FoodOrder - Role-Based Food Ordering System

A full-stack web application that implements role-based access control (RBAC) and country-based restrictions for food ordering. Built with Next.js (frontend) and NestJS (backend).

🎯 Features

Core Functionality

• View Restaurants & Menu Items - Browse restaurants and their menus
• Create Orders - Add items to cart and create orders
• Checkout & Payment - Complete orders with payment method selection
• Order Management - Cancel orders (role-dependent)
• Payment Method Updates - Modify payment methods (role-dependent)

Role-Based Access Control (RBAC)

Role	View Restaurants	Create Orders	Place Orders	Cancel Orders	Update Payment
Admin	✅	✅	✅	✅	✅
Manager	✅	✅	✅	✅	✅
Member	✅	✅	❌	❌	❌

Country-Based Access Control

• India: Users can only access restaurants and data from India
• America: Users can only access restaurants and data from America
• Admin Exception: Admins can access data from all countries

👥 Demo Users

Name	Email	Role	Country	Password
Nick Fury	[email protected]	Admin	America	password123
Captain Marvel	[email protected]	Manager	India	password123
Captain America	[email protected]	Manager	America	password123
Thanos	[email protected]	Member	India	password123
Thor	[email protected]	Member	India	password123
Travis	[email protected]	Member	America	password123

🏗️ Architecture

Backend (NestJS)

backend/
├── src/
│   ├── entities/          # TypeORM entities
│   │   ├── user.entity.ts
│   │   ├── restaurant.entity.ts
│   │   ├── menu-item.entity.ts
│   │   ├── order.entity.ts
│   │   └── order-item.entity.ts
│   ├── auth/              # Authentication & Authorization
│   │   ├── auth.service.ts
│   │   ├── auth.controller.ts
│   │   ├── jwt.strategy.ts
│   │   ├── roles.guard.ts
│   │   └── country.guard.ts
│   ├── restaurants/       # Restaurant management
│   ├── orders/           # Order management
│   ├── dto/              # Data Transfer Objects
│   └── seed.ts           # Database seeding

Frontend (Next.js)

frontend/
├── src/
│   ├── app/              # Next.js App Router
│   │   ├── login/
│   │   ├── restaurants/
│   │   ├── cart/
│   │   └── orders/
│   ├── components/       # Reusable components
│   ├── contexts/         # React contexts
│   │   ├── AuthContext.tsx
│   │   └── CartContext.tsx
│   └── lib/              # Utilities
│       └── api.ts        # API client

🚀 Getting Started

Prerequisites

• Node.js (v18 or higher)
• npm or yarn

Installation

1. Clone the repository

git clone <repository-url>
cd food-ordering-app

2. Install Backend Dependencies

cd backend
npm install

3. Install Frontend Dependencies

cd ../frontend
npm install

Running the Application

1. Start the Backend Server

cd backend
npm run start:dev

The backend will run on http://localhost:3001

2. Seed the Database (First time only)

cd backend
npm run seed

3. Start the Frontend Server

cd frontend
npm run dev

The frontend will run on http://localhost:3000

🔧 Environment Variables

Backend (.env)

JWT_SECRET=your-secret-key
PORT=3001

Frontend (.env.local)

NEXT_PUBLIC_API_URL=http://localhost:3001

📊 Database Schema

The application uses SQLite with TypeORM. The database includes:

• Users: Authentication and role management
• Restaurants: Restaurant information with country association
• Menu Items: Food items belonging to restaurants
• Orders: Customer orders with status tracking
• Order Items: Individual items within orders

🔐 Security Features

Authentication

• JWT-based authentication
• Password hashing with bcrypt
• Token-based session management

Authorization

• Role-based access control (RBAC)
• Country-based data filtering
• Route-level protection
• API endpoint security

Guards

• JwtAuthGuard: Validates JWT tokens
• RolesGuard: Enforces role-based permissions
• CountryGuard: Implements country-based restrictions

🧪 Testing the Application

Test Scenarios

1. Admin Access

   • Login as Nick Fury
   • View restaurants from both countries
   • Place and cancel orders
   • Update payment methods

2. Manager Access

   • Login as Captain Marvel (India) or Captain America (America)
   • View restaurants only from their country
   • Manage orders from their region
   • Update payment methods for users in their country

3. Member Access

   • Login as Thanos, Thor, or Travis
   • View restaurants from their country only
   • Add items to cart but cannot place orders
   • Cannot cancel orders or update payment methods

📱 API Endpoints

Authentication

• POST /auth/login - User login
• POST /auth/register - User registration

Restaurants

• GET /restaurants - Get restaurants (filtered by country)
• GET /restaurants/:id - Get restaurant details
• GET /restaurants/:id/menu - Get restaurant menu items

Orders

• POST /orders - Create new order
• GET /orders - Get user orders (filtered by role/country)
• PUT /orders/:id/cancel - Cancel order (admin/manager only)
• PUT /orders/users/:userId/payment-method - Update payment method

🎨 UI/UX Features

• Responsive Design: Works on desktop and mobile
• Role Indicators: Clear visual indicators of user permissions
• Country Badges: Shows which country's data is being accessed
• Real-time Cart: Live cart updates with item counts
• Status Tracking: Visual order status indicators
• Error Handling: User-friendly error messages

🔄 State Management

• Authentication: React Context for user state
• Cart Management: React Context for shopping cart
• API State: TanStack Query for server state
• Local Storage: Persistent authentication tokens

📦 Technologies Used

Backend

• NestJS: Node.js framework
• TypeORM: Database ORM
• SQLite: Database
• JWT: Authentication
• bcrypt: Password hashing
• class-validator: Input validation

Frontend

• Next.js 15: React framework
• TypeScript: Type safety
• Tailwind CSS: Styling
• TanStack Query: Server state management
• Axios: HTTP client
• Lucide React: Icons

🚀 Deployment

Backend Deployment

1. Build the application: npm run build
2. Set environment variables
3. Run migrations/seeding
4. Start production server: npm run start:prod

Frontend Deployment

1. Build the application: npm run build
2. Set environment variables
3. Deploy to hosting platform (Vercel, Netlify, etc.)

📝 Additional Notes

• The application uses SQLite for simplicity, but can be easily configured for PostgreSQL, MySQL, etc.
• All API endpoints are protected with authentication
• Country-based filtering is implemented at the service level
• The frontend gracefully handles role-based UI rendering
• Error boundaries and loading states are implemented throughout

🤝 Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests if applicable
5. Submit a pull request

📄 License

This project is licensed under the MIT License.