# dashback

Backend API for Dash — Google SSO auth, MSSQL allowlist, and session cookies.

## Setup

```bash
cp .env.example .env
npm install
```

Configure `.env` (see `.env.example`). Required for auth: `GOOGLE_CLIENT_ID`, `JWT_SECRET`, and `CORS_ORIGINS`.

## Run

```bash
npm start
```

Default port: `4208`.

## API

See [docs/api](docs/api/README.md) for endpoints, auth flow, and frontend integration.

Docs are generated from `@openapi` JSDoc on route handlers:

```bash
npm run docs:api
```

That writes `docs/api/routes.md`, `docs/api/routes-all.md`, and per-route Markdown under `docs/api/routes/`. There is no generated `openapi.json` on disk — the interactive Swagger UI at `/docs/` builds the spec from the same `@openapi` JSDoc at runtime (`src/api/openapiSpec.js`).

### Brands (company-scoped, `selectedCompanyId` aus der Session)

| Methode | Route | Store-Methode |
| --- | --- | --- |
| `GET` | `/api/brand` | `brand.list` |
| `PUT` | `/api/brand` | `brand.upsert` |
| `DELETE` | `/api/brand/:id` | `brand.delete` |

### Artikel-Felder (liefern dasselbe Shape wie `GET /api/article/:sku`)

| Methode | Route | Store-Methode |
| --- | --- | --- |
| `PUT` | `/api/article/:sku/eans` | `article.setEansBySku` |
| `PUT` | `/api/article/:sku/brand` | `article.setBrandIdBySku` |
| `PUT` | `/api/article/:sku/weight` | `article.setWeightBySku` |
| `PUT` | `/api/article/:sku/categories` | `article.setCategoryIdsBySku` |

### Kategorien

| Methode | Route | Store-Methode |
| --- | --- | --- |
| `PATCH` | `/api/category/:id` | `category.rename` und/oder `category.move` (Name+Slug und/oder Verschieben unter neuen Eltern) |
| `PUT` | `/api/category/order` | `category.order` (Geschwister-Sortierung unter einem Elternteil) |

### Public Product Catalog (ohne Auth, company-scoped)

| Methode | Route | Beschreibung |
| --- | --- | --- |
| `GET` | `/api/public/:companyId/categories` | Liefert den Kategoriebaum der Firma |
| `GET` | `/api/public/:companyId/articles` | Liefert paginierte Artikelliste (optional gefiltert nach `?categoryId=`, `?search=`) |
| `GET` | `/api/public/:companyId/articles/:sku` | Liefert öffentliche Artikeldetails (Preise, Bilder, Kategorien, EANs, Varianten) |

## Users

Manage the email allowlist:

```bash
npm run manage-users
```