u

src/api/routes/auth/login.js

@@ -12,14 +12,64 @@ const googleClient = new OAuth2Client(env.googleClientId);
  */
 export function register(app, basePath = '') {
     /**
-     * @route POST /auth/login
-     * @description Verifies a Google ID token, checks allowlist (or creates entry when `IMPLICIT_CREATE=true`), and sets an HTTP-only `token` cookie.
-     * @body {string} idToken - Google ID token from Google Identity Services
-     * @returns {Object} 200 - `{ message, user }` with `{ id, email, selectedCompanyId, picture? }` in `user`
-     * @returns {Object} 400 - Missing token or Google client not configured
-     * @returns {Object} 401 - Invalid Google token
-     * @returns {Object} 403 - Email not on allowlist
-     * @returns {Object} 500 - Server error
+     * @openapi
+     * /auth/login:
+     *   post:
+     *     tags: [Auth]
+     *     summary: Login with Google ID token
+     *     description: Verifies a Google ID token, checks allowlist (or creates entry when `IMPLICIT_CREATE=true`), and sets an HTTP-only `token` cookie.
+     *     security: []
+     *     x-markdown: auth/login.md
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [idToken]
+     *             properties:
+     *               idToken:
+     *                 type: string
+     *                 description: Google ID token from Google Identity Services
+     *             example:
+     *               idToken: "<google-id-token>"
+     *     responses:
+     *       200:
+     *         description: Login successful; `token` cookie set
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 message:
+     *                   type: string
+     *                   example: Login successful
+     *                 user:
+     *                   $ref: '#/components/schemas/User'
+     *       400:
+     *         description: Missing token or Google client not configured
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Invalid Google token or account
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Email not on allowlist
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       500:
+     *         description: Server error
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
      */
     app.post(`${basePath}/auth/login`, async (req, res) => {
         try {