Merge pull request #59 from Genesis-ISE-DSCE/fixes

Implement admin token authentication for food distribution API and UI

Author: Arpit529Srivastava

frontend/src/app/admin/food/[teamCode]/page.tsx

@@ -45,12 +45,20 @@ export default function FoodDistributionPage() {
   const teamCode = params.teamCode as string;
 
   // --- State Hooks ---
+  const [token, setToken] = useState<string>("");
+  const [inputToken, setInputToken] = useState<string>("");
   const [membersData, setMembersData] = useState<MemberList>([]);
   const [teamName, setTeamName] = useState('');
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
 
   // --- Data Fetching Effect ---
+  useEffect(() => {
+    // load token from localStorage
+    const stored = typeof window !== 'undefined' ? localStorage.getItem('admin_token') : null;
+    if (stored) setToken(stored);
+  }, []);
+
   useEffect(() => {
     if (!teamCode || teamCode === "undefined") {
       setLoading(false);
@@ -62,7 +70,9 @@ export default function FoodDistributionPage() {
       setLoading(true);
       setError(null);
       try {
-        const response = await fetch(`/api/admin/food/${teamCode}`);
+        const response = await fetch(`/api/admin/food/${teamCode}`, {
+          headers: token ? { Authorization: `Bearer ${token}` } : {},
+        });
         if (!response.ok) {
           const err = await response.json();
           throw new Error(err.message || 'Team not found');
@@ -85,8 +95,10 @@ export default function FoodDistributionPage() {
       }
     };
 
-    fetchTeam();
-  }, [teamCode]);
+    if (token) {
+      fetchTeam();
+    }
+  }, [teamCode, token]);
 
   // --- Update Handler ---
   const handleFoodToggle = async (
@@ -107,7 +119,7 @@ export default function FoodDistributionPage() {
     try {
       const response = await fetch('/api/admin/food/update', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
         body: JSON.stringify({
           docId: docId,
           field: field,
@@ -136,6 +148,60 @@ export default function FoodDistributionPage() {
   if (loading) { /* ... */ }
   if (error) { /* ... */ }
 
+  if (!token) {
+    return (
+      <div style={{ maxWidth: 420, margin: '64px auto', padding: 24 }}>
+        <Toaster />
+        <h2 style={{ fontSize: 24, fontWeight: 700, marginBottom: 12 }}>Admin Login</h2>
+        <p style={{ color: '#666', marginBottom: 16 }}>Enter the admin access token.</p>
+        <form
+          onSubmit={(e) => {
+            e.preventDefault();
+            const trimmed = inputToken.trim();
+            if (!trimmed) return;
+            localStorage.setItem('admin_token', trimmed);
+            setToken(trimmed);
+          }}
+          style={{ display: 'flex', gap: 8 }}
+        >
+          <input
+            type="password"
+            placeholder="Admin token"
+            value={inputToken}
+            onChange={(e) => setInputToken(e.target.value)}
+            style={{ flex: 1, padding: '10px 12px', border: '1px solid #ddd', borderRadius: 8 }}
+          />
+          <button
+            type="submit"
+            style={{
+              padding: '12px 32px',
+              borderRadius: 12,
+              background: 'linear-gradient(135deg, #FF0500 0%, #c53030 100%)',
+              color: 'white',
+              border: 'none',
+              fontWeight: 'bold',
+              textTransform: 'uppercase',
+              letterSpacing: '1px',
+              cursor: 'pointer',
+              transition: 'all 0.3s ease',
+              boxShadow: '0 4px 15px rgba(255, 5, 0, 0.4)'
+            }}
+            onMouseOver={(e) => {
+              e.currentTarget.style.transform = 'translateY(-2px)';
+              e.currentTarget.style.boxShadow = '0 6px 20px rgba(255, 5, 0, 0.6)';
+            }}
+            onMouseOut={(e) => {
+              e.currentTarget.style.transform = 'translateY(0)';
+              e.currentTarget.style.boxShadow = '0 4px 15px rgba(255, 5, 0, 0.4)';
+            }}
+          >
+            Continue
+          </button>
+        </form>
+      </div>
+    );
+  }
+
   return (
     <div className={styles.pageContainer}>
       <Toaster />

frontend/src/app/api/admin/food/[teamCode]/route.ts

@@ -1,11 +1,18 @@
 import { NextResponse } from 'next/server';
 import dbConnect from '@/lib/dbConnect';
 import FoodLog from '@/models/FoodLog';
-import mongoose from 'mongoose'; // <-- 1. Import mongoose
+// mongoose not needed here since FoodLog uses string _id
+
+function isAuthorized(request: Request): boolean {
+  const header = request.headers.get('authorization') || '';
+  const token = header.startsWith('Bearer ') ? header.slice(7) : '';
+  const expected = process.env.ADMIN_TOKEN || '';
+  return Boolean(expected) && token === expected;
+}
 
 // 2. Define an interface for the data returned by .lean()
 interface IFoodLog {
-  _id: mongoose.Types.ObjectId;
+  _id: string;
   name: string;
   teamName: string;
   teamId: string;
@@ -21,6 +28,9 @@ export async function GET(
   context: { params: Promise<{ teamCode: string }> }
 ) {
   try {
+    if (!isAuthorized(request)) {
+      return NextResponse.json({ message: 'Unauthorized' }, { status: 401 });
+    }
     const params = await context.params;
     const { teamCode } = params;
 
@@ -43,13 +53,8 @@ export async function GET(
       );
     }
 
-    // 3. Apply the type to the 'member' variable
-    const membersData = members.map((member: IFoodLog) => ({
-      ...member,
-      _id: member._id.toString(), // <-- This line will no longer error
-    }));
-
-    return NextResponse.json(membersData, { status: 200 });
+    // Data already has string _id; return as-is
+    return NextResponse.json(members, { status: 200 });
   } catch (error: unknown) { // <-- Also fixed the 'any' type error here
     let message = 'Internal server error';
     if (error instanceof Error) {

frontend/src/app/api/admin/food/update/route.ts

@@ -1,10 +1,20 @@
 import { NextResponse } from 'next/server';
 import dbConnect from '@/lib/dbConnect';
 import FoodLog from '@/models/FoodLog';
-import mongoose from 'mongoose';
+// No ObjectId casting; FoodLog uses string _id
+
+function isAuthorized(request: Request): boolean {
+  const header = request.headers.get('authorization') || '';
+  const token = header.startsWith('Bearer ') ? header.slice(7) : '';
+  const expected = process.env.ADMIN_TOKEN || '';
+  return Boolean(expected) && token === expected;
+}
 
 export async function POST(request: Request) {
   try {
+    if (!isAuthorized(request)) {
+      return NextResponse.json({ message: 'Unauthorized' }, { status: 401 });
+    }
     const { docId, field, status } = await request.json();
 
     if (!docId || !field || typeof status !== 'boolean') {
@@ -16,19 +26,10 @@ export async function POST(request: Request) {
 
     await dbConnect();
 
-    let result;
-    try {
-      result = await FoodLog.updateOne(
-        { _id: new mongoose.Types.ObjectId(docId) },
-        { [field]: status }
-      );
-    } catch (castError) {
-      console.warn('Casting to ObjectId failed, trying string match...');
-      result = await FoodLog.updateOne(
-        { _id: docId },
-        { [field]: status }
-      );
-    }
+    const result = await FoodLog.updateOne(
+      { _id: docId },
+      { [field]: status }
+    );
 
     if (result.matchedCount === 0) {
       return NextResponse.json({ message: 'Document not found' }, { status: 404 });

frontend/src/models/FoodLog.ts

@@ -1,6 +1,7 @@
 import mongoose from 'mongoose';
 
 const FoodLogSchema = new mongoose.Schema({
+  _id: { type: String },
   name: { type: String, required: true },
   teamName: { type: String, required: true },
   teamId: { type: String, required: true, index: true }, // Add index for fast lookup
@@ -13,4 +14,8 @@ const FoodLogSchema = new mongoose.Schema({
 });
 
 // Tell Mongoose to use the 'food1' collection
-export default mongoose.models.FoodLog || mongoose.model('FoodLog', FoodLogSchema, 'food1');
+// In dev/hot-reload, force recompile to pick up schema changes (string _id)
+if (mongoose.models.FoodLog) {
+  delete mongoose.models.FoodLog;
+}
+export default mongoose.model('FoodLog', FoodLogSchema, 'food1');