48 lines
1.8 KiB
Markdown
48 lines
1.8 KiB
Markdown
# Dash API
|
|
|
|
```
|
|
http://localhost:4208/api
|
|
```
|
|
|
|
## CORS & cookies
|
|
|
|
All browser requests that need auth must send cookies:
|
|
|
|
```js
|
|
fetch('http://localhost:4208/api/auth/me', {
|
|
credentials: 'include',
|
|
});
|
|
```
|
|
|
|
Sessions use an HTTP-only `token` cookie (`Secure`, `SameSite=Strict`, 24h). The browser must talk to the API over **HTTPS** for login to work — `Secure` cookies are not sent on plain HTTP.
|
|
|
|
## Auth flow
|
|
|
|
1. Call [`GET /auth/me`](routes/auth/me.md) to get `googleClientId` (included in 200 and 401 responses).
|
|
2. Sign in with Google on the frontend (Google Identity Services / One Tap).
|
|
3. POST the Google ID token to [`POST /auth/login`](routes/auth/login.md).
|
|
4. The API sets the session cookie.
|
|
5. Call protected routes with `credentials: 'include'`. The cookie is refreshed automatically when it has less than 2 hours left.
|
|
|
|
## Routes
|
|
|
|
Mirrors [`src/api/routes/`](../../src/api/routes/).
|
|
|
|
| File | Endpoint |
|
|
|------|----------|
|
|
| [`routes/auth/login.md`](routes/auth/login.md) | `POST /auth/login` |
|
|
| [`routes/auth/logout.md`](routes/auth/logout.md) | `POST /auth/logout` |
|
|
| [`routes/auth/me.md`](routes/auth/me.md) | `GET /auth/me` |
|
|
| [`routes/health.md`](routes/health.md) | `GET /health` |
|
|
| [`routes/article/search.md`](routes/article/search.md) | `GET /article/search` |
|
|
| [`routes/article/get.md`](routes/article/get.md) | `GET /article/get` |
|
|
| [`routes/misc/getSteuer.md`](routes/misc/getSteuer.md) | `GET /misc/getSteuer` |
|
|
| [`routes/misc/getCategories.md`](routes/misc/getCategories.md) | `GET /misc/getCategories` |
|
|
|
|
## DESIGN
|
|
|
|
- for every route we have a file in /src/api/routes
|
|
- that should loosly bound to services in /src/services
|
|
- for every service we have a CLI tester in /scripts/
|
|
- all DB SQL code shall be in /src/db
|
|
- with mssql staements in /src/db/mssql/ |