planner-bot
8551d14591
- Architecture task: ApiClient autoload (HTTP + JWT + error contract) - Implementation task: Login/Register UI wired to /api/auth - Implementation task: Browse worlds screen wired to GET /api/worlds - Validation task: End-to-end smoke test (login + list worlds)
38 lines
2.3 KiB
Markdown
38 lines
2.3 KiB
Markdown
# MVP Vertical Slice: Client-Server Wiring — Plan
|
|
|
|
## Goal
|
|
Prove the real Godot client and the real backend can talk: **a user can register/log in
|
|
and see a list of worlds from the game client**. Nothing more. Gameplay, join-a-world,
|
|
chat, avatar, Discovery search/tags/trending, Social/Economy/Trust & Safety are all
|
|
explicitly out of scope.
|
|
|
|
## Verified backend contract (as of this writing)
|
|
- `POST /api/auth/register` — JSON body `{username, email, password, date_of_birth}`.
|
|
`date_of_birth` is a `YYYY-MM-DD` string. Returns `201 {access_token, token_type}`.
|
|
Rejects under-18 with `400`.
|
|
- `POST /api/auth/login` — OAuth2 **form-encoded** (`application/x-www-form-urlencoded`)
|
|
`username` + `password` (this is NOT a JSON endpoint). Returns `{access_token, token_type}`.
|
|
- `GET /api/worlds` — **requires auth** (`CurrentUser`), returns a JSON array of
|
|
`{id, name, description, visibility, owner_id, created_at}`. There is no unauthenticated
|
|
public-worlds path, so the worlds list screen can only be shown after login/register.
|
|
- `GET /api/health` — unauthenticated, `{status, app}`.
|
|
- Base URL: uvicorn default `http://127.0.0.1:8000` (must be configurable in the client).
|
|
- CORS is irrelevant to the native Godot `HTTPRequest` client (no browser origin).
|
|
|
|
## Task breakdown
|
|
| # | Type | Task | Depends on |
|
|
|---|------|------|-----------|
|
|
| 1 | architecture | `ApiClient` autoload: HTTP + JWT storage + error contract | — |
|
|
| 2 | implementation | Main-menu **login** wiring (form-encoded) | 1 |
|
|
| 3 | implementation | Main-menu **register** wiring (JSON + age gate) | 2 |
|
|
| 4 | implementation | **World list** screen consuming `GET /api/worlds` | 2 |
|
|
| 5 | testing | End-to-end headless smoke test + manual verify | 1,3,4 |
|
|
|
|
## Design decisions captured (resolved in task 1)
|
|
- Token storage: in-memory singleton property for the MVP; a `save_to_disk` seam is left
|
|
open but not required yet (no re-login on restart in this slice).
|
|
- Error contract: every call returns a discriminated result (`ok`/`error`) so callers
|
|
never crash on network failure; non-2xx surfaces `{status, detail}` from the backend.
|
|
- Base URL: read from a ProjectSetting, defaulting to `http://127.0.0.1:8000`.
|
|
- Login is form-encoded; register is JSON — the client helper must support both content types.
|