Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fredy-rizo/ecommerce-delivery-frontend/llms.txt

Use this file to discover all available pages before exploring further.

Ecommerce Delivery uses a JWT-based authentication strategy: when a user signs in, the server returns a token and a user object that are both stored in the browser’s localStorage. Every subsequent API request attaches the token in an Authorization: Bearer header. Three utility functions in src/tools/User.js — validateUser, ValidateSession, and getDataUser — handle session validation, redirect logic, and user-data retrieval throughout the app.

​
Session storage

After a successful login or registration, the application saves two keys to localStorage: 
// Saved on successful POST /api/user/login or POST /api/user/create
localStorage.setItem("token", response.token);
localStorage.setItem("user", JSON.stringify(response.user));
  • token — The raw JWT string used as the Authorization header on every authenticated request.
  • user — A JSON-serialized object containing the user’s id, name, email, roles array, and membership details.
Both keys are cleared together (via localStorage.clear()) when a session expires or the user is unauthorised.

​
validateUser(data)

validateUser is called before any protected API request. It reads the current user from localStorage, checks whether their role satisfies the required role(s), and returns either the enriched user object (with the token attached) or false. 
// src/tools/User.js
const validateUser = (data) => {
  const dataUser = JSON.parse(
    localStorage.getItem("user")
      ? localStorage.getItem("user")
      : '{"id":"1","name":"Invitado","roles":[{"name":"usuario","value":"1"}],"membership":{"status":{"code":3,"status":"Cancelado"},"expdate":"","duedate":"","value":""}}'
  );
  const token = localStorage.getItem("token");

  if (dataUser.roles && dataUser.roles[0].value == 2) {
    return { ...dataUser, token };
  }

  // Permitir rol simple o múltiples
  const userRoles = dataUser.roles.map(r => Number(r.value));
  const allowedRoles = Array.isArray(data.rol) ? data.rol.map(Number) : [Number(data.rol)];

  const hasRole = allowedRoles.some(r => userRoles.includes(r));

  return hasRole ? { ...dataUser, token } : false;
};
ParameterTypeDescription
data.rolnumber | number[]The role value(s) permitted to proceed. Pass a single number or an array for OR logic.
Return value — { ...dataUser, token } when the check passes; false when it fails. The admin shortcut: if the stored user’s first role has value == 2 (admin), validateUser returns the full user+token object immediately, regardless of data.rol. 
// Single role — admin only
const session = validateUser({ rol: 2 });

// Multiple roles — usuario OR promotor
const session = validateUser({ rol: [1, 3] });

if (!session) {
  // user is not authenticated or lacks permission
  router.push("/login");
}

​
ValidateSession(res, router)

ValidateSession is called after every API response. It inspects the response’s status code and, on a 401 or 403, clears the session and navigates to /login. 
// src/tools/User.js
const ValidateSession = (res, router) => {
  if (res.code == "403" || res.code == 403 || res.code == "401" || res.code == 401) {
    router.push({ path: "/login" });
    localStorage.clear();
    return false;
  }
  return true;
};
ParameterTypeDescription
resobjectThe parsed API response — must contain a code property.
routerVueRouterThe Vue Router instance obtained from useRouter().
Returns false and performs the redirect on 401/403; returns true for all other responses.

​
getDataUser()

getDataUser retrieves the current user and token from localStorage and returns them as a single merged object. If no user key is present, it returns a safe guest (Invitado) default so that downstream code never has to guard against null. 
// src/tools/User.js
const getDataUser = () => {
  const dataUser = JSON.parse(
    localStorage.getItem("user")
      ? localStorage.getItem("user")
      : '{"id":"1", "name": "Invitado", "address": "Indefinido", "phone_number": "1234567890", "email": "Invitado@email.com", "type":0, "roles":[{"name":"Invitado", "value":"4"}], "membership": {"status": { "code": 3, "status": "Cancelado" }, "expdate": "", "duedate": "", "value": ""}}'
  );
  const token = localStorage.getItem("token");
  localStorage.setItem("user", JSON.stringify(dataUser));
  return { ...dataUser, token };
};
The function also re-persists the user object via localStorage.setItem on every call, ensuring the storage key is always populated before the guest default is used.

​
Auth flow

1

POST /api/user/login

The sign-in form submits { email, password } to POST /api/user/login. A successful response includes response.token and response.user.
2

Store token and user in localStorage

The app writes both values immediately:
localStorage.setItem("token", response.token);
localStorage.setItem("user", JSON.stringify(response.user));
3

Attach Authorization header on all API calls

Every authenticated fetch includes the token:
fetch(process.env.API_SERVER + "/api/some-endpoint", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
  },
});
4

On 401 / 403, ValidateSession redirects to /login

Any API response with code 401 or 403 triggers ValidateSession(res, router), which calls localStorage.clear() and pushes /login, ending the session cleanly.
When no user is stored in localStorage, validateUser falls back to a guest default with role value: "1" (usuario) and a cancelled membership — pages that require elevated roles will correctly return false for this guest. getDataUser uses a separate guest default with role value: "4" (Invitado) and additional profile fields such as address, phone_number, and email. Both defaults have a cancelled membership (status.code: 3).

Build docs developers (and LLMs) love

Get started for freeTalk to us