dashback/README.md

Dashback API

Backend API for the Dashback frontend. Default base URL:

http://localhost:4208/api

CORS & cookies

All browser requests that need auth must send cookies:

fetch('http://localhost:4208/api/auth/me', {
  credentials: 'include',
});

Sessions use an HTTP-only token cookie (Secure, SameSite=Strict, 24h). The browser must talk to the API over HTTPS for login to work — Secure cookies are not sent on plain HTTP.

Auth flow

1. Call GET /auth/me to get googleClientId (included in 200 and 401 responses).
2. Sign in with Google on the frontend (Google Identity Services / One Tap).
3. POST the Google ID token to the API.
4. The API sets the session cookie.
5. Call protected routes with credentials: 'include'. The cookie is refreshed automatically when it has less than 2 hours left.

POST /auth/login

Public. No cookie required.

Body (JSON)

{ "idToken": "<google-id-token>" }

200

{
  "message": "Login successful",
  "user": { "id": 1, "email": "you@example.com", "picture": "https://lh3.googleusercontent.com/..." }
}

Errors

Status	Body
400	{ "error": "idToken is required" }
401	{ "error": "Invalid Google token" } or { "error": "Invalid Google account" }
403	{ "error": "Email is not authorized" }

POST /auth/logout

Public. Clears the session cookie.

200

{ "message": "Logged out successfully" }

GET /auth/me

Protected. Requires a valid session cookie. Every response includes googleClientId.

200

{
  "user": { "id": 1, "email": "you@example.com", "picture": "https://lh3.googleusercontent.com/..." },
  "googleClientId": "your-client-id.apps.googleusercontent.com"
}

Errors

Status	Body
401	{ "error": "Unauthorized", "googleClientId": "..." } or { "error": "Invalid token", "googleClientId": "..." }
403	{ "error": "User is no longer authorized", "googleClientId": "..." }

Frontend checklist

• credentials: 'include' on every API call
• HTTPS in dev (or proxy) so Secure cookies work