# dashback

Backend API for Dash — Google SSO auth, MSSQL allowlist, and session cookies.

## Setup

```bash
cp .env.example .env
npm install
```

Configure `.env` (see `.env.example`). Required for auth: `GOOGLE_CLIENT_ID`, `JWT_SECRET`, and `CORS_ORIGINS`.

## Run

```bash
npm start
```

Default port: `4208`.

## API

See [docs/api](docs/api/README.md) for endpoints, auth flow, and frontend integration.

Docs are generated from `@openapi` JSDoc on route handlers:

```bash
npm run docs:api
```

That writes `docs/api/routes.md` and per-route Markdown under `docs/api/routes/`.

### Brands (company-scoped, `selectedCompanyId` aus der Session)

| Methode | Route | Store-Methode |
| --- | --- | --- |
| `GET` | `/api/brand` | `brand.list` |
| `PUT` | `/api/brand` | `brand.upsert` |
| `DELETE` | `/api/brand/:id` | `brand.delete` |

### Artikel-Felder (liefern dasselbe Shape wie `GET /api/article/:sku`)

| Methode | Route | Store-Methode |
| --- | --- | --- |
| `PUT` | `/api/article/:sku/eans` | `article.setEansBySku` |
| `PUT` | `/api/article/:sku/brand` | `article.setBrandIdBySku` |
| `PUT` | `/api/article/:sku/weight` | `article.setWeightBySku` |
| `PUT` | `/api/article/:sku/categories` | `article.setCategoryIdsBySku` |

### Kategorien

| Methode | Route | Store-Methode |
| --- | --- | --- |
| `PATCH` | `/api/category/:id` | `category.rename` und/oder `category.move` (Name+Slug und/oder Verschieben unter neuen Eltern) |
| `PUT` | `/api/category/order` | `category.order` (Geschwister-Sortierung unter einem Elternteil) |

## Users

Manage the email allowlist:

```bash
npm run manage-users
```