Blame for src/controllers/userController.js

const User = require('../models/User');
const { log } = require('../utils/activityLogger');

// GET /api/users
exports.getUsers = async (req, res) => {
  const users = await User.find().sort({ createdAt: -1 });
  res.json(users);
};

// POST /api/users — create cashier (owner only)
exports.createUser = async (req, res) => {
  const { name, username, password, role } = req.body;
  if (!name || !username || !password) return res.status(400).json({ message: 'name, username and password required' });

  const exists = await User.findOne({ username: username.toLowerCase() });
  if (exists) return res.status(400).json({ message: 'Username already taken' });

  const user = await User.create({ name, username, password, role: role || 'cashier' });
  log(req.user, 'CREATE_USER', { entity: 'User', entityId: user._id, detail: `Created ${user.username} (${user.role})` });
  res.status(201).json(user);
};

// PUT /api/users/:id — update user (toggle active, reset password, set adminPin)
exports.updateUser = async (req, res) => {
  const user = await User.findById(req.params.id);
  if (!user) return res.status(404).json({ message: 'User not found' });

  const { name, password, active, adminPin } = req.body;
  if (name) user.name = name;
  if (typeof active === 'boolean') user.active = active;
  if (password) user.password = password; // pre-save hook will hash
  if (adminPin) user.adminPin = adminPin; // pre-save hook will hash

  await user.save();
  log(req.user, 'UPDATE_USER', { entity: 'User', entityId: user._id, detail: `Updated ${user.username}` });
  res.json(user);
};