appointment-booking-software/docs/api/admin-registration.md

Admin Registration API Usage

Flow Overview

1. POST /api/admin/register - Create admin account
2. POST /api/admin/confirm - Confirm account via email token
3. POST /api/admin/resend-confirmation - Resend confirmation email

API Endpoints

1. Register Admin

POST /api/admin/register
Content-Type: application/json

{
  "name": "Admin Name",
  "email": "admin@example.com",
  "passkey": {
    "id": "credential-id-from-webauthn",
    "publicKey": "base64-encoded-public-key",
    "counter": 0,
    "deviceName": "MacBook Pro"
  }
}

Response (201):

{
	"message": "Admin account created successfully. Please check your email for confirmation.",
	"adminId": "01234567-89ab-cdef-0123-456789abcdef",
	"email": "admin@example.com"
}

2. Confirm Admin Account

POST /api/admin/confirm
Content-Type: application/json

{
  "token": "01234567-89ab-cdef-0123-456789abcdef"
}

Response (200):

{
	"message": "Admin account confirmed successfully. You can now log in."
}

3. Resend Confirmation Email

POST /api/admin/resend-confirmation
Content-Type: application/json

{
  "email": "admin@example.com"
}

Response (200):

{
	"message": "Confirmation email resent successfully. Please check your email."
}

Error Responses

400 Bad Request

{
	"error": "Invalid admin data"
}

404 Not Found

{
	"error": "Invalid or expired confirmation token"
}

409 Conflict

{
	"error": "An admin with this email already exists"
}

500 Internal Server Error

{
	"error": "Internal server error"
}

Implementation Notes

• Admin accounts are created as isActive: false and confirmed: false
• Confirmation tokens expire after 10 minutes
• Email sending is marked as TODO in the service layer
• After confirmation, admin becomes isActive: true and confirmed: true
• Passkey is stored during registration and linked to the admin account
• The passkey id field is the credential ID from WebAuthn registration
• The passkey publicKey field must be base64 encoded
• The passkey counter field defaults to 0 if not provided
• The passkey deviceName field defaults to "Unknown Device" if not provided