Context

CMUEats plans to add a review system where users must be logged in to create or update a review. Users will be able to access all other aspects of the site with or without being logged in. Using Google OAuth, we only care about authentication, not authorization to Google services. Hence, a one-time code exchange pattern detailed in the user flow below is enough.

High-Level Layout

Frontend

• Public API calls - auth not required
• Auth UI - header and personalized welcome message
• Google OAuth

Backend

• Public API Endpoints - auth not required
• Auth Endpoints
• (Semi)-Private API Endpoints - review creation and updates (can view reviews without logging in, but can only create reviews when authenticated)

User Table

• internal user id - primary key
• google id
• email
• first name
• last name
• created_at
• updated_at

Login flow