Authentication API

Endpoints

• POST /api/auth/register
• POST /api/auth/login
• POST /api/auth/logout
• POST /api/auth/token/refresh
• GET /api/auth/me
• GET /api/auth/oauth/{provider}/start
• GET /api/auth/oauth/{provider}/callback

Register

curl -s -X POST http://127.0.0.1:3000/api/auth/register \
  -H 'Content-Type: application/json' \
  -d '{"email":"dev@example.com","password":"secret"}'

Login

curl -i -s -X POST http://127.0.0.1:3000/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"dev@example.com","password":"secret"}'

Login response includes tokens and sets zeptoz_session cookie.

RBAC (current implementation)

Roles in Zeptoz:

• owner
• admin
• member

Default role on user registration is member.

Access rules in place

Area	owner	admin	member
Collection POST/PATCH/DELETE	allowed	allowed	forbidden
Collection GET/list	allowed	allowed	allowed
File access to any file	allowed	allowed	not allowed
File access to own file	allowed	allowed	allowed

Notes:

• Collection write operations enforce owner or admin.
• Collection read/list operations require authentication but are not role-restricted.
• Files are authenticated; member can only download/delete files where owner_id matches the user.