Cursor rule

1---
2globs: "frontend/**/*,web/**/*,app/**/*,src/pages/**/*,src/components/**/*"
3description: "Frontend — auth contract та орієнтири (основний стек визначає інший розробник)"
4---
5 
6# Frontend — buero.de
7 
8Frontend stack and detailed UI conventions are defined by the **frontend developer**. This rule documents the **auth contract** and integration points the backend provides; backend owner is responsible for correct auth setup and CORS so the frontend can integrate.
9 
10## Auth contract (для інтеграції з бекендом)
11 
12- **Tokens in cookie only:** `access_token`, `refresh_token` (names and options in docs/auth-spec.md, docs/auth-config.md). Do not store tokens in localStorage (XSS). Send cookies with requests; optional fallback: `Authorization: Bearer <access_token>`.
13- **API base URL and credentials:** use one HTTP client with baseURL and **withCredentials: true** for cookie. On 401: try refresh (POST /auth/refresh with refresh cookie), then redirect to login if refresh fails.
14- **UI languages:** EN / DE (users.language or Accept-Language); architecture requires EN/DE support.
15 
16## Орієнтири (з architecture)
17 
18- **Roles:** student vs teacher; student — courses, progress, lesson request; teacher — CRUD courses/materials, lesson_requests.
19- **Content access:** show course list and materials only when user has active subscription or trial; otherwise CTA to Placement Test / subscription.
20- **UI/UX:** minimal design, focus on learning scenarios; mobile-friendly; immediate feedback in quiz.
21 
22Concrete stack (React/Vue, UI library) and full frontend rules are set by the frontend developer.
23