Login
4 endpoints.
Not yet described in this reference. This endpoint is listed because the server registers it, but its request and response shapes have not been written down yet.
The handler is login in crates/lanrurugi-api/src/login.rs:209.
Responses
200The endpoint responded. Its exact shape is not documented yet — see the handler at crates/lanrurugi-api/src/login.rs:37.
This response carries no example body.
This endpoint needs no credentials.
Request failed — Usual causes: the instance address is wrong or unreachable; cross-origin access is not enabled on the instance; or this page is HTTPS while the instance is plain HTTP on a LAN address, which the browser blocks as mixed content. “Copy as cURL” above sends the same request from a terminal.
Your own instance address. Requests go from this browser straight to it.
GET /login/status — reports whether the caller is “logged in” for the purposes of gating
Section titled “GET /login/status — reports whether the caller is “logged in” for the purposes of gating”Not yet described in this reference. This endpoint is listed because the server registers it, but its request and response shapes have not been written down yet.
The note below is the handler’s own documentation comment (crates/lanrurugi-api/src/login.rs:619), quoted verbatim. It is written for maintainers of this codebase and may reference internal identifiers.
GET /login/status — reports whether the caller is “logged in” for the purposes of gating
admin-only UI, matching legacy’s own userlogged template variable
(Controller/Reader.pm/Index.pm: enable_pass == 0 || session('is_logged')). Deliberately
its own endpoint rather than a new field on /info — /info mirrors legacy’s third-party
ServerInfo OpenAPI schema field-for-field (constitution Principle II), and logged_in has no
place in that contract.
Responses
200The endpoint responded. Its exact shape is not documented yet — see the handler at crates/lanrurugi-api/src/login.rs:38.
This response carries no example body.
This endpoint needs no credentials.
Request failed — Usual causes: the instance address is wrong or unreachable; cross-origin access is not enabled on the instance; or this page is HTTPS while the instance is plain HTTP on a LAN address, which the browser blocks as mixed content. “Copy as cURL” above sends the same request from a terminal.
Your own instance address. Requests go from this browser straight to it.
Now that refresh tokens are stateful (lanrurugi_storage::refresh_tokens), logout actually
Section titled “Now that refresh tokens are stateful (lanrurugi_storage::refresh_tokens), logout actually”Not yet described in this reference. This endpoint is listed because the server registers it, but its request and response shapes have not been written down yet.
The note below is the handler’s own documentation comment (crates/lanrurugi-api/src/login.rs:671), quoted verbatim. It is written for maintainers of this codebase and may reference internal identifiers.
Now that refresh tokens are stateful (lanrurugi_storage::refresh_tokens), logout actually
revokes — burns the entire refresh-token family the caller’s access token was minted from
(same remediation rotate’s own reuse-detection path takes), not just clearing the browser’s
cookies and hoping the now-orphaned access token quietly expires on its own within the next
few hours.
Reads fid out of the access token (session::COOKIE_NAME, Path=/), not the refresh
cookie — deliberately, so REFRESH_COOKIE_PATH can stay scoped to only
POST /api/token/refresh without also needing to cover this endpoint. Uses
family_id_ignoring_expiry rather than the normal expiry-checking verifier: a user who clicks
“log out” after their access token has already expired (idle tab, hasn’t hit any endpoint that
would have triggered a silent refresh yet) must still get their refresh-token family actually
revoked — an already-expired access token still proves genuine origin via its signature, which
is all this needs.
Responses
200The endpoint responded. Its exact shape is not documented yet — see the handler at crates/lanrurugi-api/src/login.rs:39.
This response carries no example body.
This endpoint needs no credentials.
Request failed — Usual causes: the instance address is wrong or unreachable; cross-origin access is not enabled on the instance; or this page is HTTPS while the instance is plain HTTP on a LAN address, which the browser blocks as mixed content. “Copy as cURL” above sends the same request from a terminal.
Your own instance address. Requests go from this browser straight to it.
POST /token/refresh — no legacy equivalent
Section titled “POST /token/refresh — no legacy equivalent”Not yet described in this reference. This endpoint is listed because the server registers it, but its request and response shapes have not been written down yet.
The note below is the handler’s own documentation comment (crates/lanrurugi-api/src/login.rs:369), quoted verbatim. It is written for maintainers of this codebase and may reference internal identifiers.
POST /token/refresh — no legacy equivalent. Redeems the refresh cookie for a fresh access
token + rotated refresh cookie (see lanrurugi_storage::refresh_tokens::rotate’s own docs for
the rotation/reuse-detection semantics). The frontend calls this transparently on a 401 from
any other endpoint (apps/frontend/src/api/client.ts), before ever redirecting to /login.
Responses
200The endpoint responded. Its exact shape is not documented yet — see the handler at crates/lanrurugi-api/src/login.rs:40.
This response carries no example body.
This endpoint needs no credentials.
Request failed — Usual causes: the instance address is wrong or unreachable; cross-origin access is not enabled on the instance; or this page is HTTPS while the instance is plain HTTP on a LAN address, which the browser blocks as mixed content. “Copy as cURL” above sends the same request from a terminal.
Your own instance address. Requests go from this browser straight to it.