14 endpoints backfilled: devices pending/approve/reject; users
password/profile/profile-delete self-service (admin variants in prose);
admin list_users + update_user_max_devices; progress history; book
matching; new password-rules doc.
Gate fix: authLabel missed JWT middleware written inline as
createJWTMiddleware(cfg) (uppercase 'JWT') — reported auth 'none' for
/api/auth self-service routes and would have for any wrapper-inlined
group. Labeled 'JWTMiddleware' + fallthrough 'jwt' case.
Claude registry: 12 entries. Drift fixed by gate: list_users on-device —
handler returns raw []database.Users (bare array, full model incl.
password_hash — real leak the API emits; pinned + documented; earlier
draft had invented {users,total,limit,offset} wrapper). max-devices
response is {message} only. books/match is GET /api/books/match
{matches, action}. progress history sessions = ReadingHistory rows
(pgtype fields). make test 9/9.
1.5 KiB
1.5 KiB
method, path, auth, area
| method | path | auth | area |
|---|---|---|---|
| GET | /api/books/match | jwt | book-matching |
Get Book Matches
Get potential book matches for a given query.
Endpoint: GET /api/books/match
Auth: Required
Query Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| q | string | Yes | Search query (title, author, etc.) |
| limit | integer | No | Maximum number of matches to return (default: 10) |
Request Headers
| Header | Type | Required | Description |
|---|---|---|---|
| Authorization | string | Yes | Bearer token |
Example Request
GET /api/books/match?q=Foundation+Asimov&limit=5
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Response (200 OK)
{
"matches": [
{
"id": "uuid",
"title": "Foundation",
"authors": [
"Isaac Asimov"
],
"isbn": "978-0553293357",
"published_year": 1951,
"publisher": "Bantam Books",
"cover_url": "https://example.com/cover.jpg"
}
],
"action": null
}
Error Responses
| Code | Description |
|---|---|
| 400 | Missing required query parameter |
| 401 | Invalid or expired token |