John O'Keefe
ae9588f1c6
Beam backfilled auth core (login/register/refresh/logout/profile) and devices
core (list/update/delete/shelf CRUD/sidecar/register flow) with frontmatter,
provenance, and labeled examples. All claimed shapes verified against
handlers: AuthResponse {access_token, refresh_token omitempty, token_type,
expires_in, user}, update device {device_updated, device}, shelf wrappers,
DeviceAuthStatusResponse.
Claude registry verification: 15 entries pinned by type (LoginRequest,
RegisterRequest, AuthResponse, RefreshTokenRequest/Response, UserProfile,
DeviceListResponse, DeviceUpdateRequest, AddToShelfRequest, SidecarConfig,
DeviceRegistrationRequest/Response, DeviceAuthStatusRequest/Response).
Removed revoke_device.md — name-only duplicate of delete_device.md (same
DELETE /api/devices/:id route; was the last audit-orphan doc).
Gate catches this round (subtle Go serialization facts, now pinned in docs):
- uuid.UUID arrays never serialize as omitted: register/status response
ALWAYS carries device_id (all-zeros while pending) despite omitempty
- update device request binds device_name, not name
- register response includes device_id alongside registration_id
- list devices response is a {devices, total} wrapper
1.5 KiB
1.5 KiB
method, path, auth, area
| method | path | auth | area |
|---|---|---|---|
| POST | /api/auth/login | none | authentication |
Login User
Authenticate with email and password.
Endpoint: POST /api/auth/login
Auth: Not required
Content-Type: application/json or application/x-www-form-urlencoded
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
| login | string | Yes | User's email address or username |
| password | string | Yes | User's password |
Example Request
{
"login": "user@example.com",
"password": "SecureP@ss123!"
}
Response (200 OK)
{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 604800,
"user": {
"id": "uuid-here",
"email": "user@example.com",
"username": "john",
"first_name": "John",
"last_name": "Doe",
"role": "user"
}
}
Note: the access token field is access_token (not token). Nullable profile fields (first_name, last_name) may be empty strings.
Set-Cookie Header:
Set-Cookie: token=eyJhbG...; Max-Age=604800; Path=/; HttpOnly
Session Duration: 7 days (604800 seconds)
Error Responses
| Code | Description |
|---|---|
| 401 | Invalid email or password |
| 400 | Missing required fields |
| 429 | Too many login attempts |