# Web and API

ServDiary exposes two client surfaces that share the same Laravel app and domain modules.

## Web (Inertia + Jetstream)

- Session auth via Fortify / Jetstream
- Inertia + Vue pages under `laravel/resources/js/`
- Team-aware UI and policies
- After public signup, owners complete [Billing](billing.md) (Stripe Checkout) before `/dashboard`
- Domain web routes: `laravel/app/Domains/{Feature}/routes/web.php`

## API (Sanctum — Android / iOS)

- Token (and/or SPA) auth via Sanctum
- JSON endpoints for mobile clients
- Domain API routes: `laravel/app/Domains/{Feature}/routes/api.php`
- Same domain Actions/Policies as the web where possible — controllers adapt HTTP only

### Platform auth (mobile)

| Method | URI | Name | Notes |
|--------|-----|------|--------|
| POST | `/api/login` | `api.login` | `email`, `password`, `device_name` → Sanctum token + user + team + `team_role` + `subscribed` |
| POST | `/api/logout` | `api.logout` | Revoke current token (`auth:sanctum`) |
| GET | `/api/me` | `api.me` | User + current team + `team_role` + `subscribed` |

Unsubscribed teams: login and `/me` succeed with `subscribed: false`. Other authenticated API routes return **402** until the team completes web checkout. See [Billing](../features/billing.md).

### Jobs (mobile-relevant)

| Method | URI | Notes |
|--------|-----|--------|
| GET | `/api/job-appointments?from=&to=` | Staff assigned appointment list |
| GET | `/api/jobs/{job}/available-slots?date=` | Soft-read business hours; bookable ISO8601 windows |
| POST | `/api/jobs/{job}/appointments` | Book slot (`starts_at`) |
| POST | `/api/jobs/{job}/appointments/{appointment}/check-in` | Geofenced GPS check-in |
| POST | `/api/jobs/{job}/appointments/{appointment}/complete` | Assignee (or editor) marks completed |

Native clients live in [`android/`](../../android/) and [`ios/`](../../ios/). See [Mobile apps](../features/mobile-apps.md).

Vite client + SSR output (`laravel/public/build`, `laravel/bootstrap/ssr`) is gitignored. Remote hosts cannot run `npm run build`; upload with [`laravel/deploy-assets.sh`](../../laravel/deploy-assets.sh):

- **Production:** `./deploy-assets.sh` → `public_html/servdiary.com/laravel`
- **Sandbox:** `./deploy-assets.sh --sandbox` → `public_html/sandbox.servdiary.com/laravel`
- **SSR runtime:** add `--with-node-modules` when the server runs `php artisan inertia:start-ssr` (the SSR bundle imports `vue` / `@inertiajs/vue3` from `node_modules`).

## Shared expectations

- Authorization and team scoping apply on both surfaces.
- Feature tests should cover the surfaces that domain owns (web, API, or both).
- Do not put product business rules only in Vue or only in a mobile client; keep them in domain Actions.