u

src/api/routes/auth/login.js

@@ -15,7 +15,7 @@ export function register(app, basePath = '') {
      * @route POST /auth/login
      * @description Verifies a Google ID token, checks allowlist, and sets an HTTP-only `token` cookie.
      * @body {string} idToken - Google ID token from Google Identity Services
-     * @returns {Object} 200 - `{ message, user }` with `{ id, email, picture? }` in `user`
+     * @returns {Object} 200 - `{ message, user }` with `{ id, email, selectedCompanyId, picture? }` in `user`
      * @returns {Object} 400 - Missing token or Google client not configured
      * @returns {Object} 401 - Invalid Google token
      * @returns {Object} 403 - Email not on allowlist
@@ -43,7 +43,7 @@ export function register(app, basePath = '') {
                 return res.status(401).json({ error: 'Invalid Google account' });
             }
 
-            const allowed = db.getAllowedEmail(email);
+            const allowed = await db.getAllowedEmail(email);
             if (!allowed) {
                 console.warn(`Login rejected: email not authorized (${email})`);
                 return res.status(403).json({ error: 'Email is not authorized' });
@@ -52,6 +52,7 @@ export function register(app, basePath = '') {
             const user = {
                 id: allowed.id,
                 email: allowed.email,
+                selectedCompanyId: allowed.selectedCompanyId,
                 ...(payload.picture && { picture: payload.picture }),
             };
             const token = jwt.sign(user, env.jwtSecret, { expiresIn: '1d' });

src/api/routes/auth/logout.js

@@ -18,8 +18,8 @@ export function register(app, basePath = '') {
         if (token) {
             try {
                 const decoded = jwt.verify(token, env.jwtSecret, { ignoreExpiration: true });
-                if (decoded?.id) {
-                    clearCachedUser(decoded.id);
+                if (decoded?.email) {
+                    clearCachedUser(decoded.email);
                 }
             } catch {
                 // Ignore errors during cache clearing on logout

src/api/routes/auth/me.js

@@ -9,11 +9,11 @@ export function register(app, basePath = '') {
     /**
      * @route GET /auth/me
      * @description Returns the authenticated user from `req.user` and the Google client ID.
-     * @returns {Object} 200 - `{ user: { id, email, picture? }, googleClientId }`
+     * @returns {Object} 200 - `{ user: { id, email, selectedCompanyId, picture? }, googleClientId }`
      */
     app.get(`${basePath}/auth/me`, (req, res) => {
-        const { id, email, picture } = req.user;
-        const user = { id, email, ...(picture && { picture }) };
+        const { id, email, selectedCompanyId, picture } = req.user;
+        const user = { id, email, selectedCompanyId, ...(picture && { picture }) };
         meJson(res, 200, { user });
     });
 }