Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/JAQA20/LaComanda/llms.txt

Use this file to discover all available pages before exploring further.

La Comanda uses a role-based access control system to ensure every staff member sees only the tools relevant to their responsibilities. Each user account is assigned one of four roles at creation time, and the application enforces those boundaries on every request through a centralized middleware function.

​
The Four Roles

Admin

rol_id = 1Full access to every area of the application. Admins can manage users, products, categories, orders, and table layouts from the admin panel. They can also monitor active sessions and have unrestricted visibility across all workflows. Admin bypasses all role checks automatically.

Waiter (Mesero)

rol_id = 2Access to the order-taking interface at views/index.php. Waiters select tables, add products to open orders, submit those orders to the kitchen or bar, and mark items as delivered. They can also see the current status of all tables on the floor.

Kitchen (Cocina)

rol_id = 3Access to the kitchen queue at views/cocina.php. Kitchen staff see incoming food orders in real time, update item status to en_preparacion while cooking, and mark completed items or full orders as listo or entregada when the food is ready to leave the kitchen.

Barista

rol_id = 4Access to the barista queue at views/barista.php. Baristas see only orders that contain items belonging to the cafes or bebidas categories. They mark drinks as en_preparacion while being prepared and listo once ready for the waiter to pick up.

​
Role Assignment

Roles are assigned when a user account is created inside the admin panel. There is no self-registration flow — only an Admin can create new accounts and choose a role for each one.
  • Roles are stored in the roles database table and referenced by rol_id on each user record in the usuarios table.
  • The Admin role (rol_id = 1) should be reserved for trusted staff only. There is no permission sub-setting within a role — a user either has full Admin access or they do not.
  • Role changes take effect on the user’s next login; existing sessions retain the role that was active when they logged in.

​
Access Control Implementation

Role enforcement is handled by the verificarRol() function defined in middleware/roles.php. Every protected view calls this function at the top of the file, passing an array of role IDs that are allowed to access it. The function reads $_SESSION['rol_id'] set at login and applies the following logic:
  1. If no session exists, the user is redirected to the login page.
  2. If rol_id === 1 (Admin), the check is skipped entirely — Admin always has access.
  3. For all other roles, the function verifies the user’s role is in the $rolesPermitidos array.
  4. If the role is not permitted, the user is redirected to views/accesoRestringido.php.
function verificarRol(array $rolesPermitidos = [])
{
    if (!isset($_SESSION["rol_id"])) {
        header("Location: " . BASE_URL . "views/login.php");
        exit;
    }
    $rol = (int)$_SESSION["rol_id"];
    if ($rol === 1) return; // Admin bypasses all checks
    if (!in_array($rol, $rolesPermitidos, true)) {
        header("Location: " . BASE_URL . "views/accesoRestringido.php");
        exit;
    }
}
For example, the kitchen view calls verificarRol([3]), the barista view calls verificarRol([4]), and the waiter view calls verificarRol([2]). The admin panel calls verificarRol([1]), though the bypass means only the session check is ever evaluated for that view.

​
Default Test Accounts

The following test accounts are included with the development seed data. Replace all passwords before deploying to production.
RoleEmailPassword
Adminadmin@lacomanda.comadmin123
Waiter (Mesero)mesero@lacomanda.commesero123
Kitchen (Cocina)cocina@lacomanda.comcocina123
Baristabarista@lacomanda.combarista123
Restrict production access by assigning the minimal necessary role to each staff account. The Admin role should only be assigned to trusted staff — it grants unrestricted access to user management, all orders, and session monitoring.

Build docs developers (and LLMs) love

Get started for freeTalk to us