u

src/api/routes/auth/login.js

@@ -15,7 +15,7 @@ export function register(app, basePath = '') {
      * @route POST /auth/login
      * @description Verifies a Google ID token, checks allowlist, and sets an HTTP-only `token` cookie.
      * @body {string} idToken - Google ID token from Google Identity Services
-     * @returns {Object} 200 - `{ message, user }` with `{ id, email, picture? }` in `user`
+     * @returns {Object} 200 - `{ message, user }` with `{ id, email, selectedCompanyId, picture? }` in `user`
      * @returns {Object} 400 - Missing token or Google client not configured
      * @returns {Object} 401 - Invalid Google token
      * @returns {Object} 403 - Email not on allowlist
@@ -43,7 +43,7 @@ export function register(app, basePath = '') {
                 return res.status(401).json({ error: 'Invalid Google account' });
             }
 
-            const allowed = db.getAllowedEmail(email);
+            const allowed = await db.getAllowedEmail(email);
             if (!allowed) {
                 console.warn(`Login rejected: email not authorized (${email})`);
                 return res.status(403).json({ error: 'Email is not authorized' });
@@ -52,6 +52,7 @@ export function register(app, basePath = '') {
             const user = {
                 id: allowed.id,
                 email: allowed.email,
+                selectedCompanyId: allowed.selectedCompanyId,
                 ...(payload.picture && { picture: payload.picture }),
             };
             const token = jwt.sign(user, env.jwtSecret, { expiresIn: '1d' });