Qui La Carne API (1.0)

Allows a manager to accept or reject an existing guest report. If the report is accepted (isAccepted: true), the system automatically issues a ban for the reported guest until the specified expiresAt date and sends an email notification. Requires MANAGER role.

Returns a list of all available dishes including ingredients and allergens. The names of categories and allergens are translated based on the 'Accept-Language' header.

Updates dish details and/or replaces its photo on S3. Requires ROLE_MANAGER privileges. Uses multipart/form-data.

Creates a new dish in the menu and optionally uploads its photo to S3. Requires ROLE_MANAGER privileges. Uses multipart/form-data.

Toggles the availability of a dish. If marking as unavailable, an optional reason can be provided. Requires ROLE_MANAGER privileges.

Creates a new employee account (Manager or Waiter) and automatically activates it. Requires ROLE_MANAGER privileges.

Updates the email and/or username of an existing employee. Only provided fields will be updated. Requires ROLE_MANAGER privileges.

Generates a new 2FA secret and returns a QR code URI along with a manual code. Does NOT enable 2FA yet. Requires ROLE_MANAGER.

Verifies the 6-digit code from the authenticator app. If correct, permanently enables 2FA for the manager's account. Requires ROLE_MANAGER.

Returns a list of tables. If startTime and endTime are provided, it filters out tables that are reserved or unavailable in that timeframe. The names of table status are translated based on the 'Accept-Language' header.

Creates a new table with the specified number and capacity. The table is automatically assigned the default 'AVAILABLE' status. Requires ROLE_MANAGER.

Creates a new table status in the system. The English name is automatically used to generate a unique token. Requires MANAGER role.

Retrieves a paginated and filterable list of reservations made by the currently authenticated user. Supports filtering by date range and status.

Creates a new incident report for a specific client. The user being reported must have the ROLE_CLIENT. The report is created with an initial status of IN_PROGRESS. Requires WAITER or MANAGER role.

Creates a new order status in the system. The English name is automatically used to generate a unique token. Requires MANAGER role.

Creates a new order item status in the system. The English name is automatically used to generate a unique token. Requires MANAGER role.

Creates a new ingredient in the system. The English name is automatically used to generate a unique token. Requires MANAGER role.

Creates a new dish category in the system. The English name is automatically used to generate a unique token. Requires MANAGER role.

Creates a new allergen in the system. The English name is automatically used to generate a unique token. Requires MANAGER role.

Allows a manager to manually ban a client without needing a prior report. The targeted user must have the ROLE_CLIENT. Automatically deactivates the user and sends an email notification. Requires MANAGER role.

Validates the 6-digit 2FA code along with the Pre-Auth token. If valid, returns the final JWT Bearer token giving full access to the system.

Exchanges a valid Refresh Token for a new pair of Access and Refresh tokens.

Logs out the authenticated user by revoking their refresh token. The client application must also delete the JWT and Refresh Token locally.

Authenticates a user using their username (or email) and password. If credentials are valid and 2FA is OFF, a final JWT token is returned. If 2FA is ON, a Pre-Auth token is returned and the 'requires2fa' flag is set to true. In that case, the client must proceed to the /verify-2fa endpoint.

Allows a manager to change the role of an employee (e.g., promote to Manager or demote to Waiter). Managers cannot change their own role.

Allows a manager to forcefully change an employee's password. Managers cannot change their own password using this endpoint.

Allows a manager to block or unblock an employee's access to the system. Managers cannot change their own availability.

Retrieves a dictionary list of all table statuses available in the system. The names are translated based on the 'Accept-Language' header.

Review list of all Redis caches names (e.g., 'usersList', 'dishMenu'). Requires ROLE_MANAGER.

Returns a paginated, flat list of users (both staff and guests) with their role tokens and a convenient isStaff flag.

Returns a paginated, flat list of tables with their statuses.

Returns a flat list of all available roles in the system. Used to synchronize the roles dictionary on client devices.

Returns a paginated, flat list of reservations with foreign key tokens (user, table, statuses).

Returns a paginated, flat list of guest reports with foreign key tokens (guest, reporter, statuses). Page size is strictly fixed by the server.

Returns a paginated, flat list of orders with foreign key tokens (reservation, table, waiter, statuses).

Returns a paginated, flat list of order items with foreign key tokens (order, product, statuses).

Returns a paginated, flat list of ingredients with their translations and associated allergen tokens.

Returns a paginated, flat list of dishes with foreign key tokens. Page size is strictly fixed by the server.

Returns flat lists of all dictionaries (statuses, categories, allergens) with EN/PL translations, perfect for saving in local SQLite