Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/JAQA20/LaComanda/llms.txt

Use this file to discover all available pages before exploring further.

La Comanda exposes a set of internal PHP API endpoints used exclusively by its own frontend views and AJAX calls. This is not a public REST API — there are no bearer tokens or API keys. Access is controlled entirely through PHP sessions established via the login form, and every protected endpoint validates that the caller holds an active, authenticated session before processing any request.

​
Authentication Model

All protected endpoints require an active PHP session. A session is established when a user logs in through the views/login.php form; PHP sets a PHPSESSID cookie that the browser sends automatically on every subsequent request.
The PHPSESSID cookie must be present on all API requests. If the session is missing or expired, the server issues an HTTP redirect to views/login.php rather than returning a 401 JSON response.
Two middleware files gate access to every protected endpoint:
MiddlewareFileWhat it does
Session guardmiddleware/auth.phpStarts the session, checks $_SESSION['usuario_id'], touches the active-session timestamp via SesionesActivas::tocarSesionActual(), and redirects unauthenticated callers to the login page
Role guardmiddleware/roles.phpReads $_SESSION['rol_id'] and calls verificarRol(array $rolesPermitidos). Role 1 (Admin) is always allowed through; other roles must be listed explicitly
Role IDs used throughout the API:
rol_idRole name
1Administrador
2Mesero
3Cocina
4Barista

​
Response Format

Every endpoint sets Content-Type: application/json; charset=UTF-8. Response bodies follow one of two conventions depending on the endpoint family: Standard envelope (status key) 
{ "status": "OK" }
{ "status": "ERROR", "message": "Descripción del error" }
Newer read endpoints (ok key) 
{ "ok": true, "ordenes": [ ... ] }
{ "ok": false, "message": "Descripción del error" }
Some endpoints (notably marcarEntrega and several admin form controllers) respond with an HTTP redirect instead of JSON. These are noted explicitly in their endpoint pages. HTTP status codes used across the API:
CodeMeaning
200 OKRequest processed successfully
400 Bad RequestMissing or invalid request parameters
403 ForbiddenActive session exists but role is not permitted
405 Method Not AllowedWrong HTTP verb used
500 Internal Server ErrorUnhandled server-side exception
Role-enforcement failures do not return 403 JSON — they redirect to views/accesoRestringido.php. Only programmatic checks inside controllers return 403 JSON payloads.

​
All Endpoints

Authentication

POST logout.php — destroy session and redirect to loginPOST forgotPassword.php — send password reset email via Mailtrap

Orders

POST guardarOrden.php — create a new orderGET obtenerOrdenes.php — list kitchen ordersPOST entregarOrden.php — mark table order as deliveredPOST marcarEntrega.php — mark full order delivered (kitchen flow)GET ordenesAdminData.php — full order history with statsPOST adminCambiarEstadoOrden.php — admin force-change order status

Products

GET listarProductos.php — list products by category slugPOST nuevoProducto.php — create a productPOST editarProducto.php — update an existing productPOST eliminarProducto.php — soft-delete a product

Categories

POST nuevaCategoria.php — create a categoryPOST editarCategoria.php — update a categoryPOST eliminarCategoria.php — delete a category

Users

POST nuevoUsuario.php — create a system userPOST editarUsuario.php — update a userPOST eliminarUsuario.php — deactivate a userGET usuariosConectados.php — list currently active sessions

Tables

GET estadoMesas.php — current order state per table for calling userGET / POST / DELETE layoutMesas.php — read or persist the visual floor-plan layout

Kitchen & Barista

GET obtenerOrdenes.php — kitchen order feed (non-barista items)POST cocinaAccion.php — advance kitchen order (preparacion / lista)POST baristaAccion.php — advance barista order (preparacion / lista)GET baristaEstado.php — barista panel (pendientes + listas)

Password Reset

POST forgotPassword.php — request a password reset link by email

​
Role Requirements Summary

EndpointMethodMinimum Roles Required
logout.phpPOSTAny authenticated session
forgotPassword.phpPOSTNone (public)
guardarOrden.phpPOSTAdmin (1), Mesero (2)
obtenerOrdenes.phpGETAdmin (1), Cocina (3)
entregarOrden.phpPOSTAdmin (1), Mesero (2)
marcarEntrega.phpPOSTAdmin (1), Cocina (3)
ordenesAdminData.phpGETAdmin (1) only
adminCambiarEstadoOrden.phpPOSTAdmin (1) only
listarProductos.phpGETAny authenticated session
nuevoProducto.phpPOSTAdmin (1) only
editarProducto.phpPOSTAdmin (1) only
eliminarProducto.phpPOSTAdmin (1) only
nuevaCategoria.phpPOSTAdmin (1) only
editarCategoria.phpPOSTAdmin (1) only
eliminarCategoria.phpPOSTAdmin (1) only
nuevoUsuario.phpPOSTAdmin (1) only
editarUsuario.phpPOSTAdmin (1) only
eliminarUsuario.phpPOSTAdmin (1) only
usuariosConectados.phpGETAdmin (1) only
estadoMesas.phpGETAny authenticated session
layoutMesas.phpGETAny authenticated session
layoutMesas.phpPOST / DELETEAdmin (1) only
cocinaAccion.phpPOSTAdmin (1), Cocina (3)
baristaAccion.phpPOSTAdmin (1), Barista (4)
baristaEstado.phpGETAdmin (1), Barista (4)

Build docs developers (and LLMs) love

Get started for freeTalk to us