> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drdj.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth and Session Flow

> Authentication path across web app, API middleware, and extensions.

## Web App Authentication Path

1. user signs in via Supabase Auth
2. frontend keeps session state in auth context
3. API requests include bearer token
4. backend validates token in `/server/middleware/auth.ts`
5. backend maps identity to local user and enforces authorization

## Extension Authentication Path

* extensions sync authenticated state from DealDash app context
* extension API calls send bearer token
* backend validates tokens with same middleware rules

## Sensitive Coupling Points

* CORS/origin allowlist in `/server/index.ts`
* token parsing/verification logic in auth middleware
* extension auth sync storage and refresh behavior

## Required Checks for Auth Changes

* unauthorized/expired token handling
* cross-surface parity (web + extension)
* no public route leakage of private data
* integration/e2e coverage for changed flows