fffcb73ea4
Google-SSO PWA for bistro employee clock-in/out, admin employee management, and stats with CSV export. Express + SQLite backend, React + Zustand frontend in the light-mono-tui design language. Multi-stage Dockerfile, compose.yaml for image-based deploys, nginx reverse-proxy template, and an OKF documentation bundle in docs/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
52 lines
1.2 KiB
Markdown
52 lines
1.2 KiB
Markdown
---
|
|
type: API Endpoint
|
|
title: Auth routes
|
|
description: POST /api/auth/google, POST /api/auth/logout, GET /api/auth/me.
|
|
resource: backend/src/routes/auth.ts
|
|
tags: [api, auth]
|
|
timestamp: 2026-08-12T00:00:00Z
|
|
---
|
|
|
|
# Auth routes
|
|
|
|
Mounted at `/api/auth` (`backend/src/index.ts`).
|
|
|
|
# Examples
|
|
|
|
```
|
|
POST /api/auth/google
|
|
Body: { "credential": "<google id token>" }
|
|
200 -> { "user": SessionUser }
|
|
400 -> missing credential
|
|
401 -> invalid Google token
|
|
403 -> email not verified, or not an admin and not an active employee
|
|
```
|
|
|
|
Sets the `eatme_session` cookie on success. See
|
|
[Auth flow](/docs/architecture/auth-flow.md) for what happens before this
|
|
(role resolution) and what's inside the cookie.
|
|
|
|
```
|
|
POST /api/auth/logout
|
|
204, clears the session cookie. No auth required.
|
|
```
|
|
|
|
```
|
|
GET /api/auth/me
|
|
Requires a valid session cookie (requireAuth).
|
|
200 -> { "user": SessionUser }
|
|
401 -> not authenticated
|
|
```
|
|
|
|
`SessionUser` shape (`backend/src/types.ts`):
|
|
|
|
```ts
|
|
{ email: string; name: string | null; role: "admin" | "employee"; employeeId: number | null }
|
|
```
|
|
|
|
# Related
|
|
|
|
- [Auth flow](/docs/architecture/auth-flow.md)
|
|
- [Attendance routes](./attendance-routes.md)
|
|
- [Admin routes](./admin-routes.md)
|