# Dashfront

Vite + React web client for Dashback. Auth uses Google Sign-In and a
cookie session on the Dashback API.

## Stack

- Vite 8 (`type: module`)
- React 19 (function components only)
- MUI 9 (`@mui/material`, `@mui/icons-material`, Emotion)
- notistack (toast notifications)
- Google Identity Services + Dashback cookie auth

## Getting started

```bash
npm install
npm run dev
```

Open `http://localhost:4209`. The dev server proxies `/api` to Dashback at
`http://localhost:4208`.

Dashback must be running and your Google account must be authorized on the
backend.

## Auth flow

1. On boot the app calls `GET /api/auth/me` with `credentials: 'include'`.
   - **200** — `{ user, googleClientId }` (valid session)
   - **401 / 403** — `{ error, googleClientId }` (no session or no longer authorized)
2. The login page uses `googleClientId` from that response to obtain a Google ID
   token and posts it to `POST /api/auth/login` as `{ idToken }`.
3. Dashback sets an HTTP-only `token` cookie; all later API calls send it
   automatically.
4. Sign out calls `POST /api/auth/logout`.

The Vite dev proxy (`/api` → Dashback) satisfies the same-origin cookie
requirement without needing HTTPS on the frontend dev server.

## Architecture

- `src/api/index.js` — all backend communication (`credentials: 'include'`).
- `src/auth/googleSignIn.js` — Google Identity Services helper.
- `src/auth/AuthContext.jsx` — session state + login/logout.
- `src/components/*` — small function components with local state.