Positeasy Clone - Canteen Automation Ecosystem

🔐 Security Overhaul (Branch: krishna)

This branch represents a major security milestone for the Canteen Automation system, transitioning from open/unprotected endpoints to a robust JWT-based Authentication architecture.

🔐 Critical: Security Configuration

To run this application securely, you MUST configure the following environment variables. Do NOT commit real secrets to the repository.

Required Environment Variables

Variable	Description	Example/Hint
JWT_SECRET	Secret key for signing tokens	openssl rand -base64 32
DB_PASSWORD	Database user password	Your PostgreSQL password
MASTER_USER	Initial admin email	admin@example.com
MASTER_PASSWORD	Initial admin password	SecurePassword123

How to set them:

• Local Development: Create a .env file (if using a loader) or set them in your IDE (IntelliJ/Eclipse) Run Configurations.
• Production: Set them as System Environment Variables on your server or CI/CD platform (e.g., GitHub Secrets, Railway, Docker).

🏗️ Ecosystem Architecture

• Backend (Java/Spring Boot): Now fully protected by JWT guards. Includes JwtAuthFilter, JwtUtil, and enhanced SecurityConfig.
• Frontend (Counter/Admin): Migrated to use an authenticated API wrapper (src/api.ts).
• Ordering Site: Also migrated to the shared security pattern.

🚀 Major Changes in this Branch

Backend Security

• JWT Implementation: Added token generation, validation, and filtering.
• Role-Based Access: Restricted sensitive endpoints (Orders, Wallets, Coupons) to authenticated users.
• Rate Limiting: Implemented LoginRateLimiter to prevent brute-force attacks.
• CORS Configuration: Updated to allow secure communication with frontend origins.

Frontend Hardening

• API Wrapper: Centralized all data fetching through a secure wrapper that injects authentication headers automatically.
• Context Protection: Updated AuthContext to persist tokens securely.
• Screen Migration: Every major page (POS, Inventory, Reports) has been refactored to use the new secure communication pattern.

🛠️ Developer Setup

1. Backend: Update application.properties with your jwt.secret.
2. Frontend: Ensure .env points to the correct backend URL.
3. Migration: See migrate_fetch.ps1 in the frontend directory for details on how the transition was automated.

---

Developed by the Canteen Automation Team.