Login / Authentication

Firebase handles sign-in; the API validates ID tokens and returns the current user and organization.

Sequence

sequenceDiagram
  autonumber
  participant Web as Web client
  participant FB as Firebase Auth (client)
  participant API as Hono API
  participant MW as requireAuth
  participant Auth as auth.service
  participant Mongo as MongoDB

  Web->>FB: signIn (email or Google)
  FB-->>Web: ID token
  Web->>API: GET /v1/auth/me Authorization Bearer
  API->>MW: verify token
  MW->>FB: verifyFirebaseToken (Admin)
  MW->>Mongo: User by firebaseUid + Organization
  MW->>API: set userId, organizationId, role
  API->>Auth: getMe
  Auth->>Mongo: updateLastLoginAt, fetch user/org
  Auth-->>Web: 200 user + organization

Steps

1. User signs in with Firebase (email/password or Google) in the web app.
2. Client sends the Firebase ID token on GET /v1/auth/me.
3. Middleware verifies the token and loads active user plus organization from the database.
4. Session response includes user and organization; last login is updated.
5. Logout revokes Firebase refresh tokens; protected routes use the same auth middleware.