Spaces:
Running
Running
feat: implement core backend POS API with authentication, role-based access control, menu management, and order processing logic.
1e480b5 | const User = require('../models/User'); | |
| const { log } = require('../utils/activityLogger'); | |
| // GET /api/users | |
| exports.getUsers = async (req, res) => { | |
| const users = await User.find().sort({ createdAt: -1 }); | |
| res.json(users); | |
| }; | |
| // POST /api/users — create cashier (owner only) | |
| exports.createUser = async (req, res) => { | |
| const { name, username, password, role } = req.body; | |
| if (!name || !username || !password) return res.status(400).json({ message: 'name, username and password required' }); | |
| const exists = await User.findOne({ username: username.toLowerCase() }); | |
| if (exists) return res.status(400).json({ message: 'Username already taken' }); | |
| const user = await User.create({ name, username, password, role: role || 'cashier' }); | |
| log(req.user, 'CREATE_USER', { entity: 'User', entityId: user._id, detail: `Created ${user.username} (${user.role})` }); | |
| res.status(201).json(user); | |
| }; | |
| // PUT /api/users/:id — update user (toggle active, reset password, set adminPin) | |
| exports.updateUser = async (req, res) => { | |
| const user = await User.findById(req.params.id); | |
| if (!user) return res.status(404).json({ message: 'User not found' }); | |
| const { name, password, active, adminPin } = req.body; | |
| if (name) user.name = name; | |
| if (typeof active === 'boolean') user.active = active; | |
| if (password) user.password = password; // pre-save hook will hash | |
| if (adminPin) user.adminPin = adminPin; // pre-save hook will hash | |
| await user.save(); | |
| log(req.user, 'UPDATE_USER', { entity: 'User', entityId: user._id, detail: `Updated ${user.username}` }); | |
| res.json(user); | |
| }; | |