plum-e2e 1.3.7 → 2.2.0

package/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   A ready-to-use E2E test automation environment built on <a href="https://playwright.dev">Playwright</a> + <a href="https://cucumber.io">Cucumber</a>.<br/>
-  Write tests in Gherkin, run them from the CLI or UI, and view reports — all in one place.
+  Write tests in Gherkin, run them from the CLI or UI, view reports, and manage your entire test case repository — all in one place.
 </p>
 
 ---
@@ -113,7 +113,23 @@ The first time you run it, Plum asks a few questions (press Enter to accept the
 | **Frontend (UI) port** | `5173`                    | Host port for the web UI                                                |
 | **Primary public URL** | `http://<your-ip>:<port>` | The address you give runner nodes (see [Runner Setup](#4-runner-setup)) |
 
-Your answers are saved to `.plum-server.json`, so the next `plum server start` reuses them without asking. When it finishes, open the UI at the frontend port it prints (default **http://localhost:5173**).
+Your answers are saved to `.plum-server.json`, so the next `plum server start` reuses them without asking.
+
+### First-user setup
+
+On the very first start, Plum detects that no user accounts exist and prompts you to create one:
+
+```
+No users found — create your first account to get started.
+✔ Your name … Jane Smith
+✔ Email address … jane@example.com
+✔ Password …
+✓ Account created for jane@example.com. You can now log in.
+```
+
+After that, open the UI at the frontend port it prints (default **http://localhost:5173**) and sign in. Additional users can be invited from **Settings → Account** or the **Settings → Users** page.
+
+> If you skip the CLI prompt, visit `http://localhost:5173/setup` in your browser to create the first account.
 
 > Docker must be running before you use this command. Plum builds and starts the backend, database, and UI automatically.
 
@@ -292,7 +308,49 @@ plum run-test --browser firefox          # run in a specific browser
 
 ---
 
-## 4. Runner Setup
+## 4. Test Repository
+
+Plum includes a built-in test case management system accessible from the **Test Repository** tab in the UI.
+
+### Test Suites and Cases
+
+Organise test cases into **suites**. Each suite and case gets an auto-assigned ID (e.g. `TS-001`, `TC-001`). The prefix is configurable in **Settings → Repository**.
+
+Each test case has:
+
+- **Title** and **Description**
+- **Priority** — Critical, High, Medium, or Low
+- **Test Steps** — an ordered table with columns: Action, Test Data, Expected Output
+- **Automated tag** — a Cucumber `@tag` name that links this case to an automated scenario (e.g. `test-login-1`)
+- **History** — a timeline of every result, from manual test runs and automated builds
+
+### Linking automated tests
+
+Set the **Automated tag** on a test case to match a Cucumber `@tag` in your feature files. After every automated run, Plum scans the results and:
+
+1. Marks matching cases as **automated**
+2. Records a pass/fail entry in the case's history
+
+```gherkin
+@test-login-1
+Scenario: User can log in with valid credentials
+```
+
+If `TC-042` has `automatedTag = test-login-1`, it will be marked automated and updated after each build — no manual linking required.
+
+### Test Runs
+
+Create a **Test Run** (e.g. "Sprint 12 regression") and drag test cases from the suite browser into the run. Then switch to **Execute** mode to step through each case and mark it pass / fail / blocked / skip.
+
+Results are recorded in the case's history and the run's progress bar updates in real time.
+
+### Migrating IDs
+
+If you change the test ID prefix (e.g. from `TC` to `CASE`), use **Settings → Repository → Run Migration** to rename all existing IDs at once. Cucumber tags in your code are intentionally left unchanged — update those separately.
+
+---
+
+## 5. Runner Setup
 
 Runners are additional machines that execute tests in parallel alongside the primary server, letting you distribute a large suite across many nodes. A node runs as a plain Node process — **no Docker required**.
 
@@ -384,6 +442,56 @@ Stops the node started from the current folder. You can also stop individual run
 
 ---
 
+## 6. Notifications (Discord & Slack)
+
+Plum can post a pass/fail summary to a Discord channel or Slack workspace after every automated or manual test run. The notification includes the job name, overall result, scenario counts, browser, tags, and a link to the full report.
+
+### Step 1 — Get a webhook URL
+
+**Discord:**
+
+1. Open your Discord server, right-click the target channel → **Edit Channel**
+2. Go to **Integrations → Webhooks → New Webhook**
+3. Copy the webhook URL
+
+**Slack:**
+
+1. Go to your workspace's [Slack App directory](https://api.slack.com/apps) → **Create New App → From scratch**
+2. Under **Features**, choose **Incoming Webhooks** and activate them
+3. Click **Add New Webhook to Workspace**, choose the channel, and copy the webhook URL
+
+### Step 2 — Configure in Plum
+
+1. Open the Plum UI and go to **Settings → Integrations**
+2. Paste your webhook URL(s) into the **Discord Webhook URL** and/or **Slack Webhook URL** fields
+3. Set **Public URL** to the base address of your Plum instance (e.g. `http://192.168.1.5:5173`). This is used to generate the "View Report" link in the notification. Leave it blank if you don't want report links included.
+4. Click **Save Integrations**
+
+### Step 3 — Enable notifications
+
+**Scheduled runs:**
+
+Open **Scheduled Tests**, click **Edit** (or **New Job**) on a job, and check the **Discord** and/or **Slack** boxes that appear at the bottom of the form. Each job has its own toggle so you can notify only on the jobs that matter.
+
+> The notification toggles only appear if the corresponding webhook URL is configured in Settings.
+
+**Manual runs:**
+
+When at least one webhook is configured, small **Discord** and **Slack** buttons appear in the runner panel at the bottom of every page. Click a button to highlight it — the notification will fire when the run finishes.
+
+### What the notification contains
+
+| Field       | Example                                                      |
+| ----------- | ------------------------------------------------------------ |
+| Job / Run   | `nightly-login-suite` or `Manual Run`                        |
+| Status      | ✅ PASS or ❌ FAIL                                           |
+| Results     | `42 / 45 passed`                                             |
+| Browser     | `chromium`                                                   |
+| Tags        | `@suite-login`                                               |
+| Report link | Button / link to the full HTML report (if Public URL is set) |
+
+---
+
 ## Command Reference
 
 | Command                       | Description                                                                    |

package/backend/app.js

@@ -39,6 +39,11 @@ if (process.env.PLUM_MODE !== 'node') {
 	app.use('/settings', require('./routes/settings.routes'));
 	app.use('/backup', require('./routes/backup.routes'));
 	app.use('/runners', require('./routes/runners.routes'));
+	app.use('/auth', require('./routes/auth.routes'));
+	app.use('/users', require('./routes/users.routes'));
+	app.use('/test-suites', require('./routes/test-suites.routes'));
+	app.use('/test-cases', require('./routes/test-cases.routes'));
+	app.use('/test-runs', require('./routes/test-runs.routes'));
 }
 
 module.exports = app;

package/backend/config/scripts/create-test.mjs

@@ -0,0 +1,172 @@
+/*
+ * This file is part of Plum.
+ *
+ * Plum is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Plum is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Plum. If not, see https://www.gnu.org/licenses/.
+ */
+
+import * as clack from '@clack/prompts';
+import pc from 'picocolors';
+import fs from 'fs';
+import path from 'path';
+
+const testsRoot = process.env.TESTS_ROOT || path.join(process.cwd(), 'tests');
+
+/* ------------------------------------------------------------------ */
+/*  Helpers                                                            */
+/* ------------------------------------------------------------------ */
+
+function toPascalCase(str) {
+	return str
+		.replace(/[-_\s]+(.)/g, (_, c) => c.toUpperCase())
+		.replace(/^(.)/, (c) => c.toUpperCase());
+}
+
+function toKebabCase(str) {
+	return str
+		.replace(/([A-Z])/g, (c) => `-${c.toLowerCase()}`)
+		.replace(/[-_\s]+/g, '-')
+		.replace(/^-/, '');
+}
+
+// Strip a trailing "Page" suffix so "CheckoutPage" → base "Checkout",
+// then we append "Page" ourselves — avoiding "CheckoutPagePage".
+function stripPageSuffix(pascal) {
+	return pascal.endsWith('Page') ? pascal.slice(0, -4) : pascal;
+}
+
+/* ------------------------------------------------------------------ */
+/*  File generators                                                    */
+/* ------------------------------------------------------------------ */
+
+function generateFeature(pascal, kebab, suiteTag, testTag) {
+	return `${suiteTag}
+Feature: ${pascal}
+
+  ${testTag}
+  Scenario: Example scenario
+    Given I am on the ${pascal} page
+    When I perform an action
+    Then I should see the expected result
+`;
+}
+
+function generatePage(base) {
+	return `import { page } from '../utils/browser';
+
+export class ${base}Page {
+  static async goTo() {
+    await page().goto(process.env.BASE_URL as string);
+  }
+
+  static async performAction() {
+    // TODO: implement
+  }
+
+  static async verifyResult() {
+    // TODO: implement
+  }
+}
+`;
+}
+
+function generateSteps(pascal, base, kebab) {
+	return `import { Given, When, Then } from '@cucumber/cucumber';
+import { ${base}Page } from '../pages/${base}Page';
+
+Given('I am on the ${pascal} page', async () => {
+  await ${base}Page.goTo();
+});
+
+When('I perform an action', async () => {
+  await ${base}Page.performAction();
+});
+
+Then('I should see the expected result', async () => {
+  await ${base}Page.verifyResult();
+});
+`;
+}
+
+/* ------------------------------------------------------------------ */
+/*  Main                                                               */
+/* ------------------------------------------------------------------ */
+
+async function main() {
+	clack.intro(pc.bgMagenta(pc.white('  🟣 Plum — Create Test  ')));
+
+	const rawName = await clack.text({
+		message: 'Feature name',
+		placeholder: 'Checkout, LoginPage, Cart…',
+		hint: 'Creates a .feature, Steps.ts and Page.ts',
+		validate: (v) => (!v.trim() ? 'Feature name is required' : undefined)
+	});
+	if (clack.isCancel(rawName)) {
+		clack.cancel('Cancelled.');
+		process.exit(0);
+	}
+
+	const pascal = toPascalCase(rawName.trim());
+	const base = stripPageSuffix(pascal); // "CheckoutPage" → "Checkout", "Cart" → "Cart"
+	const kebab = toKebabCase(pascal);
+	const suiteTag = `@suite-${kebab}`;
+	const testTag = `@test-${kebab}-1`;
+
+	const featurePath = path.join(testsRoot, 'features', `${pascal}.feature`);
+	const pagePath = path.join(testsRoot, 'pages', `${base}Page.ts`);
+	const stepsPath = path.join(testsRoot, 'step_definitions', `${pascal}Steps.ts`);
+
+	const conflicts = [featurePath, pagePath, stepsPath].filter(fs.existsSync);
+	if (conflicts.length > 0) {
+		clack.log.error('The following files already exist:');
+		conflicts.forEach((f) => clack.log.warn(`  ${path.relative(process.cwd(), f)}`));
+		clack.cancel('Delete them first or choose a different name.');
+		process.exit(1);
+	}
+
+	const s = clack.spinner();
+	s.start('Generating files…');
+
+	fs.mkdirSync(path.join(testsRoot, 'features'), { recursive: true });
+	fs.mkdirSync(path.join(testsRoot, 'pages'), { recursive: true });
+	fs.mkdirSync(path.join(testsRoot, 'step_definitions'), { recursive: true });
+
+	fs.writeFileSync(featurePath, generateFeature(pascal, kebab, suiteTag, testTag), 'utf8');
+	fs.writeFileSync(pagePath, generatePage(base), 'utf8');
+	fs.writeFileSync(stepsPath, generateSteps(pascal, base, kebab), 'utf8');
+
+	s.stop(pc.green('✓ Files created'));
+
+	const rel = (p) => path.relative(process.cwd(), p);
+
+	clack.note(
+		[
+			`${pc.dim('Feature:')}  ${pc.white(rel(featurePath))}`,
+			`${pc.dim('Page:')}     ${pc.white(rel(pagePath))}`,
+			`${pc.dim('Steps:')}    ${pc.white(rel(stepsPath))}`,
+			'',
+			`${pc.dim('Suite tag:')} ${pc.cyan(suiteTag)}`,
+			`${pc.dim('Test tag:')}  ${pc.cyan(testTag)}`,
+			'',
+			`${pc.bold('Run with:')}  ${pc.cyan(`plum run-test ${testTag}`)}`
+		].join('\n'),
+		`${pascal} scaffold`
+	);
+
+	clack.outro(pc.magenta('Done! Fill in your scenarios and implement the page methods.'));
+}
+
+main().catch((err) => {
+	clack.log.error(err.message);
+	process.exit(1);
+});

package/backend/config/scripts/generate-report.js

@@ -50,7 +50,8 @@ if (process.env.PLUM_MODE === 'node') process.exit(0);
 			nodeCount,
 			browser: process.env.BROWSER || 'chromium',
 			runnerName: process.env.RUNNER_NAME || null,
-			runnerId: process.env.RUNNER_ID || null
+			runnerId: process.env.RUNNER_ID || null,
+			testRunId: process.env.TEST_RUN_ID || null
 		});
 
 		console.log(`Report saved to database (id: ${saved.id})`);

package/backend/lib/runnerProcess.js

@@ -49,6 +49,34 @@ function saveRegistry(registry) {
 	fs.writeFileSync(REGISTRY_PATH, JSON.stringify(registry, null, 2), 'utf8');
 }
 
+/**
+ * Returns the PID of the process listening on the given TCP port, or null.
+ * Uses lsof on macOS/Linux and netstat on Windows.
+ */
+function findPidOnPort(port) {
+	const portStr = String(port);
+	try {
+		if (process.platform === 'win32') {
+			const out = execSync('netstat -ano', { encoding: 'utf8' });
+			for (const line of out.split('\n')) {
+				const upper = line.toUpperCase();
+				if (upper.includes(`:${portStr}`) && upper.includes('LISTENING')) {
+					const parts = line.trim().split(/\s+/);
+					const pid = parseInt(parts[parts.length - 1], 10);
+					if (!isNaN(pid) && pid > 0) return pid;
+				}
+			}
+		} else {
+			const out = execSync(`lsof -i :${portStr} -t -sTCP:LISTEN`, { encoding: 'utf8' }).trim();
+			if (out) {
+				const pid = parseInt(out.split('\n')[0].trim(), 10);
+				if (!isNaN(pid) && pid > 0) return pid;
+			}
+		}
+	} catch {}
+	return null;
+}
+
 // Signal 0 performs the OS-level permission/existence check without actually
 // delivering a signal — the portable way to ask "is this pid alive?".
 function isAlive(pid) {
@@ -128,7 +156,13 @@ function startNode({ id, port, token }) {
 
 	const child = spawn(process.execPath, [SERVER_PATH], {
 		cwd: BACKEND_DIR,
-		env: { ...process.env, NODE_TOKEN: token, PLUM_MODE: 'node', PORT: String(port) },
+		env: {
+			...process.env,
+			NODE_TOKEN: token,
+			PLUM_MODE: 'node',
+			PORT: String(port),
+			RUNNER_ID: String(id)
+		},
 		detached: true,
 		stdio: ['ignore', out, out],
 		windowsHide: true
@@ -146,14 +180,25 @@ function startNode({ id, port, token }) {
 /**
  * Stops the managed process for a runner. Returns true if a live process was
  * signalled, false if nothing was running.
+ *
+ * Falls back to port-based PID discovery when the registry entry is missing or
+ * its PID is stale, using the port stored in the entry or an explicit fallback.
  */
-function stopNode(id) {
+function stopNode(id, fallbackPort = null) {
 	const registry = loadRegistry();
 	const entry = registry[id];
 	let signalled = false;
-	if (entry?.pid && isAlive(entry.pid)) {
+
+	let pid = entry?.pid && isAlive(entry.pid) ? entry.pid : null;
+
+	if (!pid) {
+		const port = fallbackPort ?? (entry?.port ? Number(entry.port) : null);
+		if (port) pid = findPidOnPort(port);
+	}
+
+	if (pid) {
 		try {
-			process.kill(entry.pid, 'SIGTERM');
+			process.kill(pid, 'SIGTERM');
 			signalled = true;
 		} catch {}
 	}
@@ -171,6 +216,7 @@ module.exports = {
 	isAlive,
 	isLocalUrl,
 	parsePort,
+	findPidOnPort,
 	pruneDead,
 	statusOf,
 	prepareEnv,

package/backend/logs/runner-cmqneqerz0000qq01i5ap2rvl.log

@@ -0,0 +1,22 @@
+/*
+This file is part of Plum.
+
+Plum is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+Plum is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with Plum. If not, see https://www.gnu.org/licenses/.
+*/
+📂 Loading tests from: /Users/silverlunah/Projects/plum/backend/tests
+Backend running on port 3002 (node/runner mode)
+📂 Loading tests from: /Users/silverlunah/Projects/plum/backend/tests
+Backend running on port 3002 (node/runner mode)
+(node:14993) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
+(Use `node --trace-deprecation ...` to show where the warning was created)

package/backend/logs/runner-cmqnfv7kr0000r101aeocm8eu.log

@@ -0,0 +1,20 @@
+/*
+This file is part of Plum.
+
+Plum is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+Plum is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with Plum. If not, see https://www.gnu.org/licenses/.
+*/
+📂 Loading tests from: /Users/silverlunah/Projects/plum/backend/tests
+Backend running on port 3002 (node/runner mode)
+(node:23570) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
+(Use `node --trace-deprecation ...` to show where the warning was created)

package/backend/logs/runner-cmqnfvb560001r101qoi0phau.log

@@ -0,0 +1,43 @@
+/*
+This file is part of Plum.
+
+Plum is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+Plum is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with Plum. If not, see https://www.gnu.org/licenses/.
+*/
+📂 Loading tests from: /Users/silverlunah/Projects/plum/backend/tests
+node:events:487
+      throw er; // Unhandled 'error' event
+      ^
+
+Error: listen EADDRINUSE: address already in use :::3002
+    at Server.setupListenHandle [as _listen2] (node:net:2008:16)
+    at listenInCluster (node:net:2065:12)
+    at Server.listen (node:net:2170:7)
+    at start (/Users/silverlunah/Projects/plum/backend/server.js:54:9)
+    at Object.<anonymous> (/Users/silverlunah/Projects/plum/backend/server.js:120:1)
+    at Module._compile (node:internal/modules/cjs/loader:1829:14)
+    at Module._extensions..js (node:internal/modules/cjs/loader:1969:10)
+    at Module.load (node:internal/modules/cjs/loader:1552:32)
+    at Module._load (node:internal/modules/cjs/loader:1354:12)
+    at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
+Emitted 'error' event on Server instance at:
+    at emitErrorNT (node:net:2044:8)
+    at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {
+  code: 'EADDRINUSE',
+  errno: -48,
+  syscall: 'listen',
+  address: '::',
+  port: 3002
+}
+
+Node.js v25.9.0

package/backend/logs/runner-cmqnfvlm20002r101gsyqb837.log

@@ -0,0 +1,20 @@
+/*
+This file is part of Plum.
+
+Plum is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+Plum is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with Plum. If not, see https://www.gnu.org/licenses/.
+*/
+📂 Loading tests from: /Users/silverlunah/Projects/plum/backend/tests
+Backend running on port 3003 (node/runner mode)
+(node:23686) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
+(Use `node --trace-deprecation ...` to show where the warning was created)

package/backend/logs/runner-cmqnfvqfy0003r101fh41pzx3.log

@@ -0,0 +1,20 @@
+/*
+This file is part of Plum.
+
+Plum is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+Plum is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with Plum. If not, see https://www.gnu.org/licenses/.
+*/
+📂 Loading tests from: /Users/silverlunah/Projects/plum/backend/tests
+Backend running on port 3004 (node/runner mode)
+(node:23733) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
+(Use `node --trace-deprecation ...` to show where the warning was created)

package/backend/logs/runner-cmqnfvvwo0004r101q4dtqxd2.log

@@ -0,0 +1,20 @@
+/*
+This file is part of Plum.
+
+Plum is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+Plum is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with Plum. If not, see https://www.gnu.org/licenses/.
+*/
+📂 Loading tests from: /Users/silverlunah/Projects/plum/backend/tests
+Backend running on port 3005 (node/runner mode)
+(node:23776) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
+(Use `node --trace-deprecation ...` to show where the warning was created)

package/backend/middleware/jwtAuth.js

@@ -0,0 +1,33 @@
+/*
+ * This file is part of Plum.
+ *
+ * Plum is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Plum is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Plum. If not, see https://www.gnu.org/licenses/.
+ */
+
+const { verifyToken } = require('../services/userService');
+
+function jwtAuth(req, res, next) {
+	const auth = req.headers.authorization;
+	if (!auth || !auth.startsWith('Bearer ')) {
+		return res.status(401).json({ error: 'Unauthorized' });
+	}
+	try {
+		req.user = verifyToken(auth.slice(7));
+		next();
+	} catch {
+		return res.status(401).json({ error: 'Invalid or expired token' });
+	}
+}
+
+module.exports = { jwtAuth };

package/backend/middleware/requireAdmin.js

@@ -0,0 +1,25 @@
+/*
+ * This file is part of Plum.
+ *
+ * Plum is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Plum is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Plum. If not, see https://www.gnu.org/licenses/.
+ */
+
+function requireAdmin(req, res, next) {
+	if (req.user?.role !== 'admin') {
+		return res.status(403).json({ error: 'Admin access required' });
+	}
+	next();
+}
+
+module.exports = { requireAdmin };

package/backend/package.json

@@ -25,12 +25,14 @@
 		"@clack/prompts": "^1.5.1",
 		"@cucumber/cucumber": "^11.2.0",
 		"@prisma/client": "^6.19.3",
+		"bcryptjs": "^2.4.3",
 		"chai": "^4.3.6",
 		"chai-soft-assert": "^0.0.5",
 		"chokidar": "^5.0.0",
 		"cors": "^2.8.5",
 		"dotenv": "^16.4.7",
 		"express": "^4.21.2",
+		"jsonwebtoken": "^9.0.2",
 		"node-cron": "^3.0.3",
 		"picocolors": "^1.1.1",
 		"playwright": "^1.50.1",