RenewCMS/docs/design/routes.md

Route map

A global router.beforeEach guard reads meta.auth. On the first navigation it resolves the session with GET /v1/auth/me and caches the result in the session store. useApi turns any 401 into /login?redirect=<path>&reason=expired and any 403 from an unverified account into /register/pending.

Path	Layout	Auth	Screen	API calls
/	none	any	Redirect	none; goes to /home or /login
/login	AuthShell	public	LoginPage	GET /v1/auth/registration · POST /v1/auth/login
/register	AuthShell	public	RegisterPage	POST /v1/auth/register
/register/pending	AuthShell	session	PendingPage	DELETE /v1/auth/register · POST /v1/auth/logout
/register/validate	AuthShell	public	VerifyPage	POST /v1/auth/verify (+ POST /login inline on 401)
/register/reset/request	AuthShell	public	ResetRequestPage	POST /v1/auth/password-reset
/register/reset/validate	AuthShell	public	ResetConfirmPage	POST /v1/auth/password-reset/confirm
/home	DashboardShell	verified	HomePage	GET /v1/article/ · GET /v1/activity?size=5 · GET /v1/system/update (owner, for the banner)
/article	DashboardShell	verified	ArticlesPage	GET /v1/article/ · PATCH /{id}/publish|unpublish · DELETE /{id}
/article/new	DashboardShell	verified	ArticlesPage + NewArticleModal	POST /v1/article/
/article/:id/edit	DashboardShell	verified	EditorPage	GET /{id} · PATCH /{id} · PATCH /{id}/publish|unpublish · GET /v1/media/ · POST /v1/media/ · DELETE /{id}
/media	DashboardShell	verified	MediaPage	GET /v1/media/purge-preview · POST /v1/media/purge · GET /v1/media/ · POST /v1/media/ · PATCH /v1/media/{id} · DELETE /v1/media/{id} · POST /v1/media/merge · GET /v1/media/{id}/usage
/activity	DashboardShell	verified	ActivityPage + ActivityDetailsPanel	GET /v1/activity · GET /v1/activity/summary (owner, admin) · GET /v1/activity/export (owner, admin)
/integration	DashboardShell	verified	IntegrationPage	none
/integration/api-keys	DashboardShell	verified	ApiKeysPage + CreateApiKeyModal	GET /v1/api-key · POST /v1/api-key · DELETE /v1/api-key/{id}
/users	DashboardShell	verified	UsersPage + InviteUserModal	GET /v1/user/ · POST /v1/user/invite · DELETE /v1/user/invite/:id · POST /v1/user/invite/:id/renew
/settings	DashboardShell	verified	SettingsPage	GET /v1/settings · PATCH /v1/settings (owner, retention) · GET /v1/system/update · POST /v1/system/update/check · POST /v1/system/update/download · POST /v1/system/update/restart · GET /v1/media/purge-settings · PATCH /v1/media/purge-settings · GET /v1/media/purge-preview · POST /v1/media/purge
/profile	DashboardShell	verified	ProfilePage	GET /v1/auth/me · PATCH /v1/user/me · POST /v1/auth/password-reset
/invite/accept	AuthShell	public	AcceptInvitePage	GET /v1/auth/invite?c=* · POST /v1/auth/invite/accept*
/:pathMatch(.*)*	either	any	NotFoundPage	none

Auth values: public needs no session, session needs a logged-in account (verified or not), verified needs a verified account, any applies to redirects and the catch-all.