90 lines
2.1 KiB
Markdown
90 lines
2.1 KiB
Markdown
# Dashback API
|
|
|
|
Backend API for the Dashback frontend. Default base URL:
|
|
|
|
```
|
|
http://localhost:4208/api
|
|
```
|
|
|
|
## CORS & cookies
|
|
|
|
All browser requests that need auth must send cookies:
|
|
|
|
```js
|
|
fetch('http://localhost:4208/api/auth/me', {
|
|
credentials: 'include',
|
|
});
|
|
```
|
|
|
|
Sessions use an HTTP-only `token` cookie (`Secure`, `SameSite=Strict`, 24h). The browser must talk to the API over **HTTPS** for login to work — `Secure` cookies are not sent on plain HTTP.
|
|
|
|
## Auth flow
|
|
|
|
1. Call `GET /auth/me` to get `googleClientId` (included in 200 and 401 responses).
|
|
2. Sign in with Google on the frontend (Google Identity Services / One Tap).
|
|
3. POST the Google ID token to the API.
|
|
4. The API sets the session cookie.
|
|
5. Call protected routes with `credentials: 'include'`. The cookie is refreshed automatically when it has less than 2 hours left.
|
|
|
|
### `POST /auth/login`
|
|
|
|
Public. No cookie required.
|
|
|
|
**Body (JSON)**
|
|
|
|
```json
|
|
{ "idToken": "<google-id-token>" }
|
|
```
|
|
|
|
**200**
|
|
|
|
```json
|
|
{
|
|
"message": "Login successful",
|
|
"user": { "id": 1, "email": "you@example.com", "picture": "https://lh3.googleusercontent.com/..." }
|
|
}
|
|
```
|
|
|
|
**Errors**
|
|
|
|
| Status | Body |
|
|
|--------|------|
|
|
| 400 | `{ "error": "idToken is required" }` |
|
|
| 401 | `{ "error": "Invalid Google token" }` or `{ "error": "Invalid Google account" }` |
|
|
| 403 | `{ "error": "Email is not authorized" }` |
|
|
|
|
### `POST /auth/logout`
|
|
|
|
Public. Clears the session cookie.
|
|
|
|
**200**
|
|
|
|
```json
|
|
{ "message": "Logged out successfully" }
|
|
```
|
|
|
|
### `GET /auth/me`
|
|
|
|
Protected. Requires a valid session cookie. Every response includes `googleClientId`.
|
|
|
|
**200**
|
|
|
|
```json
|
|
{
|
|
"user": { "id": 1, "email": "you@example.com", "picture": "https://lh3.googleusercontent.com/..." },
|
|
"googleClientId": "your-client-id.apps.googleusercontent.com"
|
|
}
|
|
```
|
|
|
|
**Errors**
|
|
|
|
| Status | Body |
|
|
|--------|------|
|
|
| 401 | `{ "error": "Unauthorized", "googleClientId": "..." }` or `{ "error": "Invalid token", "googleClientId": "..." }` |
|
|
| 403 | `{ "error": "User is no longer authorized", "googleClientId": "..." }` |
|
|
|
|
## Frontend checklist
|
|
|
|
- [ ] `credentials: 'include'` on every API call
|
|
- [ ] HTTPS in dev (or proxy) so `Secure` cookies work
|