11 files changed, 435 insertions, 125 deletions
diff --git a/crates/rocie-server/src/api/get/inventory.rs b/crates/rocie-server/src/api/get/auth/inventory.rs
index d1ca436..24a8e3d 100644
--- a/crates/rocie-server/src/api/get/inventory.rs
+++ b/crates/rocie-server/src/api/get/auth/inventory.rs
@@ -1,8 +1,12 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, get, web};
 
 use crate::{
     app::App,
-    storage::sql::{product::{ProductId, ProductIdStub}, product_amount::ProductAmount},
+    storage::sql::{
+        product::{ProductId, ProductIdStub},
+        product_amount::ProductAmount,
+    },
 };
 
 /// Get the amount of an product
@@ -18,6 +22,10 @@ use crate::{
             description = "Product not found in database"
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -34,6 +42,7 @@ use crate::{
 pub(crate) async fn amount_by_id(
     app: web::Data<App>,
     id: web::Path<ProductIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
diff --git a/crates/rocie-server/src/api/get/auth/mod.rs b/crates/rocie-server/src/api/get/auth/mod.rs
new file mode 100644
index 0000000..c51f6a7
--- /dev/null
+++ b/crates/rocie-server/src/api/get/auth/mod.rs
@@ -0,0 +1,32 @@
+use actix_web::web;
+
+pub(crate) mod inventory;
+pub(crate) mod product;
+pub(crate) mod product_parent;
+pub(crate) mod recipe;
+pub(crate) mod unit;
+pub(crate) mod unit_property;
+pub(crate) mod user;
+
+pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {
+    cfg.service(inventory::amount_by_id)
+        .service(product::product_by_id)
+        .service(product::product_by_name)
+        .service(product::product_suggestion_by_name)
+        .service(product::products_by_product_parent_id_direct)
+        .service(product::products_by_product_parent_id_indirect)
+        .service(product::products_in_storage)
+        .service(product::products_registered)
+        .service(product_parent::product_parents)
+        .service(product_parent::product_parents_toplevel)
+        .service(product_parent::product_parents_under)
+        .service(recipe::recipe_by_id)
+        .service(recipe::recipes)
+        .service(unit::unit_by_id)
+        .service(unit::units)
+        .service(unit::units_by_property_id)
+        .service(unit_property::unit_properties)
+        .service(unit_property::unit_property_by_id)
+        .service(user::users)
+        .service(user::user_by_id);
+}
diff --git a/crates/rocie-server/src/api/get/product.rs b/crates/rocie-server/src/api/get/auth/product.rs
index 4216f9b..1a1e31d 100644
--- a/crates/rocie-server/src/api/get/product.rs
+++ b/crates/rocie-server/src/api/get/auth/product.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpRequest, HttpResponse, Responder, Result, get, web};
 use log::info;
 use percent_encoding::percent_decode_str;
@@ -31,23 +32,43 @@ impl UrlEncodedString {
 /// Get Product by id
 #[utoipa::path(
     responses(
-        (status = OK, description = "Product found from database", body = Product),
-        (status = NOT_FOUND, description = "Product not found in database"),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Product found from database",
+            body = Product
+        ),
+        (
+            status = NOT_FOUND,
+            description = "Product not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("id" = ProductId, description = "Product id" ),
+        (
+            "id" = ProductId,
+            description = "Product id"
+        ),
     )
 )]
 #[get("/product/by-id/{id}")]
 pub(crate) async fn product_by_id(
     app: web::Data<App>,
     id: web::Path<ProductIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
     match Product::from_id(&app, id.into()).await? {
         Some(product) => Ok(HttpResponse::Ok().json(product)),
+
         None => Ok(HttpResponse::NotFound().finish()),
     }
 }
@@ -55,12 +76,30 @@ pub(crate) async fn product_by_id(
 /// Get Product by name
 #[utoipa::path(
     responses(
-        (status = OK, description = "Product found from database", body = Product),
-        (status = NOT_FOUND, description = "Product not found in database"),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Product found from database",
+            body = Product
+        ),
+        (
+            status = NOT_FOUND,
+            description = "Product not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("name" = String, description = "Name of the product" ),
+        (
+            "name" = String,
+            description = "Name of the product"
+        ),
     )
 )]
 #[get("/product/by-name/{name}")]
@@ -68,6 +107,7 @@ pub(crate) async fn product_by_name(
     app: web::Data<App>,
     req: HttpRequest,
     name: web::Path<String>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     drop(name);
 
@@ -80,6 +120,7 @@ pub(crate) async fn product_by_name(
 
     match Product::from_name(&app, name).await? {
         Some(product) => Ok(HttpResponse::Ok().json(product)),
+
         None => Ok(HttpResponse::NotFound().finish()),
     }
 }
@@ -87,11 +128,26 @@ pub(crate) async fn product_by_name(
 /// Get Product suggestion by name
 #[utoipa::path(
     responses(
-        (status = OK, description = "Product suggestions found from database", body = Vec<Product>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Product suggestions found from database",
+            body = Vec<Product>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("name" = String, description = "Partial name of a product" ),
+        (
+            "name" = String,
+            description = "Partial name of a product"
+        ),
     )
 )]
 #[get("/product/by-part-name/{name}")]
@@ -99,6 +155,7 @@ pub(crate) async fn product_suggestion_by_name(
     app: web::Data<App>,
     req: HttpRequest,
     name: web::Path<String>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     drop(name);
 
@@ -122,12 +179,27 @@ pub(crate) async fn product_suggestion_by_name(
 /// Return all registered products
 #[utoipa::path(
     responses(
-        (status = OK, description = "All products found", body = Vec<Product>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "All products found",
+            body = Vec<Product>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
 )]
 #[get("/products_registered/")]
-pub(crate) async fn products_registered(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn products_registered(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
     let all = Product::get_all(&app).await?;
 
     Ok(HttpResponse::Ok().json(all))
@@ -136,12 +208,27 @@ pub(crate) async fn products_registered(app: web::Data<App>) -> Result<impl Resp
 /// Return all products, which non-null amount in storage
 #[utoipa::path(
     responses(
-        (status = OK, description = "All products found", body = Vec<Product>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "All products found",
+            body = Vec<Product>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
 )]
 #[get("/products_in_storage/")]
-pub(crate) async fn products_in_storage(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn products_in_storage(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
     let all = Product::get_all(&app).await?;
 
     let mut output_products = Vec::with_capacity(all.len());
@@ -161,18 +248,37 @@ pub(crate) async fn products_in_storage(app: web::Data<App>) -> Result<impl Resp
 /// This will also return all products below this product parent id
 #[utoipa::path(
     responses(
-        (status = OK, description = "Products found from database", body = Vec<Product>),
-        (status = NOT_FOUND, description = "Product parent id not found in database"),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Products found from database",
+            body = Vec<Product>
+        ),
+        (
+            status = NOT_FOUND,
+            description = "Product parent id not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("id" = ProductParentId, description = "Product parent id" ),
+        (
+            "id" = ProductParentId,
+            description = "Product parent id"
+        ),
     )
 )]
 #[get("/product/by-product-parent-id-indirect/{id}")]
 pub(crate) async fn products_by_product_parent_id_indirect(
     app: web::Data<App>,
     id: web::Path<ProductParentIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
@@ -208,18 +314,37 @@ pub(crate) async fn products_by_product_parent_id_indirect(
 /// This will only return products directly associated with this product parent id
 #[utoipa::path(
     responses(
-        (status = OK, description = "Products found from database", body = Vec<Product>),
-        (status = NOT_FOUND, description = "Product parent id not found in database"),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
+        (
+            status = OK,
+            description = "Products found from database",
+            body = Vec<Product>
+        ),
+        (
+            status = NOT_FOUND,
+            description = "Product parent id not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
     ),
     params(
-        ("id" = ProductParentId, description = "Product parent id" ),
+        (
+            "id" = ProductParentId,
+            description = "Product parent id"
+        ),
     )
 )]
 #[get("/product/by-product-parent-id-direct/{id}")]
 pub(crate) async fn products_by_product_parent_id_direct(
     app: web::Data<App>,
     id: web::Path<ProductParentIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
diff --git a/crates/rocie-server/src/api/get/auth/product_parent.rs b/crates/rocie-server/src/api/get/auth/product_parent.rs
new file mode 100644
index 0000000..6c3351d
--- /dev/null
+++ b/crates/rocie-server/src/api/get/auth/product_parent.rs
@@ -0,0 +1,111 @@
+use actix_identity::Identity;
+use actix_web::{HttpResponse, Responder, error::Result, get, web};
+
+use crate::{
+    app::App,
+    storage::sql::product_parent::{ProductParent, ProductParentId, ProductParentIdStub},
+};
+
+/// Return all registered product parents
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "All parents found",
+            body = Vec<ProductParent>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+)]
+#[get("/product_parents/")]
+pub(crate) async fn product_parents(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
+    let all: Vec<ProductParent> = ProductParent::get_all(&app).await?;
+
+    Ok(HttpResponse::Ok().json(all))
+}
+
+/// Return all registered product parents, that have no parents themselves
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "All parents found",
+            body = Vec<ProductParent>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+)]
+#[get("/product_parents_toplevel/")]
+pub(crate) async fn product_parents_toplevel(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
+    let all: Vec<ProductParent> = ProductParent::get_all(&app)
+        .await?
+        .into_iter()
+        .filter(|parent| parent.parent.is_none())
+        .collect();
+
+    Ok(HttpResponse::Ok().json(all))
+}
+
+/// Return all parents, that have this parent as parent
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "All parents found",
+            body = Vec<ProductParent>
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+    params(
+        (
+            "id" = ProductParentId,
+            description = "Product parent id"
+        ),
+    ),
+)]
+#[get("/product_parents_under/{id}")]
+pub(crate) async fn product_parents_under(
+    app: web::Data<App>,
+    id: web::Path<ProductParentIdStub>,
+    _user: Identity,
+) -> Result<impl Responder> {
+    let id = id.into_inner().into();
+
+    let all: Vec<_> = ProductParent::get_all(&app)
+        .await?
+        .into_iter()
+        .filter(|parent| parent.parent.is_some_and(|found| found == id))
+        .collect();
+
+    Ok(HttpResponse::Ok().json(all))
+}
diff --git a/crates/rocie-server/src/api/get/recipe.rs b/crates/rocie-server/src/api/get/auth/recipe.rs
index 70bab39..cb80597 100644
--- a/crates/rocie-server/src/api/get/recipe.rs
+++ b/crates/rocie-server/src/api/get/auth/recipe.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, error::Result, get, web};
 
 use crate::{
@@ -14,6 +15,10 @@ use crate::{
             body = Recipe,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = NOT_FOUND,
             description = "Recipe not found in database"
         ),
@@ -34,6 +39,7 @@ use crate::{
 pub(crate) async fn recipe_by_id(
     app: web::Data<App>,
     id: web::Path<RecipeIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
@@ -52,6 +58,10 @@ pub(crate) async fn recipe_by_id(
             body = Recipe,
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -59,7 +69,7 @@ pub(crate) async fn recipe_by_id(
     ),
 )]
 #[get("/recipe/all")]
-pub(crate) async fn recipes(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn recipes(app: web::Data<App>, _user: Identity) -> Result<impl Responder> {
     let all = Recipe::get_all(&app).await?;
 
     Ok(HttpResponse::Ok().json(all))
diff --git a/crates/rocie-server/src/api/get/unit.rs b/crates/rocie-server/src/api/get/auth/unit.rs
index caafaa3..980d9c7 100644
--- a/crates/rocie-server/src/api/get/unit.rs
+++ b/crates/rocie-server/src/api/get/auth/unit.rs
@@ -1,3 +1,4 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, get, web};
 
 use crate::{
@@ -17,6 +18,10 @@ use crate::{
             body = Vec<Unit>
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -24,7 +29,7 @@ use crate::{
     ),
 )]
 #[get("/units/")]
-pub(crate) async fn units(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn units(app: web::Data<App>, _user: Identity) -> Result<impl Responder> {
     let all = Unit::get_all(&app).await?;
 
     Ok(HttpResponse::Ok().json(all))
@@ -39,6 +44,10 @@ pub(crate) async fn units(app: web::Data<App>) -> Result<impl Responder> {
             body = Vec<Unit>
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -55,6 +64,7 @@ pub(crate) async fn units(app: web::Data<App>) -> Result<impl Responder> {
 pub(crate) async fn units_by_property_id(
     app: web::Data<App>,
     id: web::Path<UnitPropertyIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
     let all = Unit::get_all(&app)
@@ -75,6 +85,10 @@ pub(crate) async fn units_by_property_id(
             body = Unit
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = NOT_FOUND,
             description = "Unit not found in database"
         ),
@@ -95,6 +109,7 @@ pub(crate) async fn units_by_property_id(
 pub(crate) async fn unit_by_id(
     app: web::Data<App>,
     id: web::Path<UnitIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
diff --git a/crates/rocie-server/src/api/get/unit_property.rs b/crates/rocie-server/src/api/get/auth/unit_property.rs
index 3160480..f5b070a 100644
--- a/crates/rocie-server/src/api/get/unit_property.rs
+++ b/crates/rocie-server/src/api/get/auth/unit_property.rs
@@ -1,10 +1,9 @@
+use actix_identity::Identity;
 use actix_web::{HttpResponse, Responder, Result, get, web};
 
 use crate::{
     app::App,
-    storage::sql::{
-        unit_property::{UnitProperty, UnitPropertyId, UnitPropertyIdStub},
-    },
+    storage::sql::unit_property::{UnitProperty, UnitPropertyId, UnitPropertyIdStub},
 };
 
 /// Return all registered unit properties
@@ -16,6 +15,10 @@ use crate::{
             body = Vec<UnitProperty>
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -23,7 +26,10 @@ use crate::{
     ),
 )]
 #[get("/unit-properties/")]
-pub(crate) async fn unit_properties(app: web::Data<App>) -> Result<impl Responder> {
+pub(crate) async fn unit_properties(
+    app: web::Data<App>,
+    _user: Identity,
+) -> Result<impl Responder> {
     let all = UnitProperty::get_all(&app).await?;
 
     Ok(HttpResponse::Ok().json(all))
@@ -42,6 +48,10 @@ pub(crate) async fn unit_properties(app: web::Data<App>) -> Result<impl Responde
             description = "Unit Property not found in database"
         ),
         (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
             status = INTERNAL_SERVER_ERROR,
             description = "Server encountered error",
             body = String
@@ -58,6 +68,7 @@ pub(crate) async fn unit_properties(app: web::Data<App>) -> Result<impl Responde
 pub(crate) async fn unit_property_by_id(
     app: web::Data<App>,
     id: web::Path<UnitPropertyIdStub>,
+    _user: Identity,
 ) -> Result<impl Responder> {
     let id = id.into_inner();
 
diff --git a/crates/rocie-server/src/api/get/auth/user.rs b/crates/rocie-server/src/api/get/auth/user.rs
new file mode 100644
index 0000000..e4a5046
--- /dev/null
+++ b/crates/rocie-server/src/api/get/auth/user.rs
@@ -0,0 +1,85 @@
+use actix_identity::Identity;
+use actix_web::{HttpResponse, Responder, Result, get, web};
+
+use crate::{
+    app::App,
+    storage::sql::user::{User, UserId, UserIdStub},
+};
+
+/// Get all registered users.
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "Users found in database and fetched",
+            body = Vec<User>,
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+)]
+#[get("/users")]
+async fn users(app: web::Data<App>, _user: Identity) -> Result<impl Responder> {
+    let output = User::get_all(&app).await?;
+
+    Ok(HttpResponse::Ok().json(output))
+}
+
+/// Get an specific user by id.
+#[utoipa::path(
+    responses(
+        (
+            status = OK,
+            description = "User found in database and fetched",
+            body = User,
+        ),
+        (
+            status = NOT_FOUND,
+            description = "User not found in database"
+        ),
+        (
+            status = UNAUTHORIZED,
+            description = "You did not login before calling this endpoint",
+        ),
+        (
+            status = FORBIDDEN,
+            description = "The current logged in user is not allowed to access this end-point."
+        ),
+        (
+            status = INTERNAL_SERVER_ERROR,
+            description = "Server encountered error",
+            body = String
+        )
+    ),
+    params(
+        (
+            "id" = UserId,
+            description = "User id"
+        ),
+    )
+)]
+#[get("/user/{id}")]
+async fn user_by_id(
+    id: web::Path<UserIdStub>,
+    app: web::Data<App>,
+    user: Identity,
+) -> Result<impl Responder> {
+    let id: UserId = id.into_inner().into();
+
+    if user.id().expect("to have one") != id.to_string() {
+        return Ok(HttpResponse::Forbidden()
+            .body("You must be logged-in as the same user, you request the info for."));
+    }
+
+    match User::from_id(&app, id).await? {
+        Some(user) => Ok(HttpResponse::Ok().json(user)),
+        None => Ok(HttpResponse::NotFound().finish()),
+    }
+}
diff --git a/crates/rocie-server/src/api/get/mod.rs b/crates/rocie-server/src/api/get/mod.rs
index 487b55c..c6ee9ab 100644
--- a/crates/rocie-server/src/api/get/mod.rs
+++ b/crates/rocie-server/src/api/get/mod.rs
@@ -1,29 +1,2 @@
-use actix_web::web;
-
-pub(crate) mod inventory;
-pub(crate) mod product;
-pub(crate) mod product_parent;
-pub(crate) mod recipe;
-pub(crate) mod unit;
-pub(crate) mod unit_property;
-
-pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {
-    cfg.service(product::product_by_id)
-        .service(product::product_by_name)
-        .service(product::product_suggestion_by_name)
-        .service(product::products_registered)
-        .service(product::products_in_storage)
-        .service(product::products_by_product_parent_id_indirect)
-        .service(product::products_by_product_parent_id_direct)
-        .service(product_parent::product_parents)
-        .service(product_parent::product_parents_toplevel)
-        .service(product_parent::product_parents_under)
-        .service(recipe::recipe_by_id)
-        .service(recipe::recipes)
-        .service(unit::units)
-        .service(unit::units_by_property_id)
-        .service(unit::unit_by_id)
-        .service(unit_property::unit_properties)
-        .service(unit_property::unit_property_by_id)
-        .service(inventory::amount_by_id);
-}
+pub(crate) mod auth;
+pub(crate) mod no_auth;
diff --git a/crates/rocie-server/src/api/get/no_auth/mod.rs b/crates/rocie-server/src/api/get/no_auth/mod.rs
new file mode 100644
index 0000000..38a041c
--- /dev/null
+++ b/crates/rocie-server/src/api/get/no_auth/mod.rs
@@ -0,0 +1,3 @@
+use actix_web::web;
+
+pub(crate) fn register_paths(cfg: &mut web::ServiceConfig) {}
diff --git a/crates/rocie-server/src/api/get/product_parent.rs b/crates/rocie-server/src/api/get/product_parent.rs
deleted file mode 100644
index a62397c..0000000
--- a/crates/rocie-server/src/api/get/product_parent.rs
+++ /dev/null
@@ -1,64 +0,0 @@
-use actix_web::{HttpResponse, Responder, error::Result, get, web};
-
-use crate::{
-    app::App,
-    storage::sql::product_parent::{ProductParent, ProductParentId, ProductParentIdStub},
-};
-
-/// Return all registered product parents
-#[utoipa::path(
-    responses(
-        (status = OK, description = "All parents found", body = Vec<ProductParent>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
-    ),
-)]
-#[get("/product_parents/")]
-pub(crate) async fn product_parents(app: web::Data<App>) -> Result<impl Responder> {
-    let all: Vec<ProductParent> = ProductParent::get_all(&app).await?;
-
-    Ok(HttpResponse::Ok().json(all))
-}
-
-/// Return all registered product parents, that have no parents themselves
-#[utoipa::path(
-    responses(
-        (status = OK, description = "All parents found", body = Vec<ProductParent>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
-    ),
-)]
-#[get("/product_parents_toplevel/")]
-pub(crate) async fn product_parents_toplevel(app: web::Data<App>) -> Result<impl Responder> {
-    let all: Vec<ProductParent> = ProductParent::get_all(&app)
-        .await?
-        .into_iter()
-        .filter(|parent| parent.parent.is_none())
-        .collect();
-
-    Ok(HttpResponse::Ok().json(all))
-}
-
-/// Return all parents, that have this parent as parent
-#[utoipa::path(
-    responses(
-        (status = OK, description = "All parents found", body = Vec<ProductParent>),
-        (status = INTERNAL_SERVER_ERROR, description = "Server encountered error", body = String)
-    ),
-    params(
-        ("id" = ProductParentId, description = "Product parent id" ),
-    ),
-)]
-#[get("/product_parents_under/{id}")]
-pub(crate) async fn product_parents_under(
-    app: web::Data<App>,
-    id: web::Path<ProductParentIdStub>,
-) -> Result<impl Responder> {
-    let id = id.into_inner().into();
-
-    let all: Vec<_> = ProductParent::get_all(&app)
-        .await?
-        .into_iter()
-        .filter(|parent| parent.parent.is_some_and(|found| found == id))
-        .collect();
-
-    Ok(HttpResponse::Ok().json(all))
-}