Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/JAQA20/LaComanda/llms.txt

Use this file to discover all available pages before exploring further.

The Users API lets administrators manage the staff accounts that access La Comanda. Each account is assigned a rol_id that controls which views and API endpoints the user can reach. Passwords are stored exclusively as bcrypt hashes — plain-text credentials are never persisted. All three endpoints require an active session with rol_id = 1 (Admin).

​
Role Reference

rol_idRole NameAccess Level
1AdminFull access to all endpoints and views
2MeseroOrder creation and table management
3CocinaKitchen queue views and actions
4BaristaBarista queue views and actions

​
Create User

POST /public/api/nuevoUsuario.php Creates a new staff account. The password is hashed with PHP’s PASSWORD_DEFAULT algorithm (bcrypt) before storage — the plain-text value is never written to the database. Validation errors are stored in the session so the form page can re-display them without an additional round trip.

​
Request Parameters

​
nombre
string
required
Staff member’s first name.
​
apellido
string
required
Staff member’s last name.
​
email
string
required
Email address. Must be unique across all user accounts and will be used as the login credential.
​
password
string
required
Account password. Minimum 8 characters.
​
password2
string
required
Password confirmation. Must be identical to password.
​
rol_id
integer
required
Role to assign. Must be one of 1, 2, 3, or 4. See Role Reference above.

​
Responses

OutcomeRedirect
Successviews/admin/usuarios.php?created=1
Validation failureBack to form; errors in $_SESSION["nuevo_usuario_errors"]
The nuevo_usuario_errors session key holds an associative array keyed by field name (e.g. email, password). Read it in your form template to highlight the specific fields that failed.

​
Example Request

curl -b 'PHPSESSID=...' \
  -X POST \
  -F 'nombre=Maria' \
  -F 'apellido=Lopez' \
  -F 'email=maria.lopez@example.com' \
  -F 'password=S3curePass!' \
  -F 'password2=S3curePass!' \
  -F 'rol_id=2' \
  'http://localhost:8080/public/api/nuevoUsuario.php'

​
Edit User

POST /public/api/editarUsuario.php Updates an existing staff account. To leave the password unchanged, omit the password and password2 fields entirely or send empty strings — the endpoint will skip the password update step in that case. If a new password is provided it must be at least 8 characters and match password2.

​
Request Parameters

​
id
integer
required
ID of the user account to update.
​
nombre
string
Updated first name.
​
apellido
string
Updated last name.
​
email
string
Updated email address. Must remain unique.
​
rol_id
integer
Updated role assignment (1–4).
​
password
string
New password. Minimum 8 characters. Leave empty to keep the existing password.
​
password2
string
New password confirmation. Must match password when a new password is being set.

​
Responses

OutcomeRedirect
Successviews/admin/usuarios.php?success=usuario_actualizado
Changing a user’s rol_id takes effect immediately on their next page load. Their current session retains the old role until they navigate to a new view.

​
Example Request

curl -b 'PHPSESSID=...' \
  -X POST \
  -F 'id=5' \
  -F 'nombre=Maria' \
  -F 'apellido=Garcia' \
  -F 'email=maria.garcia@example.com' \
  -F 'rol_id=3' \
  'http://localhost:8080/public/api/editarUsuario.php'

​
Delete User

POST /public/api/eliminarUsuario.php Permanently removes a staff account. Two hard safety rules apply regardless of caller permissions: the root admin account (id = 1) can never be deleted, and no user can delete their own account.
Deletion is permanent. There is no soft-delete or archive mechanism — the record is removed from the database immediately. Ensure any historical order data that references this user is handled before deleting the account.

​
Request Parameters

​
id
integer
required
ID of the user account to delete.

​
Responses

OutcomeRedirect
Successviews/admin/usuarios.php?deleted=1
Attempted deletion of root admin (id=1)views/admin/usuarios.php?error=root_delete
Attempted self-deletionviews/admin/usuarios.php?error=self_delete
Invalid or missing IDviews/admin/usuarios.php?error=bad_id
Database deletion failureviews/admin/usuarios.php?error=delete_failed

​
Example Request

curl -b 'PHPSESSID=...' \
  -X POST \
  -F 'id=5' \
  'http://localhost:8080/public/api/eliminarUsuario.php'

Build docs developers (and LLMs) love

Get started for freeTalk to us