u

src/api/routes/auth/login.js

@@ -13,7 +13,7 @@ const googleClient = new OAuth2Client(env.googleClientId);
 export function register(app, basePath = '') {
     /**
      * @route POST /auth/login
-     * @description Verifies a Google ID token, checks allowlist, and sets an HTTP-only `token` cookie.
+     * @description Verifies a Google ID token, checks allowlist (or creates entry when `IMPLICIT_CREATE=true`), and sets an HTTP-only `token` cookie.
      * @body {string} idToken - Google ID token from Google Identity Services
      * @returns {Object} 200 - `{ message, user }` with `{ id, email, selectedCompanyId, picture? }` in `user`
      * @returns {Object} 400 - Missing token or Google client not configured
@@ -32,10 +32,15 @@ export function register(app, basePath = '') {
                 return res.status(400).json({ error: 'GOOGLE_CLIENT_ID is not configured' });
             }
 
-            const ticket = await googleClient.verifyIdToken({
-                idToken,
-                audience: env.googleClientId,
-            });
+            let ticket;
+            try {
+                ticket = await googleClient.verifyIdToken({
+                    idToken,
+                    audience: env.googleClientId,
+                });
+            } catch {
+                return res.status(401).json({ error: 'Invalid Google token' });
+            }
             const payload = ticket.getPayload();
             const email = payload?.email?.toLowerCase();
 
@@ -43,7 +48,11 @@ export function register(app, basePath = '') {
                 return res.status(401).json({ error: 'Invalid Google account' });
             }
 
-            const allowed = await db.getAllowedEmail(email);
+            let allowed = await db.getAllowedEmail(email);
+            if (!allowed && env.implicitCreate) {
+                await db.addAllowedEmail(email);
+                allowed = await db.getAllowedEmail(email);
+            }
             if (!allowed) {
                 console.warn(`Login rejected: email not authorized (${email})`);
                 return res.status(403).json({ error: 'Email is not authorized' });
@@ -66,7 +75,8 @@ export function register(app, basePath = '') {
 
             res.status(200).json({ message: 'Login successful', user });
         } catch (error) {
-            res.status(401).json({ error: 'Invalid Google token' });
+            console.error('Login failed:', error);
+            res.status(500).json({ error: 'Login failed' });
         }
     });
 }

src/api/routes/auth/selectedCompany.js

@@ -0,0 +1,40 @@
+import * as db from '../../../db/googleAuth.js';
+import { clearCachedUser } from '../../middleware/auth.js';
+
+/**
+ * Registers the selected-company route (requires auth middleware).
+ * @param {import('express').Application} app - Express app
+ * @param {string} [basePath=''] - Optional URL prefix for all routes in this module
+ */
+export function register(app, basePath = '') {
+    /**
+     * @route PUT /auth/selected-company
+     * @description Sets the authenticated user's selected company.
+     * @body {number} companyId
+     * @returns {Object} 200 - `{ user: { id, email, selectedCompanyId, picture? } }`
+     */
+    app.put(`${basePath}/auth/selected-company`, async (req, res) => {
+        const companyId = Number(req.body?.companyId);
+        if (!Number.isInteger(companyId) || companyId <= 0) {
+            return res.status(400).json({ error: 'companyId is required' });
+        }
+
+        try {
+            await db.setSelectedCompany(req.user.id, companyId);
+            clearCachedUser(req.user.email);
+
+            const updated = await db.getAllowedEmail(req.user.email);
+            const user = {
+                id: updated.id,
+                email: updated.email,
+                selectedCompanyId: updated.selectedCompanyId,
+                ...(req.user.picture && { picture: req.user.picture }),
+            };
+
+            res.status(200).json({ user });
+        } catch (error) {
+            console.error('Set selected company failed:', error);
+            res.status(500).json({ error: 'Failed to set selected company' });
+        }
+    });
+}