AuthService: Authentication and User Management API

AuthService is a global singleton object defined in assets/auth.js and attached to the window object at script load time. It is the single source of truth for authentication state and user account management throughout the YUSEN LIMO Warehouse System.

Accessing AuthService

Because auth.js executes an IIFE that assigns window.AuthService, you can reference the object from any script or browser console tab that loads the file:

// Both forms are equivalent on authenticated pages
window.AuthService.getCurrentUser();
AuthService.getCurrentUser();

AuthService.initializeAuth() is called automatically the moment auth.js is parsed, so the account store is always ready before any other code runs.

Storage Keys

AuthService uses two dedicated Local Storage keys internally. You should not write to these keys directly — always go through the API methods described below.

Key	Purpose
`warehouseAuthAccounts`	Serialized array of all user account objects
`warehouseAuthSession`	Serialized session object for the currently logged-in user

Method Reference

`AuthService.initializeAuth()`

Reads the account list from warehouseAuthAccounts and returns it as an array of normalized account objects. If the key is missing or the stored array is empty, it seeds and persists the two default accounts before returning them. Call this once on page load (it is called automatically by auth.js, but can be called again safely to obtain the current accounts array).

const accounts = AuthService.initializeAuth();
console.log(accounts);
// [{ userId: 'admin001', role: 'admin', name: 'Juan Cruz', ... }, ...]

Returns: Array<AccountObject> — normalized account objects (see shape below). Default seeded accounts:

userId	password	role	name	employeeId
`admin001`	`Admin@123`	`admin`	Juan Cruz	`ADM-001`
`emp001`	`Employee@123`	`employee`	Joseph Dela Cruz	`EMP-001`

`AuthService.authenticateUser(userId, password)`

Validates the provided credentials against the stored account list. On success, writes a session object to warehouseAuthSession and updates the account’s lastLogin timestamp.

userId

string

required

The unique login identifier for the account (e.g. "admin001").

password

string

required

The account password. Compared as a plain-text string after trimming whitespace from both ends.

Returns: { success: boolean, user?: SessionObject, message?: string }

Outcome	`success`	Included fields
Both fields empty	`false`	`message: 'Please enter your User ID and Password.'`
userId blank only	`false`	`message: 'Invalid User ID.'`
password blank only	`false`	`message: 'Incorrect password.'`
userId not found	`false`	`message: 'Invalid User ID.'`
Password mismatch	`false`	`message: 'Incorrect password.'`
Valid credentials	`true`	`user: { userId, role, name, employeeId, position }`

// Successful login with seeded admin account
const result = AuthService.authenticateUser('admin001', 'Admin@123');
if (result.success) {
  console.log(result.user);
  // { userId: 'admin001', role: 'admin', name: 'Juan Cruz',
  //   employeeId: 'ADM-001', position: 'Administrator' }
  window.location.assign('pages/dashboard.html');
} else {
  alert(result.message);
}

`AuthService.isAuthenticated()`

Returns true if warehouseAuthSession contains a valid session object with a non-empty userId. Returns false if the key is missing, unparseable, or contains a session without a userId.

if (!AuthService.isAuthenticated()) {
  window.location.assign('index.html');
}

Returns: boolean

`AuthService.getCurrentUser()`

Returns a copy of the current session object, or null if no session exists.

const user = AuthService.getCurrentUser();
if (user) {
  console.log(`Logged in as ${user.name} (${user.role})`);
}

Returns: SessionObject | null The returned SessionObject has the following shape:

{
  userId:     string;   // e.g. "admin001"
  role:       string;   // "admin" | "employee"
  name:       string;   // e.g. "Juan Cruz"
  employeeId: string;   // e.g. "ADM-001"
  position:   string;   // e.g. "Administrator"
}

`AuthService.logout()`

Removes warehouseAuthSession from Local Storage, effectively ending the session. Returns true unconditionally.

document.getElementById('logoutBtn').addEventListener('click', () => {
  AuthService.logout();
  window.location.assign('../index.html');
});

Returns: true

`AuthService.getAccounts()`

Returns all accounts currently stored in warehouseAuthAccounts as an array of normalized account objects. Each object is a copy — mutating the returned array has no effect on storage.

const accounts = AuthService.getAccounts();
accounts.forEach(acc => console.log(acc.userId, acc.role, acc.status));

Returns: Array<AccountObject> Each AccountObject has the following shape:

{
  userId:      string;        // unique login identifier
  password:    string;        // plain-text (trimmed)
  role:        string;        // "admin" | "employee"
  name:        string;
  employeeId:  string;        // unique employee identifier
  position:    string;        // e.g. "Warehouseman"
  status:      string;        // "active" | "inactive"
  lastLogin:   string | null; // ISO 8601 timestamp or null
  createdAt:   string | null; // ISO 8601 timestamp or null
}

`AuthService.createUser(userData)`

Creates a new user account and persists it. Requires the calling session to belong to an admin user.

userData

object

required

Plain object containing the new account’s fields.

userData.employeeId

string

required

Unique employee identifier (e.g. "EMP-002"). Must not already exist in the account list (case-insensitive comparison).

userData.name

string

required

Full display name for the user.

userData.userId

string

required

userData.password

string

required

Plain-text password for the new account.

userData.confirmPassword

string

Optional confirmation value. If present, must match password exactly; otherwise the call fails.

userData.role

string

"admin" or "employee" (default: "employee").

userData.status

string

"active" or "inactive" (default: "active").

Returns: { success: boolean, user?: AccountObject, message: string }

const result = AuthService.createUser({
  employeeId: 'EMP-002',
  name: 'Maria Santos',
  userId: 'emp002',
  password: 'Warehouse@456',
  role: 'employee'
});

if (result.success) {
  console.log('Created:', result.user);
} else {
  console.error(result.message);
}

`AuthService.updateUser(userId, updates)`

Updates an existing account identified by userId. Only admin users can call this method. The employeeId and createdAt fields are always preserved from the original record and cannot be changed through updates.

userId

string

required

The userId of the account to update.

updates

object

required

An object containing any subset of fields to change. Supported fields: name, userId (rename), password, role, status, position.

An admin cannot change their own role to "employee" while they are the currently logged-in user. Doing so returns { success: false, message: 'You cannot change your own role to Employee while logged in.' }.

Returns: { success: boolean, user?: AccountObject, message: string }

// Promote an employee to admin
const result = AuthService.updateUser('emp002', { role: 'admin' });
console.log(result.message); // "User updated successfully."

`AuthService.deleteUser(userId)`

Permanently removes a user account from storage. Requires an admin session.

userId

string

required

The userId of the account to delete.

The operation is blocked in two scenarios:

The target account is the currently logged-in admin.
The target is the last remaining admin account.

Returns: { success: boolean, message: string }

const result = AuthService.deleteUser('emp002');
if (!result.success) {
  console.warn(result.message);
  // e.g. "You cannot delete the currently logged-in admin account."
}

`AuthService.resetPassword(userId)`

Resets the target account’s password to the system default "Password123". Requires an admin session.

userId

string

required

The userId of the account whose password should be reset.

Returns: { success: boolean, message: string }

const result = AuthService.resetPassword('emp001');
// result.message === 'Password reset successfully.'

Passwords are stored as plain text in Local Storage. "Password123" is the hard-coded default reset value. Always prompt users to change their password after a reset.

`AuthService.toggleUserStatus(userId)`

Flips the status field of the target account between "active" and "inactive". Requires an admin session.

userId

string

required

The userId of the account to toggle.

Returns: { success: boolean, message: string, status: string } The returned status field reflects the new value after the toggle.

const result = AuthService.toggleUserStatus('emp001');
console.log(result.status);   // "inactive" (was "active")
console.log(result.message);  // "User deactivated successfully."

// Toggle again to re-activate
AuthService.toggleUserStatus('emp001');
// result.status === "active", message === "User activated successfully."

`AuthService.changePassword(currentPassword, newPassword, confirmPassword)`

Allows the currently logged-in user to change their own password. All three arguments are required and trimmed before comparison.

currentPassword

string

required

The user’s existing password. Must match the value stored in the account record.

newPassword

string

required

The desired new password.

confirmPassword

string

required

Must be identical to newPassword. If the two differ, the call returns a failure response without modifying storage.

Returns: { success: boolean, message: string }

// Called from the profile / settings page
const result = AuthService.changePassword(
  'Employee@123',  // current
  'NewPass@789',   // new
  'NewPass@789'    // confirm
);

if (result.success) {
  showToast('Password updated successfully.');
} else {
  showToast(result.message, 'error');
}

`AuthService.getUserManagementList()`

Returns all accounts with a guaranteed, normalized status field ("active" or "inactive"). Intended for the admin User Management table.

// Render the user management table
const users = AuthService.getUserManagementList();
users.forEach(user => {
  console.log(user.userId, user.role, user.status);
});

Returns: Array<AccountObject> — identical shape to getAccounts(), with status always present and lowercase.

API Reference

Developer Guide

AuthService: Authentication and User Management API

Accessing AuthService

Storage Keys

Method Reference

`AuthService.initializeAuth()`

`AuthService.authenticateUser(userId, password)`

`AuthService.isAuthenticated()`

`AuthService.getCurrentUser()`

`AuthService.logout()`

`AuthService.getAccounts()`

`AuthService.createUser(userData)`

`AuthService.updateUser(userId, updates)`

`AuthService.deleteUser(userId)`

`AuthService.resetPassword(userId)`

`AuthService.toggleUserStatus(userId)`

`AuthService.changePassword(currentPassword, newPassword, confirmPassword)`

`AuthService.getUserManagementList()`

Build docs developers (and LLMs) love

API Reference

Developer Guide

Documentation Index

​Accessing AuthService

​Storage Keys

​Method Reference

​AuthService.initializeAuth()

​AuthService.authenticateUser(userId, password)

​AuthService.isAuthenticated()

​AuthService.getCurrentUser()

​AuthService.logout()

​AuthService.getAccounts()

​AuthService.createUser(userData)

​AuthService.updateUser(userId, updates)

​AuthService.deleteUser(userId)

​AuthService.resetPassword(userId)

​AuthService.toggleUserStatus(userId)

​AuthService.changePassword(currentPassword, newPassword, confirmPassword)

​AuthService.getUserManagementList()

Build docs developers (and LLMs) love

Accessing AuthService

Storage Keys

Method Reference

`AuthService.initializeAuth()`

`AuthService.authenticateUser(userId, password)`

`AuthService.isAuthenticated()`

`AuthService.getCurrentUser()`

`AuthService.logout()`

`AuthService.getAccounts()`

`AuthService.createUser(userData)`

`AuthService.updateUser(userId, updates)`

`AuthService.deleteUser(userId)`

`AuthService.resetPassword(userId)`

`AuthService.toggleUserStatus(userId)`

`AuthService.changePassword(currentPassword, newPassword, confirmPassword)`

`AuthService.getUserManagementList()`