README.md

---
title: Paddock API
emoji: 🏇
colorFrom: gray
colorTo: yellow
sdk: docker
app_port: 7860
pinned: false
---

# Paddock API

Node/Express backend for a white-label horse racing betting platform. SQLite, no
external services, migrates and seeds itself on boot.

## Endpoints

| Module | Count | Base |
|---|---|---|
| Race events | 6 | `/api/race-events` |
| Odds | 3 | `/api/race-events/:id/odds` |
| Betting | 4 | `/api/bets` |
| Settlement | 5 | `/api/settlements` |
| Content | 8 | `/api/teams`, `/api/jockeys` |

Plus `/api/health`, `/api/auth/login`, `/api/me`.

## Sign in

```
POST /api/auth/login  {"email":"ops@paddock.io","password":"super"}          role 1, sees every operator
POST /api/auth/login  {"email":"admin@meridian.in","password":"meridian"}    role 2, sees its own rows
POST /api/auth/login  {"email":"admin@kingsgate.in","password":"kingsgate"}  role 2, sees its own rows
```

Send the returned token as `Authorization: Bearer <token>` on every other call.

## Notes

The multi-tenant guarantee is a SQL `WHERE` clause, not an application-layer
filter — a role-2 admin who forges another operator's id gets an empty result
set from the database rather than a row that code has to remember to reject.

Straight bets snapshot the price at placement (`struck_odds`); exotics settle
pari-mutuel from the net pool. Settlement writes payouts and the audit row in a
single transaction.

The database lives in `/tmp` and resets when the Space restarts. Point `DB_PATH`
at a mounted volume, or swap `node:sqlite` for Postgres, to persist.