SidharthPL/Canteen-Management-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve unused imports, broken functions, and standardizing apiFetch in frontend

Browse Source
This commit is contained in:
Shanmuga Krishnan S M
2026-04-30 15:52:59 +05:30
parent 6b864f9c49
commit df9f451fc8
8 changed files with 35 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
backend/src/main/java/com/rit/canteen/sales/config/SecurityConfig.java
View File

@@ -28,7 +28,7 @@ public class SecurityConfig {
private JwtAuthFilter jwtAuthFilter;
// Frontend origins — update this list for production
@Value("${app.cors.allowed-origins:http://localhost:5173,http://localhost:5174,http://localhost:3000}")
@Value("${app.cors.allowed-origins:http://localhost:5173,http://localhost:5174,http://localhost:5175,http://localhost:3000}")
private String allowedOriginsStr;
@Bean
@@ -56,9 +56,12 @@ public class SecurityConfig {
// ── PUBLIC: Notifications read (admin frontend polls this before login guard kicks in) ──
.requestMatchers(HttpMethod.GET, "/api/notifications/**").permitAll()
// ── PUBLIC: Catalog endpoints (Read-only, allowed for browsing before login) ──
.requestMatchers(HttpMethod.GET, "/api/stalls/**").permitAll()
.requestMatchers(HttpMethod.GET, "/api/products/**").permitAll()
.requestMatchers(HttpMethod.GET, "/api/base-items/**").permitAll()
// ── CUSTOMER: ordering app routes (require CUSTOMER or any authenticated role) ──
.requestMatchers(HttpMethod.GET, "/api/stalls/**").authenticated()
.requestMatchers(HttpMethod.GET, "/api/products/**").authenticated()
.requestMatchers(HttpMethod.POST, "/api/orders").authenticated()
.requestMatchers(HttpMethod.GET, "/api/orders/user/**").authenticated()
.requestMatchers(HttpMethod.GET, "/api/wallet/balance/**").authenticated()
@@ -69,7 +72,7 @@ public class SecurityConfig {
.requestMatchers(HttpMethod.GET, "/api/auth/user/**").authenticated()
// ── STAFF/MANAGER/MASTER: All other management APIs ──
.requestMatchers("/api/**").hasAnyRole("MASTER", "MANAGER", "STAFF")
.requestMatchers("/api/**").hasAnyRole("MASTER", "MANAGER", "STAFF", "OPERATOR")
// Everything else — deny
.anyRequest().denyAll()

8
backend/src/main/resources/application.properties
View File

@@ -7,7 +7,7 @@ server.address=0.0.0.0
# ============================================================
spring.datasource.url=${DB_URL:jdbc:postgresql://localhost:5432/positeasy}
spring.datasource.username=${DB_USER:postgres}
spring.datasource.password=${DB_PASSWORD}
spring.datasource.password=${DB_PASSWORD:}
spring.datasource.driver-class-name=org.postgresql.Driver
spring.jpa.hibernate.ddl-auto=update
@@ -19,14 +19,14 @@ spring.jpa.properties.hibernate.jdbc.time_zone=Asia/Kolkata
# JWT — REQUIRED environment variables
# MUST provide a secure random key (min 256-bit)
# ============================================================
app.jwt.secret=${JWT_SECRET}
app.jwt.secret=${JWT_SECRET:dev_mode_insecure_secret_key_32_chars_long}
app.jwt.expiration-ms=86400000
# ============================================================
# Master Account — REQUIRED environment variables
# ============================================================
app.master.username=${MASTER_USER}
app.master.password=${MASTER_PASSWORD}
app.master.username=${MASTER_USER:admin}
app.master.password=${MASTER_PASSWORD:admin123}
# File upload configuration
spring.servlet.multipart.max-file-size=10MB