# Route & API Inventory (Nitescape)

This doc is the **source of truth** for what must be **public** vs **admin-protected** as we implement NextAuth + middleware and refactor APIs.

## Page routes (App Router)

### Public
- `/` (home): `app/(home)/page.tsx`
- `/projects`: `app/(home)/projects/page.tsx`
- `/projects/[id]`: `app/(home)/projects/[id]/page.tsx`
- `/watts-lights`: `app/(home)/watts-lights/page.tsx`

### Admin-only
- `/admin`: `app/(admin)/admin/page.tsx`
- `/admin/dashboard`: `app/(admin)/admin/dashboard/page.tsx`
- `/admin/navbar`: `app/(admin)/admin/navbar/page.tsx`
- `/admin/hero`: `app/(admin)/admin/hero/page.tsx`
- `/admin/bold`: `app/(admin)/admin/bold/page.tsx`
- `/admin/watts`: `app/(admin)/admin/watts/page.tsx`
- `/admin/watts-lights`: `app/(admin)/admin/watts-lights/page.tsx`
- `/admin/about`: `app/(admin)/admin/about/page.tsx`
- `/admin/services`: `app/(admin)/admin/services/page.tsx`
- `/admin/projects`: `app/(admin)/admin/projects/page.tsx`
- `/admin/contact-cards`: `app/(admin)/admin/contact-cards/page.tsx`
- `/admin/socials`: `app/(admin)/admin/socials/page.tsx`
- `/admin/email`: `app/(admin)/admin/email/page.tsx`
- `/admin/google`: `app/(admin)/admin/google/page.tsx`
- `/admin/seo`: `app/(admin)/admin/seo/page.tsx`
- `/admin/seo/[type]/[id]`: `app/(admin)/admin/seo/[type]/[id]/page.tsx`

### Needs review (likely admin-only)
- `/seo`: `app/(admin)/seo/page.tsx`
  - Reads from `/api/seo` and links into `/admin/seo/...`.
  - We will treat it as admin-only unless you explicitly want it public.

## API routes (`app/api/*`)

Legend:
- **Public**: must be callable without admin session
- **Admin**: must require admin session for all mutating methods (and for some reads)

### Public (unauthenticated)
- `POST /api/contact` (send email + verify reCAPTCHA): `app/api/contact/route.ts`
- `GET /api/projects` (public project list): `app/api/projects/route.ts`
- `GET /api/projects/[id]` (public project details): `app/api/projects/[id]/route.ts`
- `GET /api/services`: `app/api/services/route.ts`
- `GET /api/about`: `app/api/about/route.ts`
- `GET /api/about/sectionmeta`: `app/api/about/sectionmeta/route.ts`
- `GET /api/navbar`: `app/api/navbar/route.ts`
- `GET /api/hero`: `app/api/hero/route.ts`
- `GET /api/bold`: `app/api/bold/route.ts`
- `GET /api/watts`: `app/api/watts/route.ts`
- `GET /api/watts-lights`: `app/api/watts-lights/route.ts`
- `GET /api/services-cta`: `app/api/services-cta/route.ts`
- `GET /api/social-links` (active only): `app/api/social-links/route.ts`
- `GET /api/uploads/[filename]` (serves uploaded media): `app/api/uploads/[filename]/route.ts`
  - **Important**: must be hardened against path traversal.

### Admin-only (requires admin session)
- Uploads:
  - `POST /api/upload`, `DELETE /api/upload`: `app/api/upload/route.ts`
- CRUD content:
  - `POST /api/projects`, `DELETE /api/projects`: `app/api/projects/route.ts`
  - `PUT|DELETE /api/projects/[id]`: `app/api/projects/[id]/route.ts`
  - `POST|DELETE /api/services`: `app/api/services/route.ts`
  - `POST|DELETE /api/about`: `app/api/about/route.ts`
  - `POST /api/about/sectionmeta`: `app/api/about/sectionmeta/route.ts`
  - `POST /api/navbar` + `PUT /api/navbar`: `app/api/navbar/route.ts`
  - `POST /api/hero`: `app/api/hero/route.ts`
  - `POST|DELETE /api/bold`: `app/api/bold/route.ts`
  - `POST /api/watts`: `app/api/watts/route.ts`
  - `PUT /api/watts-lights`: `app/api/watts-lights/route.ts`
  - `POST /api/services-cta`: `app/api/services-cta/route.ts`
  - `POST|PUT|DELETE /api/social-links`: `app/api/social-links/route.ts`
- Admin settings (high sensitivity):
  - `GET|POST /api/email/settings`: `app/api/email/settings/route.ts`
  - `GET|POST /api/google-settings`: `app/api/google-settings/route.ts`
- SEO (admin-only):
  - `GET|POST|PUT|DELETE /api/seo`: `app/api/seo/route.ts`
  - `GET|PUT|DELETE /api/seo/[id]`: `app/api/seo/[id]/route.ts`


