Dash API

http://localhost:4208/api

CORS & cookies

All browser requests that need auth must send cookies:

fetch('http://localhost:4208/api/auth/me', {
  credentials: 'include',
});

Sessions use an HTTP-only token cookie (Secure, SameSite=Strict, 24h). The browser must talk to the API over HTTPS for login to work — Secure cookies are not sent on plain HTTP.

Auth flow

Call GET /auth/me to get googleClientId (included in 200 and 401 responses).
Sign in with Google on the frontend (Google Identity Services / One Tap).
POST the Google ID token to POST /auth/login.
The API sets the session cookie.
Call protected routes with credentials: 'include'. The cookie is refreshed automatically when it has less than 2 hours left.

Routes

Mirrors src/api/routes/.

File	Endpoint
`routes/auth/login.md`	`POST /auth/login`
`routes/auth/logout.md`	`POST /auth/logout`
`routes/auth/me.md`	`GET /auth/me`
`routes/health.md`	`GET /health`
`routes/article/search.md`	`GET /article/search`
`routes/article/get.md`	`GET /article/get`
`routes/misc/getSteuer.md`	`GET /misc/getSteuer`
`routes/misc/getCategories.md`	`GET /misc/getCategories`

DESIGN

for every route we have a file in /src/api/routes
that should loosly bound to services in /src/services
for every service we have a CLI tester in /scripts/
all DB SQL code shall be in /src/db
with mssql staements in /src/db/mssql/