c56cfb30ad
No self-signup: admins create every account in Config -> Benutzer with a typed start password; a forced password change gates first use. Session- cookie auth protects all /api/* routes; /api/users additionally requires the admin role. See docs/authentication.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
16 lines
383 B
TypeScript
16 lines
383 B
TypeScript
import { Router } from "express";
|
|
import {
|
|
changePassword,
|
|
getAuthStatus,
|
|
getMe,
|
|
login,
|
|
logout,
|
|
} from "../controllers/auth.controller.js";
|
|
|
|
export const authRouter = Router();
|
|
|
|
authRouter.get("/status", getAuthStatus);
|
|
authRouter.post("/login", login);
|
|
authRouter.get("/me", getMe);
|
|
authRouter.post("/change-password", changePassword);
|
|
authRouter.post("/logout", logout);
|