u

docs/api/routes/auth/login.md

@@ -2,25 +2,38 @@
 
 Public. No cookie required.
 
-**Body (JSON)**
+Login with Google ID token
+
+Verifies a Google ID token, checks allowlist (or creates entry when `IMPLICIT_CREATE=true`), and sets an HTTP-only `token` cookie.
+
+## Body (JSON)
 
 ```json
-{ "idToken": "<google-id-token>" }
+{
+  "idToken": "<google-id-token>"
+}
 ```
 
-**200**
+## Response `200`
+
+Login successful; `token` cookie set
 
 ```json
 {
   "message": "Login successful",
-  "user": { "id": 1, "email": "you@example.com", "picture": "https://lh3.googleusercontent.com/..." }
+  "user": { … }
 }
 ```
 
-**Errors**
+## Errors
 
-| Status | Body |
-|--------|------|
-| 400 | `{ "error": "idToken is required" }` or `{ "error": "GOOGLE_CLIENT_ID is not configured" }` |
-| 401 | `{ "error": "Invalid Google token" }` or `{ "error": "Invalid Google account" }` |
-| 403 | `{ "error": "Email is not authorized" }` |
+| Status | Description |
+|--------|-------------|
+| 400 | Missing token or Google client not configured — `{"error":"…"}` |
+| 401 | Invalid Google token or account — `{"error":"…"}` |
+| 403 | Email not on allowlist — `{"error":"…"}` |
+| 500 | Server error — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/auth/logout.md

@@ -1,9 +1,21 @@
 # `POST /auth/logout`
 
-Public. Clears the session cookie.
+Public. No cookie required.
 
-**200**
+Logout
+
+Clears the HTTP-only `token` cookie set at login.
+
+## Response `200`
+
+Logged out
 
 ```json
-{ "message": "Logged out successfully" }
+{
+  "message": "Logged out successfully"
+}
 ```
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/auth/me.md

@@ -1,19 +1,28 @@
 # `GET /auth/me`
 
-Protected. Requires a valid session cookie. Every response includes `googleClientId`.
+Protected. Requires a valid session cookie (`credentials: 'include'`).
 
-**200**
+Current user
+
+Returns the authenticated user from the session cookie and the Google client ID. Unauthenticated calls still receive `googleClientId` with 401.
+
+## Response `200`
+
+Authenticated
 
 ```json
 {
-  "user": { "id": 1, "email": "you@example.com", "picture": "https://lh3.googleusercontent.com/..." },
-  "googleClientId": "your-client-id.apps.googleusercontent.com"
+  "user": { … },
+  "googleClientId": "…"
 }
 ```
 
-**Errors**
+## Errors
 
-| Status | Body |
-|--------|------|
-| 401 | `{ "error": "Unauthorized", "googleClientId": "..." }` or `{ "error": "Invalid token", "googleClientId": "..." }` |
-| 403 | `{ "error": "User is no longer authorized", "googleClientId": "..." }` |
+| Status | Description |
+|--------|-------------|
+| 401 | Unauthorized — still includes `googleClientId` for the frontend |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/auth/selected-company.md

@@ -0,0 +1,37 @@
+# `PUT /auth/selected-company`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Set selected company
+
+Sets the authenticated user's selected company.
+
+## Body (JSON)
+
+```json
+{
+  "companyId": 1
+}
+```
+
+## Response `200`
+
+Updated user
+
+```json
+{
+  "user": { … }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid companyId — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 500 | Server error — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._