Library API

All library API routes except the public catalog require a valid Supabase access token in the Authorization: Bearer <token> header.

Authentication

Librarians sign in through the shared staff login page. The login POSTs credentials to /api/auth/login, which sets sb-access-token and sb-refresh-token cookies and returns a redirect URL. The cookies are then sent automatically with subsequent requests.

Routes

Signs in a staff member or librarian. Request body

{
  "email": "string",
  "password": "string"
}

Response

{
  "redirect": "/library/<school-domain>"
}

Sets sb-access-token and sb-refresh-token cookies.

`GET /api/library/catalog/<domain>`

Public catalog for a school. Does not require authentication. Response

{
  "school": { "id": "uuid", "name": "string", "domain": "string" },
  "settings": { "default_loan_days": 14, "max_renewals": 2, "renewal_days": 7 },
  "books": [
    { "id": "uuid", "isbn": "string", "title": "string", "author": "string", "cover_url": "string", "total_copies": 10, "available_copies": 7 }
  ]
}

`GET /api/library/accounts?schoolId=<uuid>`

List librarian accounts for a school. Requires admin or staff token.

`POST /api/library/invite`

Create a new librarian account. Requires admin token. Request body

{
  "email": "string",
  "school_id": "uuid",
  "password": "string (optional)"
}

`PATCH /api/library/accounts/manage`

Suspend or unsuspend a librarian account. Requires admin token. Request body

{
  "account_id": "uuid",
  "suspended": "boolean"
}

`POST /api/library/books`

Add a book to the catalog. Requires librarian token. Request body

{
  "school_id": "uuid",
  "isbn": "string (optional)",
  "title": "string",
  "author": "string",
  "copies": 5
}

`POST /api/library/copies`

Generate copy codes for a book. Requires librarian token. Request body

{
  "book_id": "uuid",
  "count": 5
}

`GET /api/library/loans`

List active loans for the librarian’s school.

`POST /api/library/loans`

Create a loan. Requires librarian token. Request body

{
  "book_id": "uuid",
  "copy_id": "uuid",
  "student_id": "uuid",
  "due_at": "ISO date"
}

`PATCH /api/library/loans`

Renew or return a loan. Requires librarian token. Request body

{
  "loan_id": "uuid",
  "action": "renew" | "return"
}

`GET /api/library/settings`

Read settings for the librarian’s school.

`PUT /api/library/settings`

Update settings. Requires librarian token. Request body

{
  "default_loan_days": 14,
  "max_renewals": 2,
  "renewal_days": 7,
  "allow_public_catalog": true
}

`GET /api/library/student/loans`

Returns the currently authenticated student’s loans.

​Library API

​Authentication

​Routes

​POST /api/auth/login

​GET /api/library/catalog/<domain>

​GET /api/library/accounts?schoolId=<uuid>

​POST /api/library/invite

​PATCH /api/library/accounts/manage

​POST /api/library/books

​POST /api/library/copies

​GET /api/library/loans

​POST /api/library/loans

​PATCH /api/library/loans

​GET /api/library/settings

​PUT /api/library/settings

​GET /api/library/student/loans