create-jinmankn-app 1.0.13 → 1.0.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-jinmankn-app",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "type": "module",
   "bin": {
     "create-jinmankn-app": "./bin/index.js"

package/templates/HRMS (reba kuri iyi bro)/README.md

@@ -0,0 +1 @@
+umvax mbaye nshyizeho iyi reka mbanze nkore test numona i dakora fresh uze gusubiroho after 10min ndaba naya updatinze

package/templates/{index/backend/controllers/authController.js → HRMS (reba kuri iyi bro)/backend/controllers/authController.js }

@@ -1,17 +1,14 @@
 const bcrypt = require('bcrypt');
-const jwt = require('jsonwebtoken');
 const User = require('../models/User');
-const JWT_SECRET = 'change_this_to_a_long_random_secret';
+const Employee = require('../models/Employee');
 
-function createToken(userId) {
-  return jwt.sign({ userId }, JWT_SECRET, { expiresIn: '7d' });
-}
-//this function is formatting the user object to return the id, name, and email when 
 function formatUser(user) {
   return {
     id: user._id,
     name: user.name,
     email: user.email,
+    role: user.role || 'user',
+    employee: user.employee || null,
   };
 }
 
@@ -32,17 +29,57 @@ exports.register = async (req, res) => {
       return res.status(409).json({ message: 'Email already registered' });
     }
 
+    const userCount = await User.countDocuments();
+    if (userCount > 0) {
+      return res.status(403).json({ message: 'Registration closed. Ask an admin to create an account.' });
+    }
+
     const hashedPassword = await bcrypt.hash(password, 10);
     const user = await User.create({
       name: name.trim(),
       email: email.trim().toLowerCase(),
       password: hashedPassword,
+      role: 'admin',
+    });
+
+    req.session.userId = user._id;
+
+    res.status(201).json({
+      user: formatUser(user),
     });
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+};
+
+exports.createUser = async (req, res) => {
+  try {
+    const { employeeId, password } = req.body;
+
+    if (!employeeId || !password) {
+      return res.status(400).json({ message: 'Employee and password are required' });
+    }
 
-    const token = createToken(user._id);
+    const employee = await Employee.findById(employeeId);
+    if (!employee) {
+      return res.status(404).json({ message: 'Employee not found' });
+    }
+
+    const existing = await User.findOne({ email: employee.email });
+    if (existing) {
+      return res.status(409).json({ message: 'A user already exists for this employee' });
+    }
+
+    const hashedPassword = await bcrypt.hash(password, 10);
+    const user = await User.create({
+      name: `${employee.firstName} ${employee.lastName}`.trim(),
+      email: employee.email,
+      password: hashedPassword,
+      role: 'user',
+      employee: employee._id,
+    });
 
     res.status(201).json({
-      token,
       user: formatUser(user),
     });
   } catch (err) {
@@ -68,10 +105,9 @@ exports.login = async (req, res) => {
       return res.status(401).json({ message: 'Invalid email or password' });
     }
 
-    const token = createToken(user._id);
+    req.session.userId = user._id;
 
     res.json({
-      token,
       user: formatUser(user),
     });
   } catch (err) {
@@ -86,3 +122,17 @@ exports.getMe = async (req, res) => {
     res.status(500).json({ message: err.message });
   }
 };
+
+exports.logout = async (req, res) => {
+  try {
+    req.session.destroy((err) => {
+      if (err) {
+        return res.status(500).json({ message: 'Logout failed' });
+      }
+      res.clearCookie('connect.sid');
+      res.json({ message: 'Logged out successfully' });
+    });
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+};

package/templates/HRMS (reba kuri iyi bro)/backend/middleware/auth.js

@@ -0,0 +1,28 @@
+
+const User = require('../models/User');
+
+exports.protect = async (req, res, next) => {
+  try {
+    if (!req.session || !req.session.userId) {
+      return res.status(401).json({ message: 'Not authorized' });
+    }
+
+    const user = await User.findById(req.session.userId).select('-password');
+
+    if (!user) {
+      return res.status(401).json({ message: 'Not authorized' });
+    } 
+
+    req.user = user;
+    next();
+  } catch (err) {
+    return res.status(401).json({ message: 'Not authorized' });
+  }
+};
+
+exports.admin = (req, res, next) => {
+  if (!req.user || req.user.role !== 'admin') {
+    return res.status(403).json({ message: 'Admin access required' });
+  }
+  next();
+};

package/templates/{index/backend/models/User.js → HRMS (reba kuri iyi bro)/backend/models/User.js }

@@ -19,6 +19,11 @@ const userSchema = new mongoose.Schema(
       required: true,
       minlength: 6,
     },
+    role: {
+      type: String,
+      enum: ['admin', 'user', 'employee'],
+      default: 'user',
+    },
     employee: {
       type: mongoose.Schema.Types.ObjectId,
       ref: 'Employee',

package/templates/{index/backend/package-lock.json → HRMS (reba kuri iyi bro)/backend/package-lock.json }

@@ -11,8 +11,8 @@
       "dependencies": {
         "bcrypt": "^5.1.1",
         "cors": "^2.8.5",
-        "dotenv": "^16.4.7",
         "express": "^4.21.2",
+        "express-session": "^1.19.0",
         "jsonwebtoken": "^9.0.2",
         "mongoose": "^8.9.3"
       },
@@ -458,18 +458,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/dotenv": {
-      "version": "16.6.1",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
-      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://dotenvx.com"
-      }
-    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
@@ -605,6 +593,29 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/express-session": {
+      "version": "1.19.0",
+      "resolved": "https://registry.npmjs.org/express-session/-/express-session-1.19.0.tgz",
+      "integrity": "sha512-0csaMkGq+vaiZTmSMMGkfdCOabYv192VbytFypcvI0MANrp+4i/7yEkJ0sbAEhycQjntaKGzYfjfXQyVb7BHMA==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "~0.7.2",
+        "cookie-signature": "~1.0.7",
+        "debug": "~2.6.9",
+        "depd": "~2.0.0",
+        "on-headers": "~1.1.0",
+        "parseurl": "~1.3.3",
+        "safe-buffer": "~5.2.1",
+        "uid-safe": "~2.1.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/fill-range": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -1613,6 +1624,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/on-headers": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
+      "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/once": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
@@ -1703,6 +1723,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/random-bytes": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz",
+      "integrity": "sha512-iv7LhNVO047HzYR3InF6pUcUsPQiHTM1Qal51DcGSuZFBil1aBBWG5eHPNek7bvILMaYJ/8RU1e8w1AMdHmLQQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/range-parser": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
@@ -2103,6 +2132,18 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/uid-safe": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.5.tgz",
+      "integrity": "sha512-KPHm4VL5dDXKz01UuEd88Df+KzynaohSL9fBh096KWAxSKZQDI2uBrVqtvRM4rwrIrRRKsdLNML/lnaaVSRioA==",
+      "license": "MIT",
+      "dependencies": {
+        "random-bytes": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/undefsafe": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/undefsafe/-/undefsafe-2.0.5.tgz",

package/templates/{index/backend/package.json → HRMS (reba kuri iyi bro)/backend/package.json }

@@ -13,6 +13,7 @@
     "bcrypt": "^5.1.1",
     "cors": "^2.8.5",
     "express": "^4.21.2",
+    "express-session": "^1.19.0",
     "jsonwebtoken": "^9.0.2",
     "mongoose": "^8.9.3"
   },

package/templates/HRMS (reba kuri iyi bro)/backend/routes/authRoutes.js

@@ -0,0 +1,13 @@
+const express = require('express');
+const { register, login, getMe, createUser, logout } = require('../controllers/authController');
+const { protect, admin } = require('../middleware/auth');
+
+const router = express.Router();
+
+router.post('/register', register);
+router.post('/login', login);
+router.post('/logout', protect, logout);
+router.post('/users', protect, admin, createUser);
+router.get('/me', protect, getMe);
+
+module.exports = router;

package/templates/{index/backend/routes/departmentRoutes.js → HRMS (reba kuri iyi bro)/backend/routes/departmentRoutes.js }

@@ -1,6 +1,6 @@
 const express = require('express');
 const router = express.Router();
-const { protect } = require('../middleware/auth');
+const { protect, admin } = require('../middleware/auth');
 const {
   addDepartment,
   getDepartments,
@@ -9,9 +9,9 @@ const {
 } = require('../controllers/departmentController');
 
 router.use(protect);
-router.post('/add', addDepartment);
+router.post('/add', admin, addDepartment);
 router.get('/list', getDepartments);
-router.put('/:id', updateDepartment);
-router.delete('/:id', deleteDepartment);
+router.put('/:id', admin, updateDepartment);
+router.delete('/:id', admin, deleteDepartment);
 
 module.exports = router;

package/templates/{index/backend/routes/employeeRoutes.js → HRMS (reba kuri iyi bro)/backend/routes/employeeRoutes.js }

@@ -1,6 +1,6 @@
 const express = require('express');
 const router = express.Router();
-const { protect } = require('../middleware/auth');
+const { protect, admin } = require('../middleware/auth');
 const {
   addEmployee,
   getEmployees,
@@ -10,10 +10,10 @@ const {
 } = require('../controllers/employeeController');
 
 router.use(protect);
-router.post('/add', addEmployee);
+router.post('/add', admin, addEmployee);
 router.get('/list', getEmployees);
 router.get('/:id', getEmployee);
-router.put('/:id', updateEmployee);
-router.delete('/:id', deleteEmployee);
+router.put('/:id', admin, updateEmployee);
+router.delete('/:id', admin, deleteEmployee);
 
 module.exports = router;

package/templates/{index/backend/routes/positionRoutes.js → HRMS (reba kuri iyi bro)/backend/routes/positionRoutes.js }

@@ -1,6 +1,6 @@
 const express = require('express');
 const router = express.Router();
-const { protect } = require('../middleware/auth');
+const { protect, admin } = require('../middleware/auth');
 const {
   addPosition,
   getPositions,
@@ -9,9 +9,9 @@ const {
 } = require('../controllers/positionController');
 
 router.use(protect);
-router.post('/add', addPosition);
+router.post('/add', admin, addPosition);
 router.get('/list', getPositions);
-router.put('/:id', updatePosition);
-router.delete('/:id', deletePosition);
+router.put('/:id', admin, updatePosition);
+router.delete('/:id', admin, deletePosition);
 
 module.exports = router;

package/templates/{index/backend/routes/reportRoutes.js → HRMS (reba kuri iyi bro)/backend/routes/reportRoutes.js }

@@ -1,9 +1,9 @@
 const express = require('express');
 const { getOnLeaveByDepartment } = require('../controllers/reportController');
-const { protect } = require('../middleware/auth');
+const { protect, admin } = require('../middleware/auth');
 
 const router = express.Router();
 
-router.get('/on-leave-by-department', protect, getOnLeaveByDepartment);
+router.get('/on-leave-by-department', protect, admin, getOnLeaveByDepartment);
 
 module.exports = router;

package/templates/{index/backend/server.js → HRMS (reba kuri iyi bro)/backend/server.js }

@@ -1,5 +1,6 @@
 const express = require('express');
 const cors = require('cors');
+const session = require('express-session');
 
 const connectDB = require('./config/db');
 
@@ -12,8 +13,26 @@ const protectedRoutes = require('./routes/protectedRoutes');
 
 const app = express();
 
-app.use(cors());
+app.use(
+  cors({
+    origin: 'http://localhost:5173',
+    credentials: true,
+  })
+);
 app.use(express.json());
+app.use(
+  session({
+    secret: 'change_this_to_a_long_random_secret',
+    resave: false,
+    saveUninitialized: false,
+    cookie: {
+      httpOnly: true,
+      secure: false,
+      sameSite: 'none',
+      maxAge: 1000 * 60 * 60 * 24,
+    },
+  })
+);
 connectDB();
 
 app.use('/api/auth', authRoutes);

package/templates/{index/frontend/src/App.jsx → HRMS (reba kuri iyi bro)/frontend/src/App.jsx }

@@ -8,6 +8,7 @@ import Department from './pages/Department';
 import Employee from './pages/Employee';
 import Position from './pages/Position';
 import Reports from './pages/Reports';
+import CreateUser from './pages/CreateUser';
 
 function App() {
   return (
@@ -22,6 +23,7 @@ function App() {
           <Route path="employee" element={<Employee />} />
           <Route path="position" element={<Position />} />
           <Route path="reports" element={<Reports />} />
+          <Route path="create-user" element={<CreateUser />} />
         </Route>
 
         <Route path="/" element={<Navigate to="/dashboard" replace />} />
@@ -32,4 +34,4 @@ function App() {
 }
 
 export default App;
-
+

package/templates/{index/frontend/src/components/DashboardLayout.jsx → HRMS (reba kuri iyi bro)/frontend/src/components/DashboardLayout.jsx }

@@ -22,7 +22,7 @@ function DashboardLayout() {
     }
 
     axios.get('http://localhost:5006/api/auth/me', {
-        headers: { Authorization: `Bearer ${localStorage.getItem('token')}` },
+        withCredentials: true,
       })
       .then((response) => {
         setUser(response.data.user);
@@ -35,12 +35,22 @@ function DashboardLayout() {
       });
   }, []);
 
-  const handleLogout = () => {
-    localStorage.removeItem('token');
+  const handleLogout = async () => {
+    try {
+      await axios.post('http://localhost:5006/api/auth/logout', null, {
+        withCredentials: true,
+      });
+    } catch (err) {
+      console.error('Logout failed', err.response?.data || err.message);
+    }
     localStorage.removeItem('user');
     navigate('/login');
   };
 
+  const visibleNav = user?.role === 'employee'
+    ? navItems.filter((i) => ['/dashboard/employee', '/dashboard/department', '/dashboard/position'].includes(i.to))
+    : navItems;
+
   return (
     <div className="min-h-screen bg-gray-100">
       <aside className="fixed inset-y-0 left-0 flex w-56 flex-col bg-teal-900 text-white">
@@ -50,7 +60,7 @@ function DashboardLayout() {
         </div>
 
         <nav className="flex-1 space-y-1 overflow-y-auto px-2 py-4">
-          {navItems.map((item) => (
+          {visibleNav.map((item) => (
             <NavLink
               key={item.to}
               to={item.to}
@@ -60,6 +70,14 @@ function DashboardLayout() {
               {item.label}
             </NavLink>
           ))}
+          {user?.role === 'admin' && (
+            <NavLink
+              to="/dashboard/create-user"
+              className={({ isActive }) => `nav-link ${isActive ? 'nav-link-active' : ''}`}
+            >
+              Create User
+            </NavLink>
+          )}
         </nav>
 
         <div className="border-t border-teal-800 px-4 py-4">
@@ -87,4 +105,4 @@ function DashboardLayout() {
 }
 
 export default DashboardLayout;
-
+

package/templates/{index/frontend/src/components/ProtectedRoute.jsx → HRMS (reba kuri iyi bro)/frontend/src/components/ProtectedRoute.jsx }

@@ -2,8 +2,8 @@ import React from 'react';
 import { Navigate } from 'react-router-dom';
 
 export default function ProtectedRoute({ children }) {
-  const token = localStorage.getItem('token');
-  if (!token) return <Navigate to="/login" replace />;
+  const user = localStorage.getItem('user');
+  if (!user) return <Navigate to="/login" replace />;
   return children;
 }
 

package/templates/HRMS (reba kuri iyi bro)/frontend/src/pages/CreateUser.jsx

@@ -0,0 +1,149 @@
+import { useEffect, useState } from 'react';
+import axios from 'axios';
+
+function CreateUser() {
+  const [employees, setEmployees] = useState([]);
+  const [selectedEmployeeId, setSelectedEmployeeId] = useState('');
+  const [password, setPassword] = useState('');
+  const [message, setMessage] = useState('');
+  const [error, setError] = useState('');
+  const [loading, setLoading] = useState(false);
+  const [user, setUser] = useState(null);
+
+  useEffect(() => {
+    const storedUser = localStorage.getItem('user');
+    if (storedUser) {
+      setUser(JSON.parse(storedUser));
+    }
+
+    axios
+      .get('http://localhost:5006/api/auth/me', {
+        withCredentials: true,
+      })
+      .then((response) => {
+        setUser(response.data.user);
+        localStorage.setItem('user', JSON.stringify(response.data.user));
+      })
+      .catch((err) => {
+        setError(err.response?.data?.message || 'Unable to verify admin rights');
+      });
+  }, []);
+
+  useEffect(() => {
+    if (!user || user.role !== 'admin') return;
+
+    axios
+      .get('http://localhost:5006/api/employees/list', {
+        withCredentials: true,
+      })
+      .then((response) => setEmployees(response.data))
+      .catch((err) => setError(err.response?.data?.message || 'Could not load employees'));
+  }, [user]);
+
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError('');
+    setMessage('');
+
+    if (!selectedEmployeeId) {
+      setError('Please select an existing employee.');
+      return;
+    }
+
+    if (password.length < 6) {
+      setError('Password must be at least 6 characters long.');
+      return;
+    }
+
+    setLoading(true);
+
+    try {
+      const response = await axios.post(
+        'http://localhost:5006/api/auth/users',
+        {
+          employeeId: selectedEmployeeId,
+          password,
+        },
+        {
+          withCredentials: true,
+        }
+      );
+
+      setMessage(`User account created for ${response.data.user.name}.`);
+      setSelectedEmployeeId('');
+      setPassword('');
+    } catch (err) {
+      setError(err.response?.data?.message || 'Failed to create user account');
+      console.error(err.response?.data || err.message);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  if (!user) {
+    return (
+      <div className="rounded-xl bg-white p-6 shadow-sm">
+        <h1 className="mb-4 text-2xl font-bold">Create User</h1>
+        <p className="text-sm text-gray-600">Loading your account...</p>
+      </div>
+    );
+  }
+
+  if (user.role !== 'admin') {
+    return (
+      <div className="rounded-xl bg-white p-6 shadow-sm">
+        <h1 className="mb-4 text-2xl font-bold">Access Denied</h1>
+        <p className="text-sm text-gray-600">Only admins can create dashboard users.</p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="rounded-xl bg-white p-6 shadow-sm">
+      <h1 className="mb-4 text-2xl font-bold">Create Dashboard User</h1>
+      <p className="mb-4 text-sm text-gray-600">
+        Choose an existing employee and assign a password. New users will be created with the <strong>user</strong> role.
+      </p>
+
+      {message && <p className="alert-success mb-4">{message}</p>}
+      {error && <p className="alert-error mb-4">{error}</p>}
+
+      <form onSubmit={handleSubmit} className="space-y-4">
+        <div>
+          <label className="mb-1 block text-sm font-medium">Employee</label>
+          <select
+            value={selectedEmployeeId}
+            onChange={(e) => setSelectedEmployeeId(e.target.value)}
+            className="input-field w-full"
+          >
+            <option value="">Select an employee</option>
+            {employees.map((employee) => (
+              <option key={employee._id} value={employee._id}>
+                {employee.firstName} {employee.lastName} — {employee.email}
+              </option>
+            ))}
+          </select>
+        </div>
+
+        <div>
+          <label className="mb-1 block text-sm font-medium">Password</label>
+          <input
+            type="password"
+            required
+            minLength={6}
+            placeholder="Enter a password for this user"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+            className="input-field w-full"
+          />
+        </div>
+
+        <button type="submit" disabled={loading} className="btn-primary w-full">
+          {loading ? 'Creating user...' : 'Create User'}
+        </button>
+      </form>
+    </div>
+  );
+}
+
+export default CreateUser;

package/templates/{index/frontend/src/pages/DashboardHome.jsx → HRMS (reba kuri iyi bro)/frontend/src/pages/DashboardHome.jsx }

@@ -8,11 +8,10 @@ function DashboardHome() {
   const [positions, setPositions] = useState([]);
 
   useEffect(() => {
-    const headers = { Authorization: `Bearer ${localStorage.getItem('token')}` };
     Promise.all([
-      axios.get('http://localhost:5006/api/departments/list', { headers }),
-      axios.get('http://localhost:5006/api/employees/list', { headers }),
-      axios.get('http://localhost:5006/api/positions/list', { headers }),
+      axios.get('http://localhost:5006/api/departments/list', { withCredentials: true }),
+      axios.get('http://localhost:5006/api/employees/list', { withCredentials: true }),
+      axios.get('http://localhost:5006/api/positions/list', { withCredentials: true }),
     ])
       .then(([deptRes, empRes, posRes]) => {
         setDepartments(deptRes.data);

package/templates/{index/frontend/src/pages/Department.jsx → HRMS (reba kuri iyi bro)/frontend/src/pages/Department.jsx }

@@ -6,12 +6,11 @@ function Department() {
   const [departmentName, setDepartmentName] = useState('');
   const [editingId, setEditingId] = useState(null);
   const [message, setMessage] = useState('');
-
-  const headers = { Authorization: `Bearer ${localStorage.getItem('token')}` };
+  const currentUser = JSON.parse(localStorage.getItem('user') || 'null');
 
   const getDepartments = async () => {
     try {
-      const res = await axios.get('http://localhost:5006/api/departments/list', { headers });
+      const res = await axios.get('http://localhost:5006/api/departments/list', { withCredentials: true });
       setDepartments(res.data);
     } catch (err) {
       console.error(err);
@@ -29,14 +28,14 @@ function Department() {
         await axios.put(
           `http://localhost:5006/api/departments/${editingId}`,
           { departmentName },
-          { headers }
+          { withCredentials: true }
         );
         setMessage('Department updated successfully');
       } else {
         await axios.post(
           'http://localhost:5006/api/departments/add',
           { departmentName },
-          { headers }
+          { withCredentials: true }
         );
         setMessage('Department added successfully');
       }
@@ -57,7 +56,7 @@ function Department() {
   const handleDelete = async (id) => {
     if (!window.confirm('Delete this department?')) return;
     try {
-      await axios.delete(`http://localhost:5006/api/departments/${id}`, { headers });
+      await axios.delete(`http://localhost:5006/api/departments/${id}`, { withCredentials: true });
       setMessage('Department deleted successfully');
       if (editingId === id) {
         setEditingId(null);
@@ -85,30 +84,37 @@ function Department() {
         <p className={isSuccess ? 'alert-success' : 'alert-error'}>{message}</p>
       )}
 
-      <form onSubmit={handleSubmit} className="mb-6 box space-y-4">
-        <h2 className="font-semibold">{editingId ? 'Edit Department' : 'Add Department'}</h2>
-        <div>
-          <label className="mb-1 block text-sm">Department Name</label>
-          <input
-            type="text"
-            value={departmentName}
-            onChange={(e) => setDepartmentName(e.target.value)}
-            className="input-field"
-            placeholder="e.g. Human Resources"
-            required
-          />
-        </div>
-        <div className="flex items-center gap-3">
-          <button type="submit" className="btn-primary">
-            {editingId ? 'Update Department' : 'Add Department'}
-          </button>
-          {editingId && (
-            <button type="button" className="btn-secondary" onClick={handleCancel}>
-              Cancel
+      {currentUser?.role === 'admin' ? (
+        <form onSubmit={handleSubmit} className="mb-6 box space-y-4">
+          <h2 className="font-semibold">{editingId ? 'Edit Department' : 'Add Department'}</h2>
+          <div>
+            <label className="mb-1 block text-sm">Department Name</label>
+            <input
+              type="text"
+              value={departmentName}
+              onChange={(e) => setDepartmentName(e.target.value)}
+              className="input-field"
+              placeholder="e.g. Human Resources"
+              required
+            />
+          </div>
+          <div className="flex items-center gap-3">
+            <button type="submit" className="btn-primary">
+              {editingId ? 'Update Department' : 'Add Department'}
             </button>
-          )}
+            {editingId && (
+              <button type="button" className="btn-secondary" onClick={handleCancel}>
+                Cancel
+              </button>
+            )}
+          </div>
+        </form>
+      ) : (
+        <div className="mb-6 box">
+          <h2 className="font-semibold">Departments (read-only)</h2>
+          <p className="text-sm text-gray-600">You have read-only access. Contact an admin for changes.</p>
         </div>
-      </form>
+      )}
 
       <div className="box">
         <h2 className="mb-3 font-semibold">Department List ({departments.length})</h2>
@@ -128,12 +134,16 @@ function Department() {
                   <tr key={dept._id}>
                     <td>{dept.departmentName}</td>
                     <td className="space-x-2">
-                      <button type="button" className="btn-secondary btn-small" onClick={() => handleEdit(dept)}>
-                        Edit
-                      </button>
-                      <button type="button" className="btn-danger btn-small" onClick={() => handleDelete(dept._id)}>
-                        Delete
-                      </button>
+                      {currentUser?.role === 'admin' && (
+                        <>
+                          <button type="button" className="btn-secondary btn-small" onClick={() => handleEdit(dept)}>
+                            Edit
+                          </button>
+                          <button type="button" className="btn-danger btn-small" onClick={() => handleDelete(dept._id)}>
+                            Delete
+                          </button>
+                        </>
+                      )}
                     </td>
                   </tr>
                 ))}
@@ -147,4 +157,4 @@ function Department() {
 }
 
 export default Department;
-
+

package/templates/{index/frontend/src/pages/Employee.jsx → HRMS (reba kuri iyi bro)/frontend/src/pages/Employee.jsx }

@@ -21,12 +21,11 @@ function Employee() {
   const [status, setStatus] = useState('on mission');
   const [department, setDepartment] = useState('');
   const [message, setMessage] = useState('');
-
-  const headers = { Authorization: `Bearer ${localStorage.getItem('token')}` };
+  const currentUser = JSON.parse(localStorage.getItem('user') || 'null');
 
   const getEmployees = async () => {
     try {
-      const res = await axios.get('http://localhost:5006/api/employees/list', { headers });
+      const res = await axios.get('http://localhost:5006/api/employees/list', { withCredentials: true });
       setEmployees(res.data);
     } catch (err) {
       console.error(err);
@@ -35,7 +34,7 @@ function Employee() {
 
   const getDepartments = async () => {
     try {
-      const res = await axios.get('http://localhost:5006/api/departments/list', { headers });
+      const res = await axios.get('http://localhost:5006/api/departments/list', { withCredentials: true });
       setDepartments(res.data);
     } catch (err) {
       console.error(err);
@@ -44,7 +43,7 @@ function Employee() {
 
   const getPositions = async () => {
     try {
-      const res = await axios.get('http://localhost:5006/api/positions/list', { headers });
+      const res = await axios.get('http://localhost:5006/api/positions/list', { withCredentials: true });
       setPositions(res.data);
     } catch (err) {
       console.error(err);
@@ -92,10 +91,10 @@ function Employee() {
       };
 
       if (editingId) {
-        await axios.put(`http://localhost:5006/api/employees/${editingId}`, payload, { headers });
+        await axios.put(`http://localhost:5006/api/employees/${editingId}`, payload, { withCredentials: true });
         setMessage('Employee updated successfully');
       } else {
-        await axios.post('http://localhost:5006/api/employees/add', payload, { headers });
+        await axios.post('http://localhost:5006/api/employees/add', payload, { withCredentials: true });
         setMessage('Employee added successfully');
       }
 
@@ -126,7 +125,7 @@ function Employee() {
   const handleDelete = async (id) => {
     if (!window.confirm('Delete this employee?')) return;
     try {
-      await axios.delete(`http://localhost:5006/api/employees/${id}`, { headers });
+      await axios.delete(`http://localhost:5006/api/employees/${id}`, { withCredentials: true });
       setMessage('Employee deleted successfully');
       if (editingId === id) {
         resetForm();
@@ -152,7 +151,8 @@ function Employee() {
         <p className={isSuccess ? 'alert-success' : 'alert-error'}>{message}</p>
       )}
 
-      <form onSubmit={handleSubmit} className="mb-6 box space-y-4">
+      {currentUser?.role === 'admin' ? (
+        <form onSubmit={handleSubmit} className="mb-6 box space-y-4">
         <h2 className="font-semibold">{editingId ? 'Edit Employee' : 'Add Employee'}</h2>
         <div className="grid gap-4 sm:grid-cols-2">
           <div>
@@ -304,7 +304,13 @@ function Employee() {
             </button>
           )}
         </div>
-      </form>
+        </form>
+      ) : (
+        <div className="mb-6 box">
+          <h2 className="font-semibold">Employees (read-only)</h2>
+          <p className="text-sm text-gray-600">You have read-only access. Contact an admin for changes.</p>
+        </div>
+      )}
 
       <div className="box">
         <h2 className="mb-3 font-semibold">Employee List ({employees.length})</h2>
@@ -344,12 +350,16 @@ function Employee() {
                     <td>{emp.position?.posName || 'N/A'}</td>
                     <td className="capitalize">{emp.status}</td>
                     <td className="space-x-2">
-                      <button type="button" className="btn-secondary btn-small" onClick={() => handleEdit(emp)}>
-                        Edit
-                      </button>
-                      <button type="button" className="btn-danger btn-small" onClick={() => handleDelete(emp._id)}>
-                        Delete
-                      </button>
+                      {currentUser?.role === 'admin' && (
+                        <>
+                          <button type="button" className="btn-secondary btn-small" onClick={() => handleEdit(emp)}>
+                            Edit
+                          </button>
+                          <button type="button" className="btn-danger btn-small" onClick={() => handleDelete(emp._id)}>
+                            Delete
+                          </button>
+                        </>
+                      )}
                     </td>
                   </tr>
                 ))}

package/templates/{index/frontend/src/pages/Login.jsx → HRMS (reba kuri iyi bro)/frontend/src/pages/Login.jsx }

@@ -17,8 +17,11 @@ function Login() {
     setLoading(true);
 
     try {
-      const response = await axios.post('http://localhost:5006/api/auth/login', { email, password });
-      localStorage.setItem('token', response.data.token);
+      const response = await axios.post(
+        'http://localhost:5006/api/auth/login',
+        { email, password },
+        { withCredentials: true }
+      );
       localStorage.setItem('user', JSON.stringify(response.data.user));
       setMessage('Login successful');
       navigate('/dashboard');
@@ -70,7 +73,7 @@ function Login() {
         </form>
 
         <p className="mt-4 text-center text-sm text-gray-600">
-          No account? <Link to="/register" className="text-blue-600 hover:underline">Register</Link>
+          If you do not have an account, ask your administrator to create one.
         </p>
       </div>
     </div>
@@ -78,4 +81,4 @@ function Login() {
 }
 
 export default Login;
-
+

package/templates/{index/frontend/src/pages/Position.jsx → HRMS (reba kuri iyi bro)/frontend/src/pages/Position.jsx }

@@ -7,12 +7,11 @@ function Position() {
   const [requiredQualification, setRequiredQualification] = useState('');
   const [editingId, setEditingId] = useState(null);
   const [message, setMessage] = useState('');
-
-  const headers = { Authorization: `Bearer ${localStorage.getItem('token')}` };
+  const currentUser = JSON.parse(localStorage.getItem('user') || 'null');
 
   const getPositions = async () => {
     try {
-      const res = await axios.get('http://localhost:5006/api/positions/list', { headers });
+      const res = await axios.get('http://localhost:5006/api/positions/list', { withCredentials: true });
       setPositions(res.data);
     } catch (err) {
       console.error(err);
@@ -30,14 +29,14 @@ function Position() {
         await axios.put(
           `http://localhost:5006/api/positions/${editingId}`,
           { posName, requiredQualification },
-          { headers }
+          { withCredentials: true }
         );
         setMessage('Position updated successfully');
       } else {
         await axios.post(
           'http://localhost:5006/api/positions/add',
           { posName, requiredQualification },
-          { headers }
+          { withCredentials: true }
         );
         setMessage('Position added successfully');
       }
@@ -61,7 +60,7 @@ function Position() {
   const handleDelete = async (id) => {
     if (!window.confirm('Delete this position?')) return;
     try {
-      await axios.delete(`http://localhost:5006/api/positions/${id}`, { headers });
+      await axios.delete(`http://localhost:5006/api/positions/${id}`, { withCredentials: true });
       setMessage('Position deleted successfully');
       if (editingId === id) {
         setEditingId(null);
@@ -91,7 +90,8 @@ function Position() {
         <p className={isSuccess ? 'alert-success' : 'alert-error'}>{message}</p>
       )}
 
-      <form onSubmit={handleSubmit} className="mb-6 box space-y-4">
+      {currentUser?.role === 'admin' ? (
+        <form onSubmit={handleSubmit} className="mb-6 box space-y-4">
         <h2 className="font-semibold">{editingId ? 'Edit Position' : 'Add Position'}</h2>
         <div>
           <label className="mb-1 block text-sm">Position Name</label>
@@ -125,7 +125,13 @@ function Position() {
             </button>
           )}
         </div>
-      </form>
+        </form>
+      ) : (
+        <div className="mb-6 box">
+          <h2 className="font-semibold">Positions (read-only)</h2>
+          <p className="text-sm text-gray-600">You have read-only access. Contact an admin for changes.</p>
+        </div>
+      )}
 
       <div className="box">
         <h2 className="mb-3 font-semibold">Position List ({positions.length})</h2>
@@ -147,12 +153,16 @@ function Position() {
                     <td>{pos.posName}</td>
                     <td>{pos.requiredQualification}</td>
                     <td className="space-x-2">
-                      <button type="button" className="btn-secondary btn-small" onClick={() => handleEdit(pos)}>
-                        Edit
-                      </button>
-                      <button type="button" className="btn-danger btn-small" onClick={() => handleDelete(pos._id)}>
-                        Delete
-                      </button>
+                      {currentUser?.role === 'admin' && (
+                        <>
+                          <button type="button" className="btn-secondary btn-small" onClick={() => handleEdit(pos)}>
+                            Edit
+                          </button>
+                          <button type="button" className="btn-danger btn-small" onClick={() => handleDelete(pos._id)}>
+                            Delete
+                          </button>
+                        </>
+                      )}
                     </td>
                   </tr>
                 ))}

package/templates/{index/frontend/src/pages/Register.jsx → HRMS (reba kuri iyi bro)/frontend/src/pages/Register.jsx }

@@ -18,12 +18,15 @@ function Register() {
     setLoading(true);
 
     try {
-      const response = await axios.post('http://localhost:5006/api/auth/register', {
-        name,
-        email,
-        password,
-      });
-      localStorage.setItem('token', response.data.token);
+      const response = await axios.post(
+        'http://localhost:5006/api/auth/register',
+        {
+          name,
+          email,
+          password,
+        },
+        { withCredentials: true }
+      );
       localStorage.setItem('user', JSON.stringify(response.data.user));
       setMessage('Account created successfully');
       navigate('/dashboard');
@@ -99,4 +102,4 @@ function Register() {
 }
 
 export default Register;
-
+

package/templates/{index/frontend/src/pages/Reports.jsx → HRMS (reba kuri iyi bro)/frontend/src/pages/Reports.jsx }

@@ -6,11 +6,9 @@ function Reports() {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState('');
 
-  const headers = { Authorization: `Bearer ${localStorage.getItem('token')}` };
-
   useEffect(() => {
     axios
-      .get('http://localhost:5006/api/reports/on-leave-by-department', { headers })
+      .get('http://localhost:5006/api/reports/on-leave-by-department', { withCredentials: true })
       .then((res) => setReport(res.data))
       .catch((err) => setError(err.response?.data?.message || 'Failed to load report'))
       .finally(() => setLoading(false));
@@ -91,4 +89,4 @@ function Reports() {
 }
 
 export default Reports;
-
+

package/templates/index/README.md

@@ -1,34 +0,0 @@
-Problems the new system is fixing
-
-Data duplication
-Slow manual processes
-Poor record tracking
-Data inconsistency
-Delayed reporting
-Difficulty retrieving information
-
-
-What the new system will do
-
-Manage employee records
-Record purchases
-Record sales
-Store data centrally
-Retrieve information quickly
-Generate accurate reports
-Support management decision-making
-Simple summary
-
-The web-based system will replace the manual system by centralizing employee, purchase, and sales records, reducing duplication, improving data consistency, speeding up operations, and producing accurate reports.
-
-//middleware 
-Middleware in the MERN stack is a function that runs between a client's request and the server's response.
-
-It is used to:
-
-Check authentication (JWT tokens)
-Validate data
-Handle errors
-Log requests
-Modify request/response objects
-

package/templates/index/backend/middleware/auth.js

@@ -1,27 +0,0 @@
-
-const jwt = require('jsonwebtoken');
-const User = require('../models/User');
-const JWT_SECRET = 'change_this_to_a_long_random_secret';
-
-exports.protect = async (req, res, next) => {
-  try {
-    const header = req.headers.authorization;
-
-    if (!header || !header.startsWith('Bearer ')) {
-      return res.status(401).json({ message: 'Not authorized' });
-    }
-
-    const token = header.split(' ')[1];
-    const decoded = jwt.verify(token, JWT_SECRET);
-    const user = await User.findById(decoded.userId).select('-password');
-
-    if (!user) {
-      return res.status(401).json({ message: 'Not authorized' });
-    }
-
-    req.user = user;
-    next();
-  } catch (err) {
-    return res.status(401).json({ message: 'Not authorized' });
-  }
-};

package/templates/index/backend/routes/authRoutes.js

@@ -1,11 +0,0 @@
-const express = require('express');
-const { register, login, getMe } = require('../controllers/authController');
-const { protect } = require('../middleware/auth');
-
-const router = express.Router();
-
-router.post('/register', register);
-router.post('/login', login);
-router.get('/me', protect, getMe);      
-
-module.exports = router;