Authentication Config

Basics

• App authentication is implemented using JWT tokens.
• User authenticates himself using phone and password
• Session time is 3 hours
• 2 roles: ADMIN and WAITER
• Authentication endpoint: /api/auth/login

Flow

1. User logs in in the system using phone and password
2. If the authentication succeeds, a jwt token is sent to the user, which is stored in local storage.
3. From this point on, every request to the server will contain a header Authorization with the value: 'Bearer {jwt_token}'
4. Any request is filtered on the backend, if the endpoint is not public and jwt token is invalid, 401 Unauthorized error is thrown
5. If the user has not ADMIN role and tries to reach a private endpoint, 401 Unauthorized error is thrown

Authorization

Public endpoints:

• POST /api/auth/register
• POST /api/auth/login
• GET /api/menu_items
• GET /api/feedbacks
• POST /api/feedbacks

Endpoints reachable by admin only:

• POST /api/tables
• PUT /api/tables
• DELETE /api/tables
• POST /api/menu_items
• PATCH /api/menu_items
• DELETE /api/menu_items
• GET /api/users
• DELETE /api/feedbacks
• POST /api/users/activate

All other endpoints are reachable only if the user is authenticated