SkyMoney/docs/api-phase2-move-log.md

API Phase 2 Move Log

Date: 2026-03-16
Scope: Move auth + account endpoints out of api/src/server.ts into a dedicated route module.

Route Registration Changes

• Registered auth/account routes in server.ts
• New route module: auth-account.ts

Endpoint Movements

1. POST /auth/register

• Moved to auth-account.ts
• References:
  • RegisterPage.tsx
  • auth.routes.test.ts

2. POST /auth/login

• Moved to auth-account.ts
• References:
  • LoginPage.tsx
  • identification-auth-failures.test.ts

3. POST /auth/logout

• Moved to auth-account.ts
• References:
  • AccountSettings.tsx
  • useSessionTimeout.ts

4. POST /auth/verify

• Moved to auth-account.ts
• References:
  • VerifyPage.tsx
  • insecure-design.test.ts

5. POST /auth/verify/resend

• Moved to auth-account.ts
• References:
  • VerifyPage.tsx
  • insecure-design.test.ts

6. POST /auth/forgot-password/request

• Moved to auth-account.ts
• References:
  • auth.ts
  • forgot-password.security.test.ts

7. POST /auth/forgot-password/confirm

• Moved to auth-account.ts
• References:
  • auth.ts
  • forgot-password.security.test.ts

8. POST /account/delete-request

• Moved to auth-account.ts
• References:
  • AccountSettings.tsx
  • insecure-design.test.ts

9. POST /account/confirm-delete

• Moved to auth-account.ts
• References:
  • AccountSettings.tsx
  • access-control.account-delete.test.ts

10. POST /auth/refresh

• Moved to auth-account.ts
• References:
  • useSessionTimeout.ts
  • cryptographic-failures.runtime.test.ts

Notes

• server.ts auth/account endpoint blocks were removed to prevent duplicate registration.
• Existing path contracts were preserved (same method + path + response shapes).
• Existing auth helpers (issueEmailToken, cooldown checks, security logging, lockout tracking) are still sourced from server.ts and injected into the route module.