Skip to main content

Two HTTP patterns

The client uses two different HTTP approaches — both coexist in the codebase:

1. Axios (configured in main.js)

Used in some components but not the primary pattern.

2. XMLHttpRequest (Promise-wrapped)

The dominant pattern across the codebase:
There’s no centralized API service layer. Each component defines its own API calls inline in its methods block. The apiFunctions.js file has a few shared helpers but most calls are component-local.

Authentication

For the backend implementation of the auth system (custom Redis token guard), see Authentication architecture.

How it works

  1. User logs in via POST /auth/login (or registers via POST /auth/register)
  2. Backend returns a session_key token
  3. Client stores it in component state (passed via props) or sessionStorage
  4. Subsequent requests include sessionKey header

Storage

  • Component statesession_key passed through props between components
  • sessionStorage — used in Dashboard (sessionStorage.setItem('session_key', ...))
  • No localStorage — session doesn’t persist across browser close
  • No refresh token mechanism — if the token expires, user must re-login
There’s no global auth store or interceptor. If a request returns 401, handling is component-specific. There’s no automatic redirect to login on auth failure.

API helper functions

File: src/assets/scripts/apiFunctions.js

Complete API endpoint map

Every API endpoint the client calls, mapped to the backend. For full backend endpoint documentation, see the API Reference.

Authentication (backend docs)

Users & profiles (backend docs)

Booking & lessons (backend docs)

Payments (backend docs)

Other

Data structures

No TypeScript — these are the implicit shapes used across the codebase:

User object

Registration payload

Booking payload

Error handling

No global error interceptor. Each component handles errors locally:
Specific error handling examples:
  • Login: 404 = user not found, 401 = invalid credentials
  • Payment: insufficient funds, 3D Secure failures with specific messages
  • Registration: duplicate email/username with API error text display