Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/ytabeloved/ordervista/llms.txt

Use this file to discover all available pages before exploring further.

Ordervista uses JSON Web Tokens (JWT) for stateless authentication. When a user logs in with a valid email and password, the backend signs a token containing the user’s id_usuario, email, and id_rol, and returns it to the client. The frontend stores this token in LocalStorage and attaches it to every subsequent API request via the Authorization: Bearer <token> header. A verifyToken middleware on the server validates the token before allowing access to any protected route. Tokens expire after 2 hours, at which point the user must log in again.

​
Registration

New users register via POST /api/auth/register. All new accounts are assigned id_rol: 3 (Customer) automatically. The nombre, apellido, email, and password fields are required; telefono is optional. Passwords are hashed with bcrypt before being stored. Endpoint: POST /api/auth/register
FieldTypeRequiredDescription
nombrestring✅First name
apellidostring✅Last name
emailstring✅Email address (must be unique)
passwordstring✅Plain-text password (hashed server-side)
telefonostring❌Phone number
Success response: 201 Created 
{
  "mensaje": "Usuario registrado correctamente",
  "id_usuario": 12
}

curl -X POST https://your-api.com/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "nombre": "Ana",
    "apellido": "García",
    "email": "ana@example.com",
    "password": "mySecret123",
    "telefono": "+56912345678"
  }'

​
Login

Authenticated sessions begin at POST /api/auth/login. The server verifies the password against the bcrypt hash, then calls generateToken which signs a JWT valid for 2 hours using process.env.JWT_SECRET. The response includes the token and the user object needed for client-side role checks. Endpoint: POST /api/auth/login
FieldTypeRequired
emailstring✅
passwordstring✅
Success response: 200 OK 
{
  "mensaje": "Inicio de sesión correcto",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "usuario": {
    "id_usuario": 12,
    "nombre": "Ana",
    "apellido": "García",
    "email": "ana@example.com",
    "id_rol": 3
  }
}

curl -X POST https://your-api.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "ana@example.com",
    "password": "mySecret123"
  }'

​
Using the Token

After login, persist the token in LocalStorage (key: token) and include it in the Authorization header of every request to a protected endpoint. 
curl https://your-api.com/api/orders \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Never expose your JWT_SECRET in client-side code, version control, or logs. Rotate it immediately if it is ever compromised, as all active tokens will be invalidated and users will need to log in again.

​
Token Verification Middleware

Every protected route is guarded by the verifyToken middleware defined in src/middleware/authMiddleware.js. It performs the following steps:
  1. Reads the Authorization request header.
  2. Splits the value on a space and extracts the token after Bearer.
  3. Calls jwt.verify(token, process.env.JWT_SECRET) to validate the signature and expiry.
  4. On success, attaches the decoded payload ({ id_usuario, email, id_rol }) to req.user and calls next().
  5. On failure, returns 401 with { "mensaje": "Token inválido o expirado" }.
The decoded req.user object is used downstream in controllers — for example, req.user.id_usuario scopes order queries to the authenticated customer, and req.user.id_rol is checked by authorizeRoles middleware to enforce role-based access.

​
Logout

Endpoint: POST /api/auth/logout The server returns 200 OK with { "mensaje": "Sesión cerrada correctamente" }. Because Ordervista uses stateless JWT authentication, there is no server-side session to invalidate. The frontend is responsible for discarding the token (removing it from LocalStorage) to complete the logout. 
curl -X POST https://your-api.com/api/auth/logout \
  -H "Authorization: Bearer <token>"

​
Error Responses

StatusConditionResponse mensaje
400Missing required fields on register"Debe completar los datos obligatorios"
400Email address is already registered"El correo ya se encuentra registrado"
400Missing email or password on login"Debe ingresar correo y contraseña"
401Wrong email or password"Credenciales inválidas"
401Missing, invalid, or expired JWT token"Token inválido o expirado"
403Authenticated but insufficient role for the requested route—

Build docs developers (and LLMs) love

Get started for freeTalk to us