Spaces:
Running
Running
feat: implement core backend POS API with authentication, role-based access control, menu management, and order processing logic.
1e480b5 | const jwt = require('jsonwebtoken'); | |
| const User = require('../models/User'); | |
| const { log } = require('../utils/activityLogger'); | |
| const signTokens = (id) => { | |
| const access = jwt.sign({ id }, process.env.JWT_SECRET, { expiresIn: process.env.JWT_EXPIRES_IN || '15m' }); | |
| const refresh = jwt.sign({ id }, process.env.JWT_REFRESH_SECRET, { expiresIn: process.env.JWT_REFRESH_EXPIRES_IN || '7d' }); | |
| return { access, refresh }; | |
| }; | |
| // POST /api/auth/login | |
| exports.login = async (req, res) => { | |
| const { username, password } = req.body; | |
| if (!username || !password) return res.status(400).json({ message: 'Username and password required' }); | |
| const user = await User.findOne({ username: username.toLowerCase().trim() }); | |
| if (!user || !user.active) return res.status(401).json({ message: 'Invalid credentials' }); | |
| const match = await user.matchPassword(password); | |
| if (!match) return res.status(401).json({ message: 'Invalid credentials' }); | |
| const { access, refresh } = signTokens(user._id); | |
| log(user, 'LOGIN', { ip: req.ip }); | |
| res.json({ token: access, refreshToken: refresh, user }); | |
| }; | |
| // POST /api/auth/refresh | |
| exports.refresh = async (req, res) => { | |
| const { refreshToken } = req.body; | |
| if (!refreshToken) return res.status(400).json({ message: 'Refresh token required' }); | |
| try { | |
| const decoded = jwt.verify(refreshToken, process.env.JWT_REFRESH_SECRET); | |
| const user = await User.findById(decoded.id); | |
| if (!user || !user.active) return res.status(401).json({ message: 'User not found' }); | |
| const { access, refresh } = signTokens(user._id); | |
| res.json({ token: access, refreshToken: refresh }); | |
| } catch { | |
| res.status(401).json({ message: 'Invalid refresh token' }); | |
| } | |
| }; | |
| // GET /api/auth/me | |
| exports.me = async (req, res) => { | |
| res.json(req.user); | |
| }; | |