Authentication routes
POST /api/auth/camel
Exchange a Camel Accounts authorization code and PKCE verifier for a Ngamia account session. Requires an allowed Origin.
POST /api/auth/camel HTTP/1.1
Origin: https://app.ngamia.com
Content-Type: application/json
{"code":"...","code_verifier":"..."}| Field | Type | Validation |
|---|---|---|
code | string | Required and non-empty |
code_verifier | string | Required; at least 43 characters |
Successful response: 200 {"ok":true} and two Set-Cookie headers. The route posts form-encoded data to Camel /oauth/token, including the configured client ID and redirect URI, then posts the returned Camel access token as JSON to Ngamia /v1/auth/camel. Each provider request has a 20-second timeout. Both upstream steps must succeed and yield valid Ngamia access_token and refresh_token strings.
Errors: 403 disallowed/missing origin; 400 missing code or too-short verifier; provider status or 401 for failed Camel exchange; Ngamia status or 502 if the Ngamia exchange fails; 502 if the connection throws. Error JSON is { "error": { "message": "..." } }.
GET /api/auth/session
Check the current account session and, if possible, return the upstream /v1/me response. Requires an allowed Origin; cookies may be absent.
| Condition | Status | Body |
|---|---|---|
| No access or refresh cookie | 200 | {"authenticated":false} |
Authenticated /v1/me succeeds | Upstream status | Original upstream response text and content type |
/v1/me returns 404 | 200 | {"authenticated":true} |
Other /v1/me response | Upstream status | Original body and content type |
| Origin not allowed | 403 | Local error envelope |
The browser web app unwraps an optional data property to obtain its profile. The upstream request has a 15-second timeout and retries once after refresh if Ngamia responds 401. Use credentials: 'include'.
POST /api/auth/logout
Requires an allowed Origin. If both cookies exist, attempts upstream POST /v1/auth/logout with a 10-second timeout. It does not use the shared refresh-on-401 helper. Upstream failures do not prevent local cookie clearing. Returns 200 {"ok":true} after clearing both cookies. The route is safe to call without a session; it still clears the cookie names.
Preflight
Nest’s global CORS middleware handles browser OPTIONS preflight; the auth controller itself does not define an OPTIONS route.