Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/123048152-JJDS/CafeteriaPM_S203/llms.txt

Use this file to discover all available pages before exploring further.

CafeteriaPM enforces role-based access control on every protected endpoint using the require_roles dependency. When you authenticate, your role is embedded in the JWT token under the rol claim. On each request the API validates that claim against the endpoint’s allowed-role list and returns 403 Forbidden if your role is not permitted — no client-side enforcement is relied upon.

​
Roles Overview

admin

Full system access. Manages users, products, tables, and orders. Accesses all statistics, reports, and financial summaries. The only role that can create or delete user accounts.

mesero

Waiter role. Creates and tracks orders, manages table occupancy (occupy / free), and browses the full product catalog. Cannot access financial data or user management.

caja

Cashier role. Processes payments via POST /ventas/, registers expenses, views sales history, and accesses the dashboard summary. Cannot create orders or manage inventory.

cocina

Kitchen role. Views the kitchen queue, manages ingredients and inventory stock, registers supply purchases, and can create or edit products. Cannot access financial or user data.

​
Permission Matrix

The table below maps key endpoints to the roles that may call them, derived directly from the require_roles(...) guards in the source code.
Endpointadminmeserocajacocina
GET /usuarios/✅❌❌❌
POST /usuarios/✅❌❌❌
GET /productos/✅✅✅✅
POST /productos/✅❌❌✅
DELETE /productos/{id}✅❌❌❌
POST /pedidos/✅✅❌❌
PATCH /pedidos/{id}/estado✅✅✅✅
DELETE /pedidos/{id}✅❌❌❌
POST /ventas/✅❌✅❌
GET /ventas/✅❌✅❌
POST /gastos/✅❌✅❌
GET /gastos/✅❌✅❌
POST /mesas/ (create)✅❌❌❌
PATCH /mesas/{id}/ocupar✅✅❌❌
PATCH /mesas/{id}/liberar✅✅✅❌
GET /compras/✅❌❌✅
POST /compras/✅❌❌✅
GET /stats/dashboard✅❌✅❌
GET /stats/productos-estadisticas✅❌❌❌
GET /stats/inventario-estado✅❌❌✅
GET /stats/historial-actividad✅❌❌❌
All authenticated users — regardless of role — can access the following read-only endpoints: GET /productos/, GET /pedidos/, GET /pedidos/{id}, GET /mesas/, and GET /pedidos/cola-cocina. These endpoints require a valid token but impose no role restriction.

​
Managing Users

Only users with the admin role can create, update, or delete user accounts through the /usuarios/ endpoints. When creating or updating a user, the role is set via the id_rol field, which maps to the roles table in the database. Role names are admin, mesero, caja, and cocina. To create a new staff member you must be authenticated as an admin: 
curl -X POST http://localhost:8000/usuarios/ \
  -H "Authorization: Bearer <admin_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "nombre": "Carlos López",
    "email": "[email protected]",
    "password": "Secure456!",
    "id_rol": 2
  }'

​
Getting Your Own Profile

Any authenticated user can retrieve their own profile without requiring the admin role: 
curl http://localhost:8000/usuarios/me \
  -H "Authorization: Bearer <token>"
This endpoint is useful for front-end applications that need to display the logged-in user’s name, role, or ID after authentication without storing that data client-side.

Build docs developers (and LLMs) love

Get started for freeTalk to us