Backend / API

FriendChise is a single Next.js app. There is no separate backend service. "Backend" here means everything under app/api, app/actions, lib/services, and prisma.

API reference

• Base URL and Environments — production and local dev API URLs
• Authentication — session cookies (web) and bearer tokens (mobile)
• Error Handling — HTTP status codes and error response format
• Request and Response Format — content types, pagination, time values
• Mobile Authentication Endpoints — the OAuth handshake that produces a mobile bearer token
• Users and Accounts Endpoints — current user profile, org list, account deletion
• Tasks Endpoints — create, read, update, list (tasks, recipes, procedures)
• Organizations Endpoints — memberships, announcements, roster, parent-owner check
• Images and File Uploads Endpoints — presigned upload URLs, signed read URLs, org image library
• Tools Endpoints — item lists, conversions, roster templates, scan-to-task history
• API Changelog — history of API additions and removals

Architecture and internals

• API Route Reference — complete route inventory (all app/api/* paths)
• Services and Actions — why mutations go through server actions, not REST endpoints
• Operations — audit logging, monitoring, rate limiting, and cleanup
• Database — Prisma schema, enums, and seeding

Shape of a write

Most state changes do not go through app/api. Instead:

1. A client component calls a server action in app/actions/*.
2. The action authenticates the caller (via lib/authz/action.ts), validates input, and calls into a service in lib/services/*.
3. The service performs the actual database work (often in a transaction), writes an audit log entry where relevant, and returns a typed result.
4. The action calls revalidatePath/redirects as needed for the UI.

app/api is reserved for cases a server action cannot cover: mobile authentication, bearer-token-scoped identity endpoints, org-scoped task routes (/api/orgs/[orgId]/tasks/*), mobile tool routes (/api/orgs/[orgId]/tools/scan-to-task/*), lazy-loading helpers (pagination, roster weeks, memberships), image and storage URL helpers, and account management.

Authorization

See Authentication for the full guard layer (lib/authz/api.ts, page.ts, action.ts) and RBAC for the permission model.