42 lines
2.5 KiB
Markdown
42 lines
2.5 KiB
Markdown
# MVP Vertical Slice: Client-Server Wiring — Plan
|
|
|
|
## Goal
|
|
Prove the real Godot client and the real backend can talk: **a user can register/log in
|
|
and see a list of worlds from the game client**. Nothing more. Gameplay, join-a-world,
|
|
chat, avatar, Discovery search/tags/trending, Social/Economy/Trust & Safety are all
|
|
explicitly out of scope.
|
|
|
|
## Verified backend contract (as of this writing)
|
|
- `POST /api/auth/register` — JSON body `{username, email, password, date_of_birth}`.
|
|
`date_of_birth` is a `YYYY-MM-DD` string. Returns `201 {access_token, token_type}`.
|
|
Rejects under-18 with `400`.
|
|
- `POST /api/auth/login` — OAuth2 **form-encoded** (`application/x-www-form-urlencoded`)
|
|
`username` + `password` (this is NOT a JSON endpoint). Returns `{access_token, token_type}`.
|
|
- `GET /api/worlds` — **requires auth** (`CurrentUser`), returns a JSON array of
|
|
`{id, name, description, visibility, owner_id, created_at}`. There is no unauthenticated
|
|
public-worlds path, so the worlds list screen can only be shown after login/register.
|
|
- `GET /api/health` — unauthenticated, `{status, app}`.
|
|
- Base URL: uvicorn default `http://127.0.0.1:8000` (must be configurable in the client).
|
|
- CORS is irrelevant to the native Godot `HTTPRequest` client (no browser origin).
|
|
|
|
## Task breakdown
|
|
| # | Type | Task | Depends on |
|
|
|---|------|------|-----------|
|
|
| 1 | architecture | `ApiClient` autoload: HTTP + JWT storage + error contract | — |
|
|
| 2 | implementation | Main-menu **login + register** UI built & wired (form-encoded + JSON/age gate) | 1 |
|
|
| 3 | implementation | **World list** screen consuming `GET /api/worlds` | 1 |
|
|
| 4 | testing | End-to-end headless smoke test + manual verify | 1,2,3 |
|
|
|
|
## Design decisions captured (resolved in task 1)
|
|
- Token storage: in-memory singleton property for the MVP; a `save_to_disk` seam is left
|
|
open but not required yet (no re-login on restart in this slice).
|
|
- Error contract: every call returns a discriminated result (`ok`/`error`) so callers
|
|
never crash on network failure; non-2xx surfaces `{status, detail}` from the backend.
|
|
- Base URL: read from a ProjectSetting, defaulting to `http://127.0.0.1:8000`.
|
|
- Login is form-encoded; register is JSON — the client helper must support both content types.
|
|
|
|
## Notes
|
|
- The main-menu auth UI does **not** exist yet (main_menu.gd currently has only Play/Quit
|
|
stubs). Task 2 must **build** the login/register UI, not merely wire an existing one.
|
|
- The world-list screen also needs to be **built** (a new scene), not just wired.
|