ginnoir
76f68548b2
Map design IDs to Gitea #1-#37, add tasks 80-88, stub ADRs 0004-0006, and point STATUS at the P1 batch order.
1.5 KiB
1.5 KiB
87 — API surface + token auth
Goal
Documented HTTP API for existing modules (calendar, lists, notes, garden, bangs) with token auth suitable for non-browser clients, coexisting with OIDC session auth.
Why
API-early batch order: foundation lands after bugs so journal and notes can extend it; LLM agent (88) maps tools onto it.
Depends on
- ADR
0006-api-llm-agent.mdresearch half (Gitea #14) — auth model and API shape decided before implementation
Scope
- Architecture ADR 0006: token auth vs OIDC session coexistence; API shape; additive versioning (no freeze that blocks journal).
- Token auth for non-browser clients.
- Endpoints for existing entities: events, lists/items, notes, garden, bangs (dashboards as needed).
- API docs (OpenAPI or equivalent living doc).
- Vitest for auth + route handlers; optional Playwright smoke only if useful.
Out of scope
- LLM agent chat UI and tool-calling (88).
- Journal endpoints (86 adds them).
Acceptance criteria
- ADR 0006 documents auth coexistence and API shape.
- Token-authenticated client can read/write covered entities.
- Session (OIDC) auth still works for the web app.
- Docs list endpoints and auth.
- Unit/integration tests for auth and handlers.