docs / 07-api.md

Api

iTrades API & Server Interface

Purpose

This document defines conventions for communication between the iTrades interface, server-side application logic, and external integrations.

The exact implementation may include:

  • Next.js Server Actions
  • Route Handlers
  • Internal server services
  • External APIs

Principles

Authentication

Every protected server operation must verify the authenticated user.

Client-supplied user IDs must never be trusted as authorization.

Authorization

Users may only read or modify records they own or are explicitly permitted to access.

Validation

All mutation inputs must be validated server-side.

Client validation exists for user experience and does not replace server validation.

Financial Calculations

P&L logic should reside in shared server-side domain logic rather than being duplicated across API endpoints or UI components.

Proposed Domain Services

AccountService

TradeService

ExecutionService

JournalService

AnalyticsService

TradingViewService

ExportService

Future External Integrations

Potential integrations include:

  • TradingView
  • Broker APIs
  • Market data providers
  • Import services