Auth & Session

These endpoints require a user session (a signed-in browser or its JWT). Room API tokens cannot call them.

Exchange the session for a JWT

GET /api/auth/token

Exchanges the OIDC session cookie for a short-lived bearer JWT.

{ "token": "<jwt>" }

Refresh the session

POST /api/auth/refresh

Refreshes the OAuth session. The app calls this automatically.

Current session

GET /api/session

Returns information about the current session (user, expiry).

Register / update the current user

POST /api/auth/user
Authorization: Bearer <jwt>

Creates or updates the user profile from the JWT. Side effect: accepts any pending room invitations matching the user’s email and adds them to those rooms.

Current user & rooms

GET /api/users/me
GET /api/users/me/rooms

GET /api/users/me returns the profile plus a rooms array; GET /api/users/me/rooms returns the rooms the user belongs to with userRole and counts.

{
  "userId": "auth0|123456",
  "email": "user@example.com",
  "name": "John Doe",
  "rooms": ["room1", "room2"]
}