+            api::set::no_auth::user::logout,
+            api::set::no_auth::user::provision,
         ),
-    // security(
-    //     (),
-    //     ("my_auth" = ["read:items", "edit:items"]),
-    //     ("token_jwt" = [])
-    // ),
     )]
     struct ApiDoc;
 
@@ -67,6 +70,7 @@ async fn main() -> Result<(), std::io::Error> {
     // When using `Key::generate()` it is important to initialize outside of the
     // `HttpServer::new` closure. When deployed the secret key should be read from a
     // configuration file or environment variables.
+    // TODO: Load from a config file. <2025-12-07>
     let secret_key = Key::generate();
 
     let args = CliArgs::parse();
@@ -91,7 +95,7 @@ async fn main() -> Result<(), std::io::Error> {
                     .wrap(Logger::new(
                         r#"%a "%r" -> %s %b ("%{Referer}i" "%{User-Agent}i" %T s)"#,
                     ))
-                    // Install the identity framework before middle-ware (as actix is filo).
+                    // Install the identity framework before middleware (as actix uses FILO).
                     .wrap(IdentityMiddleware::default())
                     .wrap(
                         SessionMiddleware::builder(
@@ -104,8 +108,10 @@ async fn main() -> Result<(), std::io::Error> {
                         .build(),
                     )
                     .app_data(Data::clone(&data))
-                    .configure(api::get::register_paths)
-                    .configure(api::set::register_paths)
+                    .configure(api::get::auth::register_paths)
+                    .configure(api::get::no_auth::register_paths)
+                    .configure(api::set::auth::register_paths)
+                    .configure(api::set::no_auth::register_paths)
             })
             .bind((host, port.unwrap_or(0)))?;
 
@@ -121,6 +127,7 @@ async fn main() -> Result<(), std::io::Error> {
         }
         Command::OpenApi => {
             let openapi = ApiDoc::openapi();
+
             println!("{}", openapi.to_pretty_json().expect("Comp-time constant"));
             Ok(())
         }
diff --git a/crates/rocie-server/src/storage/migrate/sql/0->1.sql b/crates/rocie-server/src/storage/migrate/sql/0->1.sql
index 664f40f..e3dd879 100644
--- a/crates/rocie-server/src/storage/migrate/sql/0->1.sql
+++ b/crates/rocie-server/src/storage/migrate/sql/0->1.sql
@@ -27,6 +27,14 @@ CREATE TABLE parents (
     FOREIGN KEY(parent) REFERENCES parents(id)
 ) STRICT;
 
+-- Stores the registered users.
+CREATE TABLE users (
+    id                          TEXT UNIQUE NOT NULL PRIMARY KEY,
+    name                        TEXT UNIQUE NOT NULL,
+    password_hash               TEXT        NOT NULL,
+    description                 TEXT
+) STRICT;
+
 -- Record with barcodes were bought, and how much of this buy is already used up.
 CREATE TABLE buys (
     buy_id              TEXT    UNIQUE NOT NULL PRIMARY KEY,
diff --git a/crates/rocie-server/src/storage/sql/get/mod.rs b/crates/rocie-server/src/storage/sql/get/mod.rs
index 1fb54b0..92b34aa 100644
--- a/crates/rocie-server/src/storage/sql/get/mod.rs
+++ b/crates/rocie-server/src/storage/sql/get/mod.rs
@@ -1,7 +1,8 @@
+pub(crate) mod barcode;
 pub(crate) mod product;
-pub(crate) mod product_parent;
 pub(crate) mod product_amount;
+pub(crate) mod product_parent;
+pub(crate) mod recipe;
 pub(crate) mod unit;
 pub(crate) mod unit_property;
-pub(crate) mod barcode;
-pub(crate) mod recipe;
+pub(crate) mod user;
diff --git a/crates/rocie-server/src/storage/sql/get/user/mod.rs b/crates/rocie-server/src/storage/sql/get/user/mod.rs
new file mode 100644
index 0000000..e36c6cf
--- /dev/null
+++ b/crates/rocie-server/src/storage/sql/get/user/mod.rs
@@ -0,0 +1,77 @@
+use crate::{
+    app::App,
+    storage::sql::user::{PasswordHash, User, UserId},
+};
+
+use sqlx::query;
+
+impl User {
+    pub(crate) async fn get_all(app: &App) -> Result<Vec<Self>, get_all::Error> {
+        let records = query!(
+            "
+        SELECT id, name, password_hash, description
+        FROM users
+"
+        )
+        .fetch_all(&app.db)
+        .await?;
+
+        Ok(records
+            .into_iter()
+            .map(|record| Self {
+                id: UserId::from_db(&record.id),
+                name: record.name,
+                password_hash: PasswordHash::from_db(record.password_hash),
+                description: record.description,
+            })
+            .collect())
+    }
+
+    pub(crate) async fn from_id(app: &App, id: UserId) -> Result<Option<Self>, from_id::Error> {
+        let record = query!(
+            "
+        SELECT name, password_hash, description
+        FROM users
+        WHERE id = ?
+",
+            id
+        )
+        .fetch_optional(&app.db)
+        .await?;
+
+        if let Some(record) = record {
+            Ok(Some(Self {
+                name: record.name,
+                description: record.description,
+                id,
+                password_hash: PasswordHash::from_db(record.password_hash),
+            }))
+        } else {
+            Ok(None)
+        }
+    }
+}
+
+pub(crate) mod get_all {
+    use actix_web::ResponseError;
+
+    #[derive(thiserror::Error, Debug)]
+    pub(crate) enum Error {
+        #[error("Failed to execute the sql query")]
+        SqlError(#[from] sqlx::Error),
+    }
+
+    impl ResponseError for Error {}
+}
+
+pub(crate) mod from_id {
+    use actix_web::ResponseError;
+
+    #[derive(thiserror::Error, Debug)]
+    pub(crate) enum Error {
+        #[error("Failed to execute the sql query")]
+        SqlError(#[from] sqlx::Error),
+    }
+
+    impl ResponseError for Error {}
+}
diff --git a/crates/rocie-server/src/storage/sql/insert/mod.rs b/crates/rocie-server/src/storage/sql/insert/mod.rs
index 8a15385..54717c3 100644
--- a/crates/rocie-server/src/storage/sql/insert/mod.rs
+++ b/crates/rocie-server/src/storage/sql/insert/mod.rs
@@ -13,6 +13,7 @@ pub(crate) mod product_parent;
 pub(crate) mod unit;
 pub(crate) mod unit_property;
 pub(crate) mod recipe;
+pub(crate) mod user;
 
 pub(crate) trait Transactionable:
     Sized + std::fmt::Debug + Serialize + DeserializeOwned
diff --git a/crates/rocie-server/src/storage/sql/insert/user/mod.rs b/crates/rocie-server/src/storage/sql/insert/user/mod.rs
new file mode 100644
index 0000000..325253e
--- /dev/null
+++ b/crates/rocie-server/src/storage/sql/insert/user/mod.rs
@@ -0,0 +1,117 @@
+use serde::{Deserialize, Serialize};
+use sqlx::query;
+use uuid::Uuid;
+
+use crate::storage::sql::{
+    insert::{Operations, Transactionable},
+    user::{PasswordHash, User, UserId},
+};
+
+#[derive(Debug, Deserialize, Serialize)]
+pub(crate) enum Operation {
+    RegisterUser {
+        id: UserId,
+        name: String,
+        description: Option<String>,
+        password_hash: PasswordHash,
+    },
+}
+
+impl Transactionable for Operation {
+    type ApplyError = apply::Error;
+    type UndoError = undo::Error;
+
+    async fn apply(self, txn: &mut sqlx::SqliteConnection) -> Result<(), apply::Error> {
+        match self {
+            Operation::RegisterUser {
+                id,
+                name,
+                description,
+                password_hash,
+            } => {
+                let password_hash = password_hash.to_string();
+
+                query!(
+                    "
+                    INSERT INTO users (id, name, password_hash, description)
+                    VALUES (?,?,?,?)
+",
+                    id,
+                    name,
+                    password_hash,
+                    description,
+                )
+                .execute(txn)
+                .await?;
+            }
+        }
+        Ok(())
+    }
+
+    async fn undo(self, txn: &mut sqlx::SqliteConnection) -> Result<(), undo::Error> {
+        match self {
+            Operation::RegisterUser {
+                id,
+                name,
+                description,
+                password_hash,
+            } => {
+                let password_hash = password_hash.to_string();
+
+                query!(
+                    "
+                    DELETE FROM users
+                    WHERE id = ? AND name = ? AND description = ? AND password_hash = ?;
+",
+                    id,
+                    name,
+                    description,
+                    password_hash,
+                )
+                .execute(txn)
+                .await?;
+            }
+        }
+        Ok(())
+    }
+}
+
+pub(crate) mod undo {
+    #[derive(thiserror::Error, Debug)]
+    pub(crate) enum Error {
+        #[error("Failed to execute undo sql statments: {0}")]
+        SqlError(#[from] sqlx::Error),
+    }
+}
+pub(crate) mod apply {
+    #[derive(thiserror::Error, Debug)]
+    pub(crate) enum Error {
+        #[error("Failed to execute apply sql statments: {0}")]
+        SqlError(#[from] sqlx::Error),
+    }
+}
+
+impl User {
+    pub(crate) fn register(
+        name: String,
+        password_hash: PasswordHash,
+        description: Option<String>,
+        ops: &mut Operations<Operation>,
+    ) -> Self {
+        let id = UserId::from(Uuid::new_v4());
+
+        ops.push(Operation::RegisterUser {
+            id,
+            name: name.clone(),
+            description: description.clone(),
+            password_hash: password_hash.clone(),
+        });
+
+        Self {
+            id,
+            name,
+            description,
+            password_hash,
+        }
+    }
+}
diff --git a/crates/rocie-server/src/storage/sql/mod.rs b/crates/rocie-server/src/storage/sql/mod.rs
index dd46eab..315c251 100644
--- a/crates/rocie-server/src/storage/sql/mod.rs
+++ b/crates/rocie-server/src/storage/sql/mod.rs
@@ -9,6 +9,7 @@ pub(crate) mod product_parent;
 pub(crate) mod recipe;
 pub(crate) mod unit;
 pub(crate) mod unit_property;
+pub(crate) mod user;
 
 macro_rules! mk_id {
     ($name:ident and $stub_name:ident) => {
diff --git a/crates/rocie-server/src/storage/sql/user.rs b/crates/rocie-server/src/storage/sql/user.rs
new file mode 100644
index 0000000..2bac555
--- /dev/null
+++ b/crates/rocie-server/src/storage/sql/user.rs
@@ -0,0 +1,86 @@
+use std::fmt::Display;
+
+use argon2::{
+    Argon2, PasswordHasher, PasswordVerifier,
+    password_hash::{SaltString, rand_core::OsRng},
+};
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+
+use crate::storage::sql::mk_id;
+
+/// The definition of an rocie user.
+#[derive(ToSchema, Debug, PartialEq, Eq, PartialOrd, Ord, Clone, Serialize, Deserialize)]
+pub(crate) struct User {
+    /// The unique ID for this user.
+    pub(crate) id: UserId,
+
+    /// The user-displayed name of this user.
+    pub(crate) name: String,
+
+    /// The hash of the user's password.
+    pub(crate) password_hash: PasswordHash,
+
+    /// An description of this user.
+    #[schema(nullable = false)]
+    pub(crate) description: Option<String>,
+}
+
+/// This is stored as an PHC password string.
+///
+/// This type corresponds to the string representation of a PHC string as
+/// described in the [PHC string format specification][1].
+///
+/// PHC strings have the following format:
+///
+/// ```text
+/// $<id>[$v=<version>][$<param>=<value>(,<param>=<value>)*][$<salt>[$<hash>]]
+/// ```
+#[derive(ToSchema, Debug, PartialEq, Eq, PartialOrd, Ord, Clone, Serialize, Deserialize)]
+pub(crate) struct PasswordHash {
+    value: String,
+}
+impl PasswordHash {
+    pub(crate) fn from_db(password_hash: String) -> PasswordHash {
+        Self {
+            value: password_hash,
+        }
+    }
+
+    pub(crate) fn from_password(password: &str) -> Self {
+        let salt = SaltString::generate(&mut OsRng);
+
+        let argon2 = Argon2::default();
+
+        let password_hash = argon2
+            .hash_password(password.as_bytes(), &salt)
+            .expect("to not fail")
+            .to_string();
+
+        Self {
+            value: password_hash,
+        }
+    }
+
+    /// Check that self, and the other password have the same hash.
+    pub(crate) fn verify(&self, other: &str) -> bool {
+        let argon2 = Argon2::default();
+
+        argon2
+            .verify_password(other.as_bytes(), &self.as_argon_hash())
+            .is_ok()
+    }
+
+    fn as_argon_hash(&self) -> argon2::PasswordHash<'_> {
+        argon2::PasswordHash::new(&self.value)
+            .expect("to be valid, as we are just deserializing a previously serialize value")
+    }
+}
+
+impl Display for PasswordHash {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.value.fmt(f)
+    }
+}
+
+mk_id!(UserId and UserIdStub);
diff --git a/crates/rocie-server/tests/_testenv/init.rs b/crates/rocie-server/tests/_testenv/init.rs
index 9cb0b91..5318238 100644
--- a/crates/rocie-server/tests/_testenv/init.rs
+++ b/crates/rocie-server/tests/_testenv/init.rs
@@ -19,9 +19,15 @@ use std::{
     process::{self, Stdio},
 };
 
-use rocie_client::apis::configuration::Configuration;
+use rocie_client::{
+    apis::{api_set_no_auth_user_api::provision, configuration::Configuration},
+    models::{LoginInfo, UserStub},
+};
 
-use crate::{_testenv::Paths, testenv::TestEnv};
+use crate::{
+    _testenv::{Paths, log::request},
+    testenv::TestEnv,
+};
 
 macro_rules! function_name {
     () => {{
@@ -105,7 +111,22 @@ fn rocie_server_args(paths: &Paths) -> [&OsStr; 4] {
 }
 
 impl TestEnv {
-    pub(crate) fn new(name: &'static str) -> TestEnv {
+    pub(crate) async fn new(name: &'static str) -> TestEnv {
+        let env = Self::new_no_login(name);
+
+         request!(
+            env,
+            provision(UserStub {
+                description: Some("Test user, used during test runs".to_string()),
+                name: "rocie".to_string(),
+                password: "server".to_string()
+            })
+        );
+
+        env
+    }
+
+    pub(crate) fn new_no_login(name: &'static str) -> TestEnv {
         let test_dir = test_dir(name);
 
         let paths = prepare_files_and_dirs(&test_dir)
diff --git a/crates/rocie-server/tests/product_parents/query.rs b/crates/rocie-server/tests/product_parents/query.rs
index 6d16ca3..635a0ba 100644
--- a/crates/rocie-server/tests/product_parents/query.rs
+++ b/crates/rocie-server/tests/product_parents/query.rs
@@ -1,10 +1,10 @@
 use rocie_client::{
     apis::{
-        api_get_product_api::{products_by_product_parent_id_direct, products_by_product_parent_id_indirect},
-        api_get_product_parent_api::{product_parents_toplevel, product_parents_under},
-        api_set_product_api::register_product,
-        api_set_product_parent_api::register_product_parent,
-        api_set_unit_property_api::register_unit_property,
+        api_get_auth_product_api::{products_by_product_parent_id_direct, products_by_product_parent_id_indirect},
+        api_get_auth_product_parent_api::{product_parents_toplevel, product_parents_under},
+        api_set_auth_product_api::register_product,
+        api_set_auth_product_parent_api::register_product_parent,
+        api_set_auth_unit_property_api::register_unit_property,
     },
     models::{ProductParentStub, ProductStub, UnitPropertyStub},
 };
@@ -16,7 +16,7 @@ use crate::{
 
 #[tokio::test]
 async fn test_product_parent_query() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let parent_dairy = request!(
         env,
@@ -63,7 +63,7 @@ async fn test_product_parent_query() {
 
 #[tokio::test]
 async fn test_product_parent_query_product() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let parent_dairy = request!(
         env,
diff --git a/crates/rocie-server/tests/product_parents/register.rs b/crates/rocie-server/tests/product_parents/register.rs
index c84ffea..c9e48f2 100644
--- a/crates/rocie-server/tests/product_parents/register.rs
+++ b/crates/rocie-server/tests/product_parents/register.rs
@@ -1,8 +1,8 @@
 use rocie_client::{
     apis::{
-        api_get_product_api::product_by_id, api_set_product_api::register_product,
-        api_set_product_parent_api::register_product_parent,
-        api_set_unit_property_api::register_unit_property,
+        api_get_auth_product_api::product_by_id, api_set_auth_product_api::register_product,
+        api_set_auth_product_parent_api::register_product_parent,
+        api_set_auth_unit_property_api::register_unit_property,
     },
     models::{ProductParentStub, ProductStub, UnitPropertyStub},
 };
@@ -14,7 +14,7 @@ use crate::{
 
 #[tokio::test]
 async fn test_product_parent_register_roundtrip() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let parent_dairy = request!(
         env,
diff --git a/crates/rocie-server/tests/products/barcode.rs b/crates/rocie-server/tests/products/barcode.rs
index 5335eb7..7b48ab7 100644
--- a/crates/rocie-server/tests/products/barcode.rs
+++ b/crates/rocie-server/tests/products/barcode.rs
@@ -1,10 +1,10 @@
 use rocie_client::{
     apis::{
-        api_get_inventory_api::amount_by_id,
-        api_set_barcode_api::{buy_barcode, consume_barcode},
-        api_set_product_api::{associate_barcode, register_product},
-        api_set_unit_api::register_unit,
-        api_set_unit_property_api::register_unit_property,
+        api_get_auth_inventory_api::amount_by_id,
+        api_set_auth_barcode_api::{buy_barcode, consume_barcode},
+        api_set_auth_product_api::{associate_barcode, register_product},
+        api_set_auth_unit_api::register_unit,
+        api_set_auth_unit_property_api::register_unit_property,
     },
     models::{Barcode, BarcodeId, ProductStub, UnitAmount, UnitPropertyStub, UnitStub},
 };
@@ -17,7 +17,7 @@ use crate::{
 
 #[tokio::test]
 async fn test_barcode_buy() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let barcode_id = 23;
     let unit_value = 1;
@@ -36,7 +36,7 @@ async fn test_barcode_buy() {
 
 #[tokio::test]
 async fn test_barcode_buy_multiple() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let barcode_id = 23;
     let unit_value = 1;
@@ -55,7 +55,7 @@ async fn test_barcode_buy_multiple() {
 
 #[tokio::test]
 async fn test_barcode_consume() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let barcode_id = BarcodeId { value: 23 };
     let unit_value = 1;
@@ -92,7 +92,7 @@ async fn test_barcode_consume() {
 
 #[tokio::test]
 async fn test_barcode_consume_error() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let barcode_id = BarcodeId { value: 23 };
     let unit_value = 1;
@@ -131,7 +131,7 @@ async fn test_barcode_consume_error() {
 
 #[tokio::test]
 async fn test_barcode_consume_error_other() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let barcode_id = BarcodeId { value: 23 };
     let unit_value = 1;
@@ -181,7 +181,7 @@ async fn test_barcode_consume_error_other() {
 
 #[tokio::test]
 async fn test_barcode_multiple_buy_and_consume() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let barcode_id = BarcodeId { value: 23 };
     let unit_value = 1;
@@ -237,7 +237,7 @@ async fn test_barcode_multiple_buy_and_consume() {
 
 #[tokio::test]
 async fn test_barcode_fill_up() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let milk_id = BarcodeId { value: 23 };
     let bread_id = BarcodeId { value: 24 };
@@ -254,7 +254,7 @@ async fn test_barcode_fill_up() {
 
 #[tokio::test]
 async fn test_barcode_associate_false_unit() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property_mass = request!(
         env,
diff --git a/crates/rocie-server/tests/products/mod.rs b/crates/rocie-server/tests/products/mod.rs
index ee139f0..e503684 100644
--- a/crates/rocie-server/tests/products/mod.rs
+++ b/crates/rocie-server/tests/products/mod.rs
@@ -1,8 +1,8 @@
 use rocie_client::{
     apis::{
-        api_set_product_api::{associate_barcode, register_product},
-        api_set_unit_api::register_unit,
-        api_set_unit_property_api::register_unit_property,
+        api_set_auth_product_api::{associate_barcode, register_product},
+        api_set_auth_unit_api::register_unit,
+        api_set_auth_unit_property_api::register_unit_property,
     },
     models::{
         Barcode, BarcodeId, ProductId, ProductStub, UnitAmount, UnitId, UnitPropertyId,
diff --git a/crates/rocie-server/tests/products/query.rs b/crates/rocie-server/tests/products/query.rs
index 8adfbb5..b2095cb 100644
--- a/crates/rocie-server/tests/products/query.rs
+++ b/crates/rocie-server/tests/products/query.rs
@@ -1,7 +1,7 @@
 use rocie_client::{
     apis::{
-        api_get_product_api::{product_by_name, product_suggestion_by_name},
-        api_set_unit_property_api::register_unit_property,
+        api_get_auth_product_api::{product_by_name, product_suggestion_by_name},
+        api_set_auth_unit_property_api::register_unit_property,
     },
     models::UnitPropertyStub,
 };
@@ -14,7 +14,7 @@ use crate::{
 #[tokio::test]
 #[expect(clippy::similar_names)]
 async fn test_product_name_suggestions() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
@@ -46,7 +46,7 @@ async fn test_product_name_suggestions() {
 
 #[tokio::test]
 async fn test_product_name_suggest_space() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
@@ -68,7 +68,7 @@ async fn test_product_name_suggest_space() {
 
 #[tokio::test]
 async fn test_product_name_lookup_space() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
@@ -87,7 +87,7 @@ async fn test_product_name_lookup_space() {
 
 #[tokio::test]
 async fn test_product_name_lookup_fancy() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
@@ -106,7 +106,7 @@ async fn test_product_name_lookup_fancy() {
 
 #[tokio::test]
 async fn test_product_name_lookup_emoji() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
@@ -125,7 +125,7 @@ async fn test_product_name_lookup_emoji() {
 
 #[tokio::test]
 async fn test_product_name_lookup_plus() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
diff --git a/crates/rocie-server/tests/products/register.rs b/crates/rocie-server/tests/products/register.rs
index bae7bc7..2d4bf7e 100644
--- a/crates/rocie-server/tests/products/register.rs
+++ b/crates/rocie-server/tests/products/register.rs
@@ -1,7 +1,7 @@
 use rocie_client::{
     apis::{
-        api_get_product_api::product_by_id, api_set_product_api::register_product,
-        api_set_unit_property_api::register_unit_property,
+        api_get_auth_product_api::product_by_id, api_set_auth_product_api::register_product,
+        api_set_auth_unit_property_api::register_unit_property,
     },
     models::{ProductStub, UnitPropertyStub},
 };
@@ -13,7 +13,7 @@ use crate::{
 
 #[tokio::test]
 async fn test_product_register_roundtrip() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
diff --git a/crates/rocie-server/tests/recipies/mod.rs b/crates/rocie-server/tests/recipies/mod.rs
index e8aa3c2..dfc8983 100644
--- a/crates/rocie-server/tests/recipies/mod.rs
+++ b/crates/rocie-server/tests/recipies/mod.rs
@@ -1,5 +1,5 @@
 use rocie_client::{
-    apis::{api_get_recipe_api::recipe_by_id, api_set_recipe_api::add_recipe},
+    apis::{api_get_auth_recipe_api::recipe_by_id, api_set_auth_recipe_api::add_recipe},
     models::RecipeStub,
 };
 
@@ -7,7 +7,7 @@ use crate::testenv::{TestEnv, init::function_name, log::request};
 
 #[tokio::test]
 async fn test_recipe_roundtrip() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let recipe_id = request!(
         env,
diff --git a/crates/rocie-server/tests/tests.rs b/crates/rocie-server/tests/tests.rs
index 3759042..4a218d1 100644
--- a/crates/rocie-server/tests/tests.rs
+++ b/crates/rocie-server/tests/tests.rs
@@ -7,3 +7,4 @@ mod products;
 mod product_parents;
 mod units;
 mod recipies;
+mod users;
diff --git a/crates/rocie-server/tests/units/fetch.rs b/crates/rocie-server/tests/units/fetch.rs
index b0bfffb..a0ffd9b 100644
--- a/crates/rocie-server/tests/units/fetch.rs
+++ b/crates/rocie-server/tests/units/fetch.rs
@@ -1,7 +1,7 @@
 use rocie_client::{
     apis::{
-        api_get_unit_api::units_by_property_id, api_set_unit_api::register_unit,
-        api_set_unit_property_api::register_unit_property,
+        api_get_auth_unit_api::units_by_property_id, api_set_auth_unit_api::register_unit,
+        api_set_auth_unit_property_api::register_unit_property,
     },
     models::{UnitPropertyStub, UnitStub},
 };
@@ -10,7 +10,7 @@ use crate::testenv::{TestEnv, init::function_name, log::request};
 
 #[tokio::test]
 async fn test_units_fetch_by_property_id() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
diff --git a/crates/rocie-server/tests/units/register.rs b/crates/rocie-server/tests/units/register.rs
index 8181c25..e725a5c 100644
--- a/crates/rocie-server/tests/units/register.rs
+++ b/crates/rocie-server/tests/units/register.rs
@@ -1,7 +1,7 @@
 use rocie_client::{
     apis::{
-        api_get_unit_api::unit_by_id, api_set_unit_api::register_unit,
-        api_set_unit_property_api::register_unit_property,
+        api_get_auth_unit_api::unit_by_id, api_set_auth_unit_api::register_unit,
+        api_set_auth_unit_property_api::register_unit_property,
     },
     models::{UnitPropertyStub, UnitStub},
 };
@@ -13,7 +13,7 @@ use crate::{
 
 #[tokio::test]
 async fn test_unit_register_roundtrip() {
-    let env = TestEnv::new(function_name!());
+    let env = TestEnv::new(function_name!()).await;
 
     let unit_property = request!(
         env,
diff --git a/crates/rocie-server/tests/users/mod.rs b/crates/rocie-server/tests/users/mod.rs
new file mode 100644
index 0000000..eaa387f
--- /dev/null
+++ b/crates/rocie-server/tests/users/mod.rs
@@ -0,0 +1,53 @@
+use rocie_client::{
+    apis::{
+        api_get_no_auth_user_api::user_by_id,
+        api_set_auth_user_api::register_user,
+        api_set_no_auth_user_api::{login, logout},
+    },
+    models::{LoginInfo, UserStub},
+};
+
+use crate::testenv::{TestEnv, init::function_name, log::request};
+
+#[tokio::test]
+async fn test_register_user() {
+    let env = TestEnv::new_no_login(function_name!());
+
+    let user_id = request!(
+        env,
+        register_user(UserStub {
+            description: Some("Myself".to_string()),
+            name: "me".to_string(),
+            password: "hunter14".to_string()
+        })
+    );
+
+    request!(
+        @expect_error "The password is wrong"
+        env,
+        login(LoginInfo {
+            id: user_id,
+            password: "hunter13".to_owned()
+        })
+    );
+
+    request!(
+        env,
+        login(LoginInfo {
+            id: user_id,
+            password: "hunter14".to_owned()
+        })
+    );
+
+    let user = request!(env, user_by_id(user_id));
+
+    assert_eq!(&user.name, "me");
+    assert_eq!(user.description.as_deref(), Some("Myself"));
+
+    request!(env, logout());
+    request!(
+         @expect_error "We are not logged in anymore"
+         env,
+         user_by_id(user_id)
+    );
+}