# REQ-001: User Login Functionality

## Overview

This requirement specifies the user login functionality for the authentication service. The implementation must satisfy the service contract [CTR-001](CTR-001).

Users shall be able to authenticate using email and password credentials. The system shall return a JWT token upon successful authentication.

## Acceptance Criteria

### AC-01: Valid Credentials

Given a user with valid credentials
When they submit their email and password
Then they receive a JWT token
And the token is valid for 24 hours

### AC-02: Invalid Credentials

Given a user with invalid credentials
When they submit incorrect email or password
Then they receive an authentication error
And no token is issued

### AC-03: Account Lockout

Given a user who has failed authentication 5 times
When they attempt to login again
Then their account is locked for 30 minutes
And they receive a lockout notification
